[Bug 164992] New: Mod_proxy does not work with SElinux default policy

Daniel J Walsh dwalsh at redhat.com
Mon Aug 15 15:59:52 UTC 2005


Joe Orton wrote:

>On Mon, Aug 15, 2005 at 11:21:51AM -0400, Daniel J Walsh wrote:
>  
>
>>Latest policy has
>>
>>can_ldap(httpd_t)  which should allow httpd scripts to connect to the 
>>ldap port.  Could I give a similar connect to mysql to solve your problem?
>>    
>>
>
>That won't fix (2) or (3), either of which alone would be sufficient 
>justification to enable the boolean by default:
>
>reminder for 2 and 3:
>
>2) all mod_proxy configurations (reverse proxy, forward proxy)
>
>3) the parent connect()-to-listening-port "reap idle children"
>interface, which has the impact:
>
>joe
>
>--
>fedora-selinux-list mailing list
>fedora-selinux-list at redhat.com
>http://www.redhat.com/mailman/listinfo/fedora-selinux-list
>  
>
How about...

########################################
# Set up networking
########################################

can_network(httpd_t)
can_kerberos(httpd_t)
can_resolve(httpd_t)
can_ypbind(httpd_t)
can_ldap(httpd_t)
allow httpd_t { http_port_t http_cache_port_t }:tcp_socket name_bind;
# allow httpd to connect to mysql/posgresql
allow httpd_t { postgresql_port_t mysqld_port_t }:tcp_socket name_connect;
# allow httpd to work as a relay
allow httpd_t { gopher_port_t ftp_port_t http_port_t http_cache_port_t 
}:tcp_socket name_connect;


-- 





More information about the fedora-selinux-list mailing list