On Mon, 12 Apr 2004 00:05, "Ed Street" <edstreet@street-tek.com> wrote:
> I have included 2 patches I needed to get apache-ssl working under SID.

+#needed to read /var/www
+r_dir_file(httpd_t, var_t)

This should not be needed, see the following in apache.fc:

/var/www                -d      system_u:object_r:httpd_sys_content_t

+allow httpd_t httpd_exec_t:dir { search };

I think it would be best to use the "--" type specifier on the httpd_exec_t lines so that we don't have a directory with that type, see the attached apache.fc.

For exec'ing httpd_exec_t and for creating the sock_file I added the following:
can_exec(httpd_t, httpd_exec_t)
file_type_auto_trans(httpd_t, var_run_t, httpd_var_run_t, sock_file)

I've attached my new Apache policy to this message, try it out and let me know how it goes.

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page



--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.



text/plain attachment: apache.fc



text/plain attachment: apache.te