Security Enhanced Linux
What's New
Frequently Asked Questions
Background
Documents
License
Download
Participating
Mail List
Archives
Remaining Work
Contributors
Related Work
Press Releases
Information Assurance Research
NIARL In-house Research Areas
Mathematical Sciences Program
Sabbaticals
Computer & Information Sciences Research
Technology Transfer
Advanced Computing
Advanced Mathematics
Communications & Networking
Information Processing
Microelectronics
Other Technologies
Technology Fact Sheets
Publications
Related Links
|
SELinux Mailing ListRe: New policy for DCC
From: David Hampton <hampton-rh_at_rainbolthampton.net>
Date: Mon, 25 Apr 2005 07:14:41 -0400
> Firstly daemons should not be started with su. Agreed, but thats how the designer of DCC implemented it.
> Why do you use init_service_domain() and domain_auto_trans(initrc_t, Its started from /etc/init.d or by hand. I'll correct the policy to remove init_service_domain.
> Putting a unix domain socket in /etc is wrong. Among other things it will Agreed. This was moved from /var/dcc to /etc by the packager. I've submitted a patch to restore it to the /var/dcc directory. In the mean time I wrote the policy to work with either location.
> Types used under the /var/run directory generally should have the pidfile Thanks, will do.
> There is a type dccm_sock_t defined which is not in the .fc file. I missed this in my initial submission.
> Allowing access to sshd_t:fd is not what you want, you want to use privfd:fd Will do. I'll update this in all my policies.
> Without even knowing what DCC does Spam filtering based upon message checksums.
> I feel confident in guessing that it's not I have no problem reducing the number of domains. I got the impression somewhere that each executable should be its own domain. Would three domains be reasonable (the server, clients that connect to the server, everything else), or just two (executables that access the network and the utility programs)? David -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message.Received on Mon 25 Apr 2005 - 07:20:29 EDT |
|
Date Posted: Jan 15, 2009 | Last Modified: Jan 15, 2009 | Last Reviewed: Jan 15, 2009 |