httpd and tcp_connect

[Wart]

Daniel J Walsh wrote:
> The best solution would be to make a loadable policy module, and define 
> a new port,  something like
> 
> Create a te file like the following
> 
> #cat webapp.te
> policy_module(webapp, 1.0);
> 
> require {
>        type httpd_t;
> 
> };
> 
> type webapp_port_t;
> 
> allow httpd_t webapp_port_t:tcp_socket name_connect;
> # make -f /usr/share/selinux/targeted/include/Makefile webapp.pp
> # semodule -i webapp.pp
> # semanage port -a -t webapp_port_t -p tcp 19380-19383

Thanks for the tip.  This worked just fine.  Now that I have a working 
policy for this server + web application, I'm trying to get it all 
packaged up nicely.  I've got a policy that works, but to package it 
properly I'd have to split up rules between the webapp component and the 
server component, with dependencies between them.  I'm sure with some 
more work I could do this, but it starts to become trickier to package. 
  It seems like it would be much easier to manage if it were all part of 
the upstream selinux reference policy instead.

What is the best way to go about submitting new policies to be included 
in the reference policy?

--Mike