Adding two new booleans to httpd to tighten it's security.

Joe Orton jorton at
Mon Dec 12 11:02:47 UTC 2005

On Fri, Dec 09, 2005 at 03:58:14PM -0500, Daniel J Walsh wrote:
> Currently policy allows httpd to connect to relay ports and to 
> mysql/postgres ports.
> Adding these booleans
>    * httpd_can_network_relay
>    * httpd_can_network_connect_db
> And turning this feature off by default.  This is going into tonights 
> reference policy and into FC4 test release.

Do you mean FC4 or FC5?  This should not go in an FC4 update 
off-by-default since it will break working setups.  Make it 
on-by-default if you want to ship this to FC4 users and off-by-default 
with a big release note for FC5.

What's the difference between httpd_can_network_relay and 

Do we still have the problem that httpd cannot reap idle children 
properly when the latter is set?  That really really does need to work 
by default.


More information about the fedora-selinux-list mailing list