Re: Apache 2 file contexts

On Wed, 9 Oct 2002 17:25, Tom wrote:
> Apache2 requires some weird socket access, that I traced to the
> following (by disabling all the dontaudits in the apache.te):
>
> Oct 9 19:16:20 nsa2 kernel: avc: denied { read } for pid=5347
> exe=/usr/sbin/apache2 path=/1 dev=00:07 ino=3
> scontext=system_u:system_r:httpd_t tcontext=tom:object_r:sysadm_devpts_t
> tclass=chr_file
>
> piping that into newrules tells me:
>
> allow httpd_t sysadm_devpts_t:chr_file { read };

Most daemons do that. This is because they inherit file handles 0, 1, and 2 (stdin, stdout, stderr) from the shell. Some daemons can survive without such access, but many (most) can't.

In my tree for many daemons I have something like the following: allow daemon_t admin_tty_type:chr_file { read write };

I am going to devise a different solution to this, see the list archives for my previous messages on the topic.

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.