selinux-faq selinux-faq-it.xml,1.2,1.3
by fedora-docs-commits@redhat.com
Author: tombo
Update of /cvs/docs/selinux-faq
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv21141/selinux-faq
Modified Files:
selinux-faq-it.xml
Log Message:
updated for typos
Index: selinux-faq-it.xml
===================================================================
RCS file: /cvs/docs/selinux-faq/selinux-faq-it.xml,v
retrieving revision 1.2
retrieving revision 1.3
diff -u -r1.2 -r1.3
--- selinux-faq-it.xml 19 Nov 2005 21:56:49 -0000 1.2
+++ selinux-faq-it.xml 14 Dec 2005 06:47:27 -0000 1.3
@@ -172,7 +172,7 @@
sull'identit�� utente e il proprietario degli oggetti. Ogni utente e programma
eseguito da quell'utente ha completa discrezione sugli oggetti dell'utente.
Software malizioso o difettoso pu�� fare qualsiasi cosa con i files e
- le risosrse controllate attraverso l'utente che ha avviato i processi.
+ le risorse controllate attraverso l'utente che ha avviato i processi.
Se l'utente �� il super-user o l'applicazione ��
<command>setuid</command> o <command>setgid</command> root,
il processo pu�� avere un livello di controllo root sull'intero file
@@ -264,7 +264,7 @@
centinaia di problemi nella strict policy. In seguito, �� divenne
ovvio che applicare una singola strict policy ai molti ambienti
degli utenti &FED; non era fattibile. Amministrare una singola
- strict policy per qualsiasi cosa diversa dal'installazione standard
+ strict policy per qualsiasi cosa diversa dall'installazione standard
avrebbe richiesto un esperienza locale superiore.
</para>
<para>
@@ -397,7 +397,7 @@
</question>
<answer>
<para>
- La nuova opzione <option>-Z</option> �� il metodo piu immediato per
+ La nuova opzione <option>-Z</option> �� il metodo pi�� immediato per
mostrare il contesto di un soggetto o di un oggetto:
</para>
<screen>
@@ -417,7 +417,7 @@
<answer>
<para>
Non c'�� differenza fra un dominio ed un tipo, comunque
- il dominio �� qualche volta usato per riferisi al tipo di un processo.
+ il dominio �� qualche volta usato per riferirsi al tipo di un processo.
L'uso del dominio in questo modo discende dal tradizionale modello TE, dove
i domini ed i tipi sono separati.
</para>
@@ -471,7 +471,7 @@
<step>
<para>
Edita <filename>/etc/selinux/config</filename> e cambia il
- tipp di policy in
+ tipo di policy in
<computeroutput>SELINUXTYPE=<replaceable>policyname</replaceable></computeroutput>.
</para>
</step>
@@ -596,7 +596,7 @@
<para>
Usa <command>system-config-securitylevel</command> per controllare i
valori Booleani di specifici demoni. Per esempio, se ritieni
- di aver bisogno di sisabilitare &SEL; per Apache per eseguirlo correttamente nel tuo
+ di aver bisogno di disabilitare &SEL; per Apache per eseguirlo correttamente nel tuo
ambiente, puoi disabilitare il valore in
<command>system-config-securitylevel</command>. Questo disattiva la
transizione della policy definita in
@@ -642,7 +642,7 @@
<command>httpd</command> non �� consentito di leggere i tipi
di sicurezza per le directory ed i files che vengono creati nelle
directory home degli utenti. Per risolvere questo, cambiate i contesti
- di sicurezza della cartella e dei suoi contenuti ricursivamente usando
+ di sicurezza della cartella e dei suoi contenuti ricorsivamente usando
l'opzione <option>-R</option>:
</para>
<screen>
@@ -1012,7 +1012,7 @@
</screen>
<para>
Il contesto iniziale per una nuova directory utente ha un identit�� di
- <computeroutput>root</computeroutput>. In seguinto la rietichettatura del
+ <computeroutput>root</computeroutput>. In seguito la rietichettatura del
file system cambier�� l'identit�� a
<computeroutput>system_u</computeroutput>. Queste sono funzionalmente
le stesse poich�� il ruolo ed il tipo sono identici
@@ -1031,7 +1031,7 @@
<answer>
<para>
Il team di sviluppo di &FC; ha preso una direzione leggermente differente
- rispetto alla pratica di &SEL; esistente. Le transizioni del contesto di sicurzza adesso
+ rispetto alla pratica di &SEL; esistente. Le transizioni del contesto di sicurezza adesso
sono integrate in <command>su</command> via
<computeroutput>pam_selinux</computeroutput>. Questo semplifica
enormemente l'uso del sistema.
@@ -1328,7 +1328,7 @@
</para>
<para>
Installando o aggiornando i pacchetti della policy, la nuova policy
- verr�� caricata non appena intallati i nuovi files. In modo analogo, installando o aggiornando il
+ verr�� caricata non appena installati i nuovi files. In modo analogo, installando o aggiornando il
pacchetto di sorgenti della policy ricreer�� sia il file
<filename>policy.<replaceable>version</replaceable></filename>
che il file <filename>file_contexts</filename>, quindi
@@ -1379,7 +1379,7 @@
<qandaentry>
<question>
<para>
- I nuovi pacchetti policy potranno disabilitere il mio sistema?
+ I nuovi pacchetti policy potranno disabilitare il mio sistema?
</para>
</question>
<answer>
@@ -1419,7 +1419,7 @@
<para>
Il meglio su cui puoi scommettere �� dare un occhiata ai files di policy in <filename>/etc/selinux/<replaceable>policyname</replaceable>/src/policy/</filename>
e provare a sperimentare. Osserva i messaggi <computeroutput>avc
- denied</computeroutput> in <filename>/var/log/messages</filename> per avere degli indizzi.
+ denied</computeroutput> in <filename>/var/log/messages</filename> per avere degli indizi.
</para>
<para>
Uno strumento utile per uno scrittore di policy ��
@@ -1496,7 +1496,7 @@
applicazione KDE viene eseguita nel dominio per <command>kdeinit</command>.
</para>
<para>
- I problemi spesso vengono fuorui quando si installa &SEL; perch�� non ��
+ I problemi spesso vengono fuori quando si installa &SEL; perch�� non ��
possibile rietichettare <filename>/tmp</filename> e
<filename>/var/tmp</filename>. Non c'�� un buon metodo di
determinare quale file dovrebbe avere quale contesto.
@@ -1540,7 +1540,7 @@
</question>
<answer>
<para>
- Il file system deve supportare le estichette
+ Il file system deve supportare le etichette
<computeroutput>xattr</computeroutput> nel giusto
namespace <parameter>security.*</parameter>. Oltre a
ext2/ext3, XFS ha recentemente aggiunto il supporto per le necessarie
@@ -1568,7 +1568,7 @@
<qandaentry>
<question>
<para>
- Di che tipo di implementazioni/applicazioni/systemi, etc. dovr�� tener conto
+ Di che tipo di implementazioni/applicazioni/sistemi, etc. dovr�� tener conto
per l'uso con &SEL;?
</para>
</question>
@@ -1585,7 +1585,7 @@
In questi servers di nicchia, potrai bloccare la policy molto strettamente.
Questo sar�� facilitato dal piccolo numero di interazioni con
gli altri componenti. In modo simile, una macchina dedicata che
- esegue un applicazione specialistica di terze parti sar�� un buon cadidato.
+ esegue un applicazione specialistica di terze parti sar�� un buon candidato.
</para>
<para>
In futuro, &SEL; �� orientato a tutti gli ambienti. Per questo,
18 years, 5 months
selinux-apache Makefile,1.3,1.4 selinux-apache-it.xml,1.2,1.3
by fedora-docs-commits@redhat.com
Author: tombo
Update of /cvs/docs/selinux-apache
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv21067/selinux-apache
Modified Files:
Makefile selinux-apache-it.xml
Log Message:
Italian translation completed
Index: Makefile
===================================================================
RCS file: /cvs/docs/selinux-apache/Makefile,v
retrieving revision 1.3
retrieving revision 1.4
diff -u -r1.3 -r1.4
--- Makefile 15 Nov 2005 23:30:58 -0000 1.3
+++ Makefile 14 Dec 2005 06:24:15 -0000 1.4
@@ -8,7 +8,7 @@
# Copyright 2005 Tommy Reynolds, MegaCoder.com
###############################################################################
-LANGUAGES = en
+LANGUAGES = en it
DOCBASE = selinux-apache
XMLEXTRAFILES-en =
Index: selinux-apache-it.xml
===================================================================
RCS file: /cvs/docs/selinux-apache/selinux-apache-it.xml,v
retrieving revision 1.2
retrieving revision 1.3
diff -u -r1.2 -r1.3
--- selinux-apache-it.xml 12 Dec 2005 23:24:22 -0000 1.2
+++ selinux-apache-it.xml 14 Dec 2005 06:24:15 -0000 1.3
@@ -83,7 +83,7 @@
<section id="sn-getting-started">
<title>Cominciamo</title>
<note>
- <title>Questa guida �� specifica per &FC; &LOCALVER; or &RHEL;
+ <title>Questa guida �� specifica per &FC; &LOCALVER; o &RHEL;
&LOCALRHELVER;</title>
<para>
Mentre gran parte della teoria in questa guida �� applicabile ad altri
@@ -139,7 +139,7 @@
<para>
L'obbiettivo di sicurezza �� quello di essere sicuri che &APACHE; stia leggendo
solamente il contenuto Web statico, e non faccia altro come
- scrivere sui conenuti, connettersi ai sockets dei database, leggere
+ scrivere sui contenuti, connettersi ai sockets dei database, leggere
le home directories degli utenti, etc.
</para>
<para>
@@ -218,8 +218,8 @@
</para>
<para>
Quando hai usato
- <application>system-config-securitylevel</application> per impostare una
- bolena &SEL; che ha disattivato la capacit�� di &APACHE; di leggere le home
+ <application>system-config-securitylevel</application> per impostare la
+ booleana &SEL; che ha disattivato la capacit�� di &APACHE; di leggere le home
directories, ci�� ha assicurato che il
dominio <computeroutput>httpd_t</computeroutput> non abbia
i permessi di leggere lo
@@ -248,7 +248,7 @@
le informazioni di contesto associate con il file, mentre
<command>cp</command>, poich�� crea un nuovo file, eredita
quelle della directory genitore. Per esempio, questo �� il risultato
- dell'<command>mv</command> mensionato sopra:
+ dell'<command>mv</command> menzionato sopra:
</para>
<screen>
<command>ls -aZ /var/www/html/</command>
@@ -345,7 +345,7 @@
<step>
<para>
Avvia <application>system-config-securitylevel</application>. Nel
- tab <guilabel>&SEL;</guilabel>, apri il menu <guimenu>Apache</guimenu>
+ tab <guilabel>&SEL;</guilabel>, apri il men�� <guimenu>Apache</guimenu>
sotto <guilabel>Modifica la Policy di SELinux</guilabel>. Cambia
la booleana <guilabel>Permette ad httpd di leggere le home
directories</guilabel> attivandola. In alternativa, usa
@@ -409,7 +409,7 @@
</para>
<para>
Un idea chiave �� che attualmente sono coinvolti due
- livelli di sicurezza indipendenti. Ci sono i normail permessi Unix
+ livelli di sicurezza indipendenti. Ci sono i normali permessi Unix
(che modifichi con <command>chmod</command>),
e le etichette dei files di &SEL;, che modifichi con
<command>chcon</command>. Rendere semplicemente un file world-readable
@@ -461,12 +461,12 @@
</para>
<para>
Per un maggior approfondimento sulla discussione sulla filosofia dietro
- &SEL;, fa referimento a <citetitle>The Inevitability Of
+ &SEL;, fa riferimento a <citetitle>The Inevitability Of
Failure</citetitle> (<ulink url="http://www.nsa.gov/selinux/papers/inevit-abs.cfm">http://www.nsa.gov/selinux/papers/inevit-abs.cfm</ulink>.)
</para>
</section>
<section id="sn-suexec-and-cgi-scripts">
- <title>Hosting viryuale, CGI scripts e suEXEC</title>
+ <title>Hosting virtuale, CGI scripts e suEXEC</title>
<para>
La maggior parte delle installazioni di &APACHE; hanno qualche sorta di contenuto
dinamico; in particolare, gli scripts CGI sono molto comuni. Questa
@@ -625,7 +625,7 @@
<term><computeroutput>httpd_sys_script_rw_t</computeroutput></term>
<listitem>
<para>
- Contentenuti che uno script CGI pu�� cambiare in qualsiasi modo, inclusa
+ Contenuti che uno script CGI pu�� cambiare in qualsiasi modo, inclusa
la cancellazione.
</para>
</listitem>
@@ -655,7 +655,7 @@
booleana</firstterm> chiamata
<computeroutput>httpd_unified</computeroutput>. Se questa booleana
�� abilitata, questo vuol dire che
- <computeroutput>httpd_sys_content_t</computeroutput> (ol tipo
+ <computeroutput>httpd_sys_content_t</computeroutput> (il tipo
usato per ogni cosa fino a questo punto) �� trattato come
l'<emphasis>unione</emphasis> di tutti gli altri tipi succitati. Se
questa booleana �� disabilitata, vuol dire che (per esempio) un CGI script
@@ -672,7 +672,7 @@
La booleana <computeroutput>httpd_unified</computeroutput>
�� stata introdotta affinch�� chiunque possa, per la maggior parte, usare
una installazione tipica di &APACHE; senza conoscenza stretta sull'etichettatura
- dei files e dei contesti di sicurezza. Comunque, disabilitando questa boleana si garantisce
+ dei files e dei contesti di sicurezza. Comunque, disabilitando questa booleana si garantisce
una sicurezza di gran lunga superiore, ed �� caldamente raccomandato.
</para>
<para>
@@ -741,7 +741,7 @@
<para>
Il primo principale strumento per la personalizzazione delle policy ��
<command>system-config-securitylevel</command>. Esso
- possiede un certo numero di policy boolene:
+ possiede un certo numero di policy booleane:
</para>
<variablelist>
<title>Opzioni booleane per &APACHE;</title>
@@ -839,7 +839,7 @@
</para>
<para>
In altre parole, il CGI script in Python sta provando a scrivere in
- una directory che �� contrassegnata di sola lettura. Ci sono diverse ragioni percui ci�� pu��
+ una directory che �� contrassegnata di sola lettura. Ci sono diverse ragioni per cui ci�� pu��
accadere; potrebbe essere che lo script sia misconfigurato o bacato, per
esempio. Ma in questo caso particolare, viene fuori che
l'interprete Python normalmente usa generare
@@ -910,7 +910,7 @@
</step>
</procedure>
<caution>
- <title>Analizza l'output di <command>audit2allow</command> con attezione</title>
+ <title>Analizza l'output di <command>audit2allow</command> con attenzione</title>
<para>
Non dovrai semplicemente mettere tutto l'output di
<command>audit2allow</command> nel tuo
@@ -952,7 +952,7 @@
<computeroutput>httpd_user_script_ro_t</computeroutput> e
<computeroutput>httpd_staff_script_exec_t</computeroutput>.
Questo fornisce una pi�� forte, mandatoria separazione tra gli
- utenti, administratori, ed il sistema. Un utente ordinario ��
+ utenti, amministratori, ed il sistema. Un utente ordinario ��
prevenuto dal leggere il contenuto Web di sistema direttamente, ed un
compromesso o misconfigurato script CGI di sistema �� prevenuto dal
leggere il contenuto di un utente.
@@ -994,7 +994,7 @@
<para>
La
<computeroutput>define(`apache_domain',`</computeroutput>
- cominica la definizione della macro. All'interno della definizione, il
+ comincia la definizione della macro. All'interno della definizione, il
<computeroutput>$1</computeroutput> rappresenta il parametro
passato alla macro.
</para>
@@ -1070,7 +1070,7 @@
</step>
<step>
<para>
- Definisci nuovi tipi per i contenuti. Cio che segue mostra
+ Definisci nuovi tipi per i contenuti. Ci�� che segue mostra
un tipo sola-lettura ed un tipo sola scrittura, ma puoi facilmente
definirne differenti, tipi pi�� raffinati. Dopo averli
definiti, garantisci al tuo dominio CGI l'accesso a quelli che
@@ -1160,11 +1160,11 @@
<title>Sottodomini HTTP multipli</title>
<para>
Nell'installazione hosting virtuale descritta in <xref
- linkend="sn-suexec-and-cgi-scripts"/>, una compromisione o
+ linkend="sn-suexec-and-cgi-scripts"/>, una compromissione o
misconfigurazione del server principale &APACHE;
(<computeroutput>httpd_t</computeroutput>) significa che tutti i siti sono
- affetti. Sarebbe bello se tu potessi attalmente avere
- servers &APACHE; multipli, ogniuno eseguito nel proprio dominio;
+ affetti. Sarebbe bello se tu potessi attualmente avere
+ servers &APACHE; multipli, ognuno eseguito nel proprio dominio;
per esempio,
<computeroutput>httpd_<replaceable>site</replaceable>_t</computeroutput>.
Questa sottosezione discute semplicemente i problemi e ne delinea
@@ -1192,7 +1192,7 @@
abbastanza fortunato da avere un indirizzo ip per dominio, un
approccio �� semplicemente di copiare il
binario <computeroutput>/usr/sbin/httpd</computeroutput>
- tutte le volte, ma rietichettando ogniuno differentemente:
+ tutte le volte, ma rietichettando ognuno differentemente:
</para>
<screen>
<command> ls -aZ /usr/sbin/httpd.*</command>
@@ -1247,7 +1247,7 @@
webmaster, in questo tipo di installazione stai contando interamente sulla policy
&SEL;. C'�� molto altre da fare qui (rendere gli init scripts funzionanti
sar�� un po macchinoso), ma questo delinea l'idea generale.
- Il resto ti �� lasciato come un esercizio.
+ Il resto ti �� lasciato come esercizio.
</para>
</section>
</section>
18 years, 5 months
documentation-guide Makefile, 1.10, 1.11 acknowledgments-en.xml, 1.8, 1.9 docs-getting-files-en.xml, 1.8, 1.9 documentation-guide-en.xml, 1.21, 1.22 docs-converting-en.xml, 1.1, NONE docs-converting-zh_CN.xml, 1.1, NONE
by fedora-docs-commits@redhat.com
Author: jtr
Update of /cvs/docs/documentation-guide
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv1242
Modified Files:
Makefile acknowledgments-en.xml docs-getting-files-en.xml
documentation-guide-en.xml
Removed Files:
docs-converting-en.xml docs-converting-zh_CN.xml
Log Message:
Added documentation about the document building system. Dropped the
one-line "converting" chapter by creating a "Prerequisites" section
in the "getting-files" section.
Index: Makefile
===================================================================
RCS file: /cvs/docs/documentation-guide/Makefile,v
retrieving revision 1.10
retrieving revision 1.11
diff -u -r1.10 -r1.11
--- Makefile 10 Dec 2005 20:21:04 -0000 1.10
+++ Makefile 13 Dec 2005 21:56:24 -0000 1.11
@@ -1,15 +1,19 @@
-###############################################################################
+#######################################################################
# Makefile for RHLP docs project
# Created by: Tammy Fox <tfox(a)redhat.com>
# Last edited by: Tammy Fox <tfox(a)redhat.com>
# WARNING: need passivetex 1.24 for pdf generation to work
# License: GPL
# Copyright 2003 Tammy Fox, Red Hat, Inc.
-###############################################################################
+#######################################################################
LANGUAGES = en zh_CN
DOCBASE = documentation-guide
-XMLEXTRAFILES-en =
+XMLEXTRAFILES-en=acknowledgments-en.xml docs-emacs-en.xml \
+ docs-emacs-nxml-en.xml docs-getting-files-en.xml \
+ docs-intro-en.xml docs-rh-guidelines-en.xml docs-style-en.xml \
+ docs-tutorial-en.xml docs-vim-en.xml docs-xml-tags-en.xml \
+ documentation-guide-en.xml
######################################################
include ../docs-common/Makefile.common
Index: acknowledgments-en.xml
===================================================================
RCS file: /cvs/docs/documentation-guide/acknowledgments-en.xml,v
retrieving revision 1.8
retrieving revision 1.9
diff -u -r1.8 -r1.9
--- acknowledgments-en.xml 13 Sep 2004 02:14:06 -0000 1.8
+++ acknowledgments-en.xml 13 Dec 2005 21:56:24 -0000 1.9
@@ -37,4 +37,9 @@
linkend="s1-xml-tags-screen"></xref>.
</para>
+ <para>
+ A patch from Tommy Reynolds (Tommy.Reynolds at MegaCoder.com) has been
+ applied to more fully explaing the document building system.
+ </para>
+
</chapter>
Index: docs-getting-files-en.xml
===================================================================
RCS file: /cvs/docs/documentation-guide/docs-getting-files-en.xml,v
retrieving revision 1.8
retrieving revision 1.9
diff -u -r1.8 -r1.9
--- docs-getting-files-en.xml 19 Sep 2005 00:00:31 -0000 1.8
+++ docs-getting-files-en.xml 13 Dec 2005 21:56:24 -0000 1.9
@@ -1,83 +1,389 @@
<!-- $Id: -->
<!--
<!DOCTYPE chapter PUBLIC "-//OASIS//DTD DocBook V4.2//EN"
- "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [
+"http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [
- <!ENTITY BOILERPLATE "This header makes editing XML easier" >
+<!ENTITY BOILERPLATE "This header makes editing XML easier" >
+<!ENTITY FDPX "Fedora Docs Project" >
+<!ENTITY FED "Fedora" >
]>
-->
<chapter id="ch-getting-files">
- <title>Getting the Files</title>
+ <title>Prerequisites</title>
+ <para>
+ Before you being working with the &FED; documents, you must have certain tools and packages installed on your system.
+ The directions below will help you configure your setup.
+ </para>
+
+ <section id="ch-getting-files-system-packages">
+ <title>System Packages</title>
<para>
- To start working on the Docs Project, you will need the appropriate
- DocBook XML files, stylesheets, and scripts. The following packages are
- required:
- </para>
+ To start working on the Docs Project, you will need the appropriate DocBook XML files, stylesheets, and scripts.
+ The following packages are required:
+ </para>
<itemizedlist>
<listitem>
- <para><filename>xmlto</filename> — for producing HTML and PDF outputs</para>
+ <para>
+ <filename>xmlto</filename> — for producing HTML and PDF outputs.
+ </para>
</listitem>
<listitem>
- <para><filename>docbook-style-xsl</filename> — for the default XSLT stylesheets we
- build on</para>
+ <para>
+ <filename>docbook-style-xsl</filename> — for the default XSLT stylesheets we build on.
+ </para>
</listitem>
<listitem>
- <para><filename>docbook-dtds</filename> — XML versions of the DocBook DTD</para>
+ <para>
+ <filename>docbook-dtds</filename> — XML versions of the DocBook DTD
+ </para>
</listitem>
</itemizedlist>
<para>
- The custom scripts and stylesheets used are all stored in CVS on the
- <computeroutput>cvs.fedora.redhat.com</computeroutput> CVS server.
- You need to check them out along with the DocBook XML files for the
- existing docs.
- </para>
+ You can verify these packages are on your system by:
+ </para>
+
+ <screen>
+ <userinput>
+rpm -q xmlto
+rpm -q docbook-style-xsl
+rpm -q docbook-dtds
+</userinput>
+ </screen>
<para>
- You should perform these steps only once, when you first make a checkout
- from docs CVS. When you see the password prompt, press the
- <keycap>Enter</keycap> key.
- </para>
+ Any missing package can be installed using <application>yum(8)</application> this way:
+ </para>
+
+ <screen>
+ <userinput>
+su -c 'yum install xmlto'
+su -c 'yum install docbook-style-xsl'
+su -c 'yum install docbook-dtds'
+</userinput>
+ </screen>
+ </section>
+ <section id="ch-getting-files-fdp">
+ <title>Fedora Documentation Tools</title>
+
+ <para>
+ You need perform these steps only once.
+ These files are common to all the &FDPX; documents.
+ </para>
+
+ <para>
+ The custom scripts and stylesheets used are all stored in CVS on the <computeroutput>cvs.fedora.redhat.com</computeroutput> CVS server.
+ You need to check them out along with the DocBook XML files for the existing docs.
+ </para>
-<screen>
-<userinput>mkdir my-fedora-docs
-cd my-fedora-docs
+ <para>
+ When you see the password prompt, press the <keycap>Enter</keycap> key.
+ In the example below, we also show how to obtain a copy of an existing &FDPX; document.
+ </para>
+
+ <screen>
+<userinput>mkdir my-fedora-docs-sandbox
+cd my-fedora-docs-sandbox
export CVSROOT=:pserver:anonymous@cvs.fedora.redhat.com:/cvs/docs
cvs login
cvs co docs-common
cvs co example-tutorial</userinput>
</screen>
-
+ </section>
+ <section id="ch-getting-files-filenames">
+ <title>Filename Conventions</title>
<para>
- When you perform an anonymous CVS checkout, you can view the files and
- retreive the latest versions. You cannot add (commit) any updates or new
- files back to the repository. To commit changes to CVS, you must have
- <abbrev>CVS</abbrev> write access. Refer to <ulink
- url="http://fedoraproject.org/wiki/DocsProject/NewWriters"/> to learn
- about getting write access to <abbrev>CVS</abbrev>.
+ &FDPX; provides the tools, scripts, and stylesheets to transform your <abbrev>XML</abbrev> documents into either <abbrev>HTML</abbrev> or <abbrev>PDF</abbrev> output formats.
+ In addition, your document can automatically be built into an <abbrev>RPM</abbrev> package.
</para>
-
<para>
- To see a list of the available documents:
+ To take advantage of these services, you should follow our conventions for naming your files.
+ While you may choose whatever filenames you like, adopting our practices will make your life simpler.
+ Of course, if you are bringing your own document into our building system, changing hundreds of filenames may seem quite a burden; relax, we can use your filenames with just a little work on your part.
+ Read on to find out how.
</para>
-
-<screen><userinput>cvs co -c</userinput></screen>
-
+ <section id="ch-getting-files-filenames-doc">
+ <title>Document Filenames</title>
+ <para>
+ Each document lives in a peer directory to the <filename>docs-common</filename> directory you extracted from the &FED; archive earlier.
+ Name your document directory something related to its subject, just avoid any name already taken.
+ The <userinput>cvs co -c</userinput> command mentioned earlier will show you the names already taken.
+ </para>
+ </section>
+ <section id="ch-getting-files-i18n">
+ <title>Anticipating I18N Translation</title>
+ <para>
+ The &FDPX; includes an active translation team.
+ Project documents are often translated into several languages.
+ By convention, the translated files share the directory with the original files; filenames must be unique.
+ </para>
+ <para>
+ &FDPX; filenames are constructed appending a dash followed by the <abbrev>ISO</abbrev> language symbol before any file extention.
+ For example, a file whose language content is <abbrev>US</abbrev> English could be named <filename>mydoc-en.xml</filename>; the file containing its Chinese translation would then be named <filename>mydoc-zh_CN.xml</filename>, and so on.
+ </para>
+ <para>
+ To assist this effort, the document build system assumes that each file is tagged with its <abbrev>I18N</abbrev> locale.
+ Our filename convention is shown in <xref linkend="ch-getting-files-i18n-table"/>
+ </para>
+ <table id="ch-getting-files-i18n-table">
+ <title>&FDPX; Filename Conventions</title>
+ <tgroup cols="2">
+ <colspec align="right" colnum="1" colwidth="*1"/>
+ <colspec colnum="2" colwidth="*5"/>
+ <thead>
+ <row>
+ <entry>
+ <phrase>Compoment</phrase>
+ </entry>
+ <entry>
+ <phrase>Description</phrase>
+ </entry>
+ </row>
+ </thead>
+ <tbody>
+ <row>
+ <entry>
+ <phrase><replaceable>anything_but_dash</replaceable></phrase>
+ </entry>
+ <entry>
+ <para>
+ The initial portion of a filename can be anything, as long as <emphasis>no dash</emphasis> is used.
+ </para>
+ </entry>
+ </row>
+ <row>
+ <entry>
+ <phrase><filename>-</filename></phrase>
+ </entry>
+ <entry>
+ <para>
+ A dash (<filename>-</filename>) is to be used only to introduce the <systemitem class="macro">${LANG}</systemitem> filename component.
+ </para>
+ </entry>
+ </row>
+ <row>
+ <entry>
+ <phrase><systemitem class="macro">${LANG}</systemitem></phrase>
+ </entry>
+ <entry>
+ <para>
+ The <systemitem class="macro">${LANG}</systemitem> component identifies the <wordasword>locale</wordasword> for the file content.
+ </para>
+ <para>
+ In addition to helping classify files according to their language content, we also use the <systemitem class="macro">${LANG}</systemitem> value as an <abbrev>UTF-8</abbrev> locale when rendering the document.
+ For example, the document <filename>mydoc-it.xml</filename>will be rendered using <systemitem class="resource">it.UTF-8</systemitem> as the language environment.
+ </para>
+ <para>
+ For more information on <abbrev>I18N</abbrev> localization, visit the <ulink url="http://www.openi18n.org"/> web site.
+ </para>
+ </entry>
+ </row>
+ </tbody>
+ </tgroup>
+ </table>
+ <warning>
+ <title>Document Filenames Are Special</title>
+ <para>
+ The main file in your document <emphasis>must</emphasis> follow the file naming convention or the document building system cannot find it.
+ </para>
+ </warning>
+ </section>
+ </section>
+ <section id="ch-getting-files-build-system">
+ <title>The Document Build System</title>
<para>
- Pick your document of interest and then download it to your working directory:
+ Common tasks such as rendering the document into either <abbrev>HTML</abbrev> or <abbrev>PDF</abbrev> can be performed easily using the document building system.
</para>
-
-<screen><userinput>cvs co example-tutorial</userinput></screen>
-
<para>
- Except for the <citetitle>&IG;</citetitle>, all documentation in CVS must
- be tutorials written in DocBook XML article format using the template in
- the <filename>example-tutorial</filename> directory. Each tutorial
- <emphasis>must</emphasis> be in its own directory. No XML files should be
- in the root directory.
+ The building system heavily leverages the <application>make(1)</application> tool and shell scripts to automate these activities, but authors need <emphasis>no</emphasis> prior experience with either shell scripts or a <filename>Makefile</filename>.
+ While individual documents do have their own <filename>Makefile</filename>, it is only a few lines long and very simple.
+ The document <filename>Makefile</filename> content is designed for cut's paste.
</para>
-
- </chapter>
+ <para>
+ As an example, <xref linkend="ch-getting-files-build-system-makefile"/> shows the whole <filename>Makefile</filename> for a simple document having only one file and one language.
+ </para>
+ <example id="ch-getting-files-build-system-makefile">
+ <title>Sample Document Makefile</title>
+<programlisting width="60">
+DOCBASE = mydoc
+LANGUAGES = en
+XMLEXTRAFILES-en=
+include ../docs-common/Makefile.common
+</programlisting>
+</example>
+ <para>
+ Our main <abbrev>XML</abbrev> file is <filename>mydoc-en.xml</filename>; no translation has been done yet.
+ </para>
+ <para>
+ The <systemitem class="macro">LANGUAGES</systemitem> definition lists the English locale <literal>en</literal>; when other translations become available, their locale will just be appended to this definition.
+ </para>
+ <para>
+ Our document has only the main file <filename>mydoc-en.xml</filename>, but other documents may be split over several files.
+ The <systemitem class="macro">XMLEXTRAFILES-en</systemitem> definition catalogs these additional files so that the document building system can watch them for changes and rebuild the document when necesssary.
+ This definition is just a simple list of files.
+ </para>
+ <para>
+ The final line, beginning with <literal>include</literal>, references the main <filename>Makefile</filename> for the build system.
+ The <filename>Makefile.common</filename> file contains all the <application>make(1)</application> targets and rules to actually build the document and the various archives.
+ </para>
+ <para>
+ Add new document translations by:
+ </para>
+ <orderedlist>
+ <listitem>
+ <para>
+ Add the translated document files to the document directory.
+ Be sure to use the proper <systemitem class="macro">${LANG}</systemitem> filename component to keep the filenames similar, but unique.
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ Edit the <filename>Makefile</filename> to append the new <systemitem class="macro">${LANG}</systemitem> to the <systemitem class="macro">LANGUAGES</systemitem> definition.
+ </para>
+ </listitem>
+ <listitem>
+ <para>
+ Create a new <systemitem class="macro">XMLEXTRAFILES-${LANG}</systemitem> definition that references any document files other than the base file.
+ </para>
+ </listitem>
+ </orderedlist>
+ <section id="ch-getting-files-build-system-targets">
+ <title>Build System Actions</title>
+ <para>
+ To render the <abbrev>XML</abbrev> document into <abbrev>HTML</abbrev> or <abbrev>PDF</abbrev> the command: <userinput>make html</userinput>,
+ <userinput>make html-nochunk</userinput>, or <userinput>make pdf</userinput> may be used.
+ </para>
+ <para>
+ <xref linkend="ch-getting-files-build-system-targets-table"/> lists the defined build system targets.
+ </para>
+ <table id="ch-getting-files-build-system-targets-table">
+ <title>Document Building Targets</title>
+ <tgroup cols="2">
+ <colspec align="right" colnum="1" colwidth="*1"/>
+ <colspec colnum="2" colwidth="*5"/>
+ <thead>
+ <row>
+ <entry><phrase>Target</phrase></entry>
+ <entry><phrase>Description</phrase></entry>
+ </row>
+ </thead>
+ <tbody>
+ <row>
+ <entry><phrase><filename>all</filename></phrase></entry>
+ <entry>
+ <para>
+ Builds the <abbrev>HTML</abbrev>, and the <abbrev>PDF</abbrev> forms of the document in all its defined translations.
+ </para>
+ <para>
+ Also builds the archives, such as <application>tar(1)</application> and <application>rpm(8)</application>.
+ </para>
+ </entry>
+ </row>
+ <row>
+ <entry><phrase><filename>tarball</filename></phrase></entry>
+ <entry>
+ <para>
+ Builds only the <application>tar(1)</application> archive for all document languages.
+ </para>
+ </entry>
+ </row>
+ <row>
+ <entry><phrase><filename>pdf</filename></phrase></entry>
+ <entry>
+ <para>
+ Builds only the <abbrev>PDF</abbrev> document for all document languages.
+ </para>
+ <para>
+ Currently, <abbrev>PDF</abbrev> production is problematic and probably will not work for your document.
+ </para>
+ </entry>
+ </row>
+ <row>
+ <entry><phrase><filename>html</filename></phrase></entry>
+ <entry>
+ <para>
+ Builds only the <abbrev>HTML</abbrev> document for each defined translation.
+ Output is placed in a separate directory:
+ <systemitem class="macro">${DOCBASE}</systemitem><filename>-</filename><systemitem class="macro">${LANG}</systemitem><filename>/</filename>; each document section is given its own file within that directory.
+ </para>
+ </entry>
+ </row>
+ <row>
+ <entry><phrase><filename>html-nochunks</filename></phrase></entry>
+ <entry>
+ <para>
+ Builds only the <abbrev>HTML</abbrev> document for each defined translation.
+ Output is placed in a single file:
+ <systemitem class="macro">${DOCBASE}</systemitem><filename>-</filename><systemitem class="macro">${LANG}</systemitem><filename>.html</filename>; no other files are created.
+ </para>
+ </entry>
+ </row>
+ <row>
+ <entry><phrase><filename>clean</filename></phrase></entry>
+ <entry>
+ <para>
+ Deletes any temporary, or generated files.
+ Does <emphasis>not</emphasis> erase any <abbrev>HTML</abbrev>, <abbrev>PDF</abbrev>, or archive files.
+ </para>
+ </entry>
+ </row>
+ <row>
+ <entry><phrase><filename>distclean</filename></phrase></entry>
+ <entry>
+ <para>
+ Erases all <abbrev>HTML</abbrev>, <abbrev>PDF</abbrev>, and archive files.
+ Automatically invokes the <filename>clean</filename> target as well.
+ </para>
+ </entry>
+ </row>
+ </tbody>
+ </tgroup>
+ </table>
+ <para>
+ You can add your own special targets and rules by placing them at the bottom of the document <filename>Makefile</filename>, below the <literal>include</literal> line.
+ </para>
+ <para>
+ Be sure to follow your target definitions with a double colon, not just one.
+ This will allow you to supply extra steps for the defined targets.
+ </para>
+ </section>
+ <section id="ch-getting-files-build-system-images">
+ <title>Finding Document Image Files</title>
+ <para>
+ Image files, such as <filename>.PNG</filename>, are often used in documents.
+ While your image files may be placed anywhere you like, we recommend that you store your image files in a <filename>figs/</filename> subdirectory within your document directory.
+ In other words, place your image <filename>picture.png</filename> in the <filename>mydoc/figs/picture.png</filename> file.
+ </para>
+ <para>
+ You may organize your image files into as many subdirectories under <filename>figs/</filename> as you choose.
+ The document building system will recreate your image subdirectory structure in the output documents.
+ </para>
+ <para>
+ In addition, we recommend that you follow our convention on naming the image.
+ For example, an image often contains a caption or other text.
+ This text should be translated along with the document content, so keeping <filename>words-en.png</filename> separate from <filename>words-ru.png</filename> is a good practice.
+ </para>
+ <para>
+ Sometimes, a document may require images that do not follow the naming convention.
+ You may still use these images with the document building system, but it requires that you create an ordinary text file containing the image filenames you want to use.
+ This file must be named <filename>figs/Manifest-</filename><systemitem class="macro">${LANG}</systemitem> so that the build system can find it as the search for image filenames begins.
+ </para>
+ <para>
+ An easy way to create the <filename>figs/Manifest-</filename><systemitem class="macro">${LANG}</systemitem> file is shown in <xref linkend="ch-getting-files-build-system-manifest"/>.
+ </para>
+ <example id="ch-getting-files-build-system-manifest">
+ <title>Building A Manifest</title>
+<programlisting>
+rm -f figs/Manifest-en
+find figs -print >/tmp/manifest
+mv /tmp/manifest figs/Manifest-en
+vi figs/Manifest-en
+</programlisting>
+</example>
+
+ </section>
+ </section>
+</chapter>
Index: documentation-guide-en.xml
===================================================================
RCS file: /cvs/docs/documentation-guide/documentation-guide-en.xml,v
retrieving revision 1.21
retrieving revision 1.22
diff -u -r1.21 -r1.22
--- documentation-guide-en.xml 19 Sep 2005 00:00:31 -0000 1.21
+++ documentation-guide-en.xml 13 Dec 2005 21:56:24 -0000 1.22
@@ -22,7 +22,6 @@
<!ENTITY VIM SYSTEM "docs-vim-en.xml">
<!ENTITY TAGS SYSTEM "docs-xml-tags-en.xml">
<!ENTITY TUTORIAL SYSTEM "docs-tutorial-en.xml">
-<!ENTITY CONVERTING SYSTEM "docs-converting-en.xml">
<!ENTITY CVS SYSTEM "../docs-common/common/cvs-en.xml">
<!ENTITY ACKNOWLEDGMENTS SYSTEM "acknowledgments-en.xml">
<!ENTITY STYLE SYSTEM "docs-style-en.xml">
@@ -76,8 +75,6 @@
&STYLE;
- &CONVERTING;
-
&CVS;
&ACKNOWLEDGMENTS;
--- docs-converting-en.xml DELETED ---
--- docs-converting-zh_CN.xml DELETED ---
18 years, 5 months
docs-common/bin copy-figs,1.3,1.4
by fedora-docs-commits@redhat.com
Author: jtr
Update of /cvs/docs/docs-common/bin
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv22747
Modified Files:
copy-figs
Log Message:
Create necessary "figs/*" subdirectory paths automatically if the
Manifest-${LANG} file doesn't contain them. This invokes an extra
"mkdir -p" for every image, but we don't that many images, on average.
Index: copy-figs
===================================================================
RCS file: /cvs/docs/docs-common/bin/copy-figs,v
retrieving revision 1.3
retrieving revision 1.4
diff -u -r1.3 -r1.4
--- copy-figs 13 Dec 2005 16:39:01 -0000 1.3
+++ copy-figs 13 Dec 2005 16:45:47 -0000 1.4
@@ -209,7 +209,8 @@
# Copy file if we like it
if [ "${copyIt}" = "yes" ]; then
[ "${VERBOSE}" ] || echo >&2 "Copying file |$fn|"
- cp "${fn}" "${DST}/${rp}"
+ /bin/mkdir -p $(/usr/bin/dirname "${DST}/${rp}")
+ /bin/cp "${fn}" "${DST}/${rp}"
else
[ "${VERBOSE}" ] || echo >&2 "Rejecting file |$fn|"
fi
18 years, 5 months
docs-common/bin copy-figs,1.2,1.3
by fedora-docs-commits@redhat.com
Author: jtr
Update of /cvs/docs/docs-common/bin
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv22692
Modified Files:
copy-figs
Log Message:
Correctly documented how to build the "Manifest-${LANG}" file.
Removed extra "/figs/" path component if a manifest was used.
Index: copy-figs
===================================================================
RCS file: /cvs/docs/docs-common/bin/copy-figs,v
retrieving revision 1.2
retrieving revision 1.3
diff -u -r1.2 -r1.3
--- copy-figs 12 Dec 2005 16:35:02 -0000 1.2
+++ copy-figs 13 Dec 2005 16:39:01 -0000 1.3
@@ -11,10 +11,27 @@
# "foo-en.png".
#
# <filename>.<ext> is a language-neutral file, such as "foo.png".
+########################################################################
+# How Do We Choose Which Images Get Copied?
+#
+# We use two methods: one manual, the other automatic. If all your
+# image files conform to the above filename conventions, then we will
+# choose the appropriate image files automatically. If you name your
+# image files using another method, then you will need to list the
+# files to be copied in a "figs/Manifest-${LANG}" file.
+#
+# Before copying anything, we try to read the file "figs/Manifest-${LANG}"
+# for the list of files. If this file is missing, we will choose the
+# files based on the above naming convention.
+#
+# An easy way of generating the Manifest is like this:
+#
+# rm -f figs/Manifest-${LANG}
+# find figs -print >/tmp/Manifest-${LANG} &&
+# mv /tmp/Manifest-${LANG} figs/
#
-# What makes this complicated is that some files already have embedded
-# dashes that have nothing to do with locales, thus we have an ambiguous
-# filename grammar.
+# Then manually edit that file to remove anything you don't want copied.
+# Files matching "*/CVS/*" or "*/.svn/*" are ignored automatically.
########################################################################
targetLang=en
@@ -127,10 +144,7 @@
(
if [ "${haveManifest}" = "yes" ]; then
# We have a manifest file, so get the list of
- # RELATIVE filenames from there. Generate the
- # "Manifest-${targetLang}" file like this:
- # cd figs; find * -print >"Manifest-${targetLang}"
- # or something similar
+ # RELATIVE filenames from there.
cat "${SRC}/Manifest-${targetLang}"
else
# No manifest, resort to a search
@@ -139,6 +153,7 @@
) |
while read fn
do
+ [ "${DEBUG}" ] || echo >&2 "Considering '${fn}'"
# Skip anything that even looks like CVS or SVN
case "${fn}" in
*CVS* | *.svn* )
@@ -148,7 +163,7 @@
# Figure out the relative path for this pathname chunk
if [ "${haveManifest}" = "yes" ]; then
rp="${fn}"
- fn="${SRC}/${rp}"
+ fn="${leadin}/${rp}"
else
rp=$(
echo $(/usr/bin/dirname "${fn}")/$(/bin/basename "${fn}") |
18 years, 5 months
selinux-apache selinux-apache-it.xml,1.1,1.2
by fedora-docs-commits@redhat.com
Author: tombo
Update of /cvs/docs/selinux-apache
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv17431
Modified Files:
selinux-apache-it.xml
Log Message:
Last part of italian translation - draft
Index: selinux-apache-it.xml
===================================================================
RCS file: /cvs/docs/selinux-apache/selinux-apache-it.xml,v
retrieving revision 1.1
retrieving revision 1.2
diff -u -r1.1 -r1.2
--- selinux-apache-it.xml 4 Dec 2005 16:40:02 -0000 1.1
+++ selinux-apache-it.xml 12 Dec 2005 23:24:22 -0000 1.2
@@ -114,10 +114,11 @@
</para>
<para>
Come ulteriore controllo, usa il comando <command>ps axZ | grep
- httpd</command>. Lo dovresti vedere in esecuzione sotto il
+ httpd</command>. Dovresti vederlo in esecuzione sotto il
<firstterm>security context</firstterm>
<computeroutput>root_u:system_r:httpd_t</computeroutput>.
- La parte pi�� importante �� la terza componente, il
+ La parte pi�� importante ��
+ la terza componente, il
<firstterm>type</firstterm> <computeroutput>httpd_t</computeroutput>.
Nota che molti altri processi sul tuo sistema sono in esecuzione sotto il tipo
<computeroutput>unconfined_t</computeroutput>. Essendo eseguito
@@ -150,15 +151,15 @@
<guimenu>Servizio HTTPD</guimenu>, eliminate
il contrassegno a fianco delle voci
<guilabel>Permetti il supporto HTTPD cgi</guilabel> e
- <guilabel>Permetti ad HTTPD di leggere le home directory</guilabel>. In alternativa, puoi eseguire questi
- comandi da un terminale:
+ <guilabel>Permetti ad HTTPD di leggere le home directory</guilabel>. In alternativa,
+ puoi eseguire questi comandi da un terminale:
</para>
<screen>
<command>setsebool httpd_enable_cgi false</command>
<command>setsebool httpd_enable_homedirs false</command>
</screen>
<para>
- SELinux e le booleane sono discusse in <xref
+ SELinux e le booleane sono discusse in <xref
linkend="sn-httpd-booleans"/>.
</para>
<para>
@@ -282,10 +283,10 @@
<computeroutput>user_home_t</computeroutput>.
</para>
<para>
- To relabel the file and allow &APACHE; to read it, you can use
- the <command>chcon</command> utility: <command>chcon -t
+ Per rietichettare il file e permettere ad &APACHE; di leggerlo, puoi usare
+ l'utilit�� <command>chcon</command>: <command>chcon -t
httpd_sys_content_t /var/www/html/about.html</command>.
- Verify the context on the file is correct:
+ Verifica che il contesto del file sia corretto:
</para>
<screen>
<command>ls -aZ /var/www/html/</command>
@@ -295,79 +296,79 @@
-rw-r--r-- walters walters system_u:object_r:httpd_sys_content_t about.html
</screen>
<para>
- The <command>chcon</command> utility is similar in style to the
- UNIX command <command>chmod</command>. For example, if you
- wanted to recursively change the types of a directory and all
- the files it contains, you could use this command:
- <command>chcon -R -h -t httpd_sys_content_t /path/to/directory</command>.
- The <option>-R</option> switch means to operate recursively,
- and the <option>-h</option> option means to not follow
- symlinks (which is almost always what you want).
+ L'utilit�� <command>chcon</command> �� similare in stile al
+ comando UNIX <command>chmod</command>. Per esempio, se
+ volevi cambiare ricorsivamente i tipi di una directory e tutti
+ i files che essa contiene, potevi usare questo comando:
+ <command>chcon -R -h -t httpd_sys_content_t /path/to/directory</command>.
+ Lo switch <option>-R</option> fa operare ricorsivamente,
+ e l'opzione <option>-h</option> serve a non far seguire
+ i collegamenti (che �� quasi sempre quello che vuoi).
</para>
<tip>
<title><command>chcon</command> vs. <command>restorecon</command></title>
<para>
- There is another command available for changing file labels,
- called <command>restorecon</command>. This command is
- useful if you want to revert back to the default labels
- on files. For example, you can run
- <command>restorecon -v -R /var/www/</command> to reset
- all the file labels in the <filename>/var/www/</filename>
- directory. Internally, restorecon reads the
- <filename>/etc/selinux/targeted/contexts/files/file_contexts</filename>
- file, which has a set of regular expressions mapping file
- paths to security contexts.
+ C'�� un altro comando a disposizione per cambiare le etichette di files,
+ chiamato <command>restorecon</command>. Questo comando ��
+ utile se vuoi ripristinare le etichette dei files nella loro condizione
+ predefinita. Per esempio, puoi eseguire
+ <command>restorecon -v -R /var/www/</command> per resettare
+ tutte le etichette dei files nella directory <filename>/var/www/</filename>.
+ Internamente, restorecon legge il file
+ <filename>/etc/selinux/targeted/contexts/files/file_contexts</filename>,
+ che possiede un insieme di espressioni regolari che mappa i percorsi
+ dei files ai contesti di sicurezza.
</para>
</tip>
</section>
<section id="sn-user-homedir">
- <title>Adding Per-User Content</title>
+ <title>Aggiungere contenuto su base Per-User</title>
<para>
- This section discusses per-user
- <filename>~/public_html</filename> directories. You need to do
- three things:
+ Questa sezione discute la configurazione directory
+ <filename>~/public_html</filename> per-user. Hai bisogno di fare
+ tre cose:
</para>
<procedure>
<step>
<para>
- Edit <filename>/etc/httpd/conf/httpd.conf</filename>.
- Comment out the line <computeroutput>UserDir disable</computeroutput>
- and change the <computeroutput>UserDir</computeroutput> option
- to <computeroutput>public_html</computeroutput>.
+ Edita <filename>/etc/httpd/conf/httpd.conf</filename>.
+ Commenta la linea <computeroutput>UserDir disable</computeroutput>
+ e cambia l'opzione <computeroutput>UserDir</computeroutput>
+ a <computeroutput>public_html</computeroutput>.
</para>
</step>
<step>
<para>
- Execute <command>service httpd reload</command>.
+ Esegui <command>service httpd reload</command>.
</para>
</step>
<step>
<para>
- Start <application>system-config-securitylevel</application>. In
- the <guilabel>&SEL;</guilabel> tab, open the <guimenu>Apache</guimenu>
- menu under <guilabel>Modify SELinux Policy</guilabel>. Switch
- the Boolean <guilabel>Allow httpd to read home
- directories</guilabel> back on. Alternatively, use
- <command>setsebool httpd_enable_homedirs true</command> from a
- terminal.
+ Avvia <application>system-config-securitylevel</application>. Nel
+ tab <guilabel>&SEL;</guilabel>, apri il menu <guimenu>Apache</guimenu>
+ sotto <guilabel>Modifica la Policy di SELinux</guilabel>. Cambia
+ la booleana <guilabel>Permette ad httpd di leggere le home
+ directories</guilabel> attivandola. In alternativa, usa
+ <command>setsebool httpd_enable_homedirs true</command> da un
+ terminale.
</para>
</step>
</procedure>
<para>
- The rest of this process is from the perspective of a user
- wanting to maintain your own website.
+ Il resto di questo processo �� dalla prospettiva di un utente
+ che vuole mantenere il suo sito web.
</para>
<note>
- <title>Remember normal Linux permissions</title>
+ <title>Ricorda i normali permessi Linux</title>
<para>
- Make sure that you have your home directory set up with the
- normal Linux permissions for this: in particular, you may need
- to run <command>chmod a+x ~</command>.
+ Sii sicuro di avere la tua home directory impostata con i
+ normali permessi Linux per questo: in particolare, avrai bisogno
+ di eseguire <command>chmod a+x ~</command>.
</para>
</note>
<para>
- In your home directory, execute <command>mkdir
- public_html</command>. Examine the security context of the new
+ Nella tua home directory, esegui <command>mkdir
+ public_html</command>. Esamina il contesto di sicurezza della nuova
directory:
</para>
<screen>
@@ -375,169 +376,169 @@
drwxrwxr-x walters walters user_u:object_r:user_home_t public_html/
</screen>
<para>
- Note that it has the type
- <computeroutput>user_home_t</computeroutput>, because &SEL; has
- a rule that says new files created in a user's home directory
- (<computeroutput>user_home_dir_t</computeroutput>), get assigned
- the type <computeroutput>user_home_t</computeroutput> by
- default. A process running as
- <computeroutput>httpd_t</computeroutput> (i.e., &APACHE;) can't
- read a file with this type. To change the file's type and allow
- &APACHE; to read the file, execute:
+ Nota che ha il tipo
+ <computeroutput>user_home_t</computeroutput>, poich�� &SEL; ha
+ a regola che dice che i nuovi files creati nella home directory di un utente
+ (<computeroutput>user_home_dir_t</computeroutput>), per impostazione predefinita
+ dovranno avere assegnato il tipo <computeroutput>user_home_t</computeroutput>
+ Un processo eseguito come
+ <computeroutput>httpd_t</computeroutput> (es., &APACHE;) non pu��
+ leggere un file con questo tipo. Per cambiare il tipo del file e permettere ad
+ &APACHE; di leggere il file, esegui:
<command>chcon -t httpd_sys_content_t public_html</command>
</para>
<note>
<title>Targeted versus strict</title>
<para>
- In the strict policy, normal users have to use the type
- <computeroutput>httpd_user_content_t</computeroutput>; the
- <computeroutput>_sys_</computeroutput> means it is reserved
- for the system administrator by default. Using separate types
- like this allows stronger separation between the system and
- the user.
+ Nella policy strict, gli utenti normali devono usare il tipo
+ <computeroutput>httpd_user_content_t</computeroutput>; per impostazione
+ predefinita il <computeroutput>_sys_</computeroutput> �� inteso essere riservato
+ agli amministratori di sistema. L'uso di tipi separati
+ come questi permette una pi�� forte separazione fra il sistema
+ l'utente.
</para>
</note>
<para>
- Now, create some content in your new
- <filename>public_html</filename> (perhaps
- <filename>index.html</filename>). Test that you can browse to
- <ulink url="http://localhost/~username/index.html"/>, and see
- the expected data. Try relabeling the file back: <command>chcon
- -t user_home_t index.html</command>. When you reload the page,
- the Web server will not have permission to read it any more.
- </para>
- <para>
- One key idea is that there are actually two
- independent layers of security involved. There is the normal Unix
- permissions (which you modify with <command>chmod</command>),
- and the &SEL; file labels, which you modify with
- <command>chcon</command>. Simply making a file world-readable
- with the Unix command <command>chmod a+r
- <replaceable>filename</replaceable></command> will not, with
- &SEL;, in general allow any process to read the file. Each
- process must be explicitly authorized in the &SEL; policy for
- access to a particular file type.
+ Ora crea qualche contenuto nella nuova
+ <filename>public_html</filename> (almeno
+ <filename>index.html</filename>). Prova che puoi navigare verso
+ <ulink url="http://localhost/~username/index.html"/>, ed osserva
+ i risultati attesi. Prova a rietichettare il file come in precedenza: <command>chcon
+ -t user_home_t index.html</command>. Quando ricaricherai la pagina,
+ il Web server non avr�� pi�� il permesso di leggerla.
+ </para>
+ <para>
+ Un idea chiave �� che attualmente sono coinvolti due
+ livelli di sicurezza indipendenti. Ci sono i normail permessi Unix
+ (che modifichi con <command>chmod</command>),
+ e le etichette dei files di &SEL;, che modifichi con
+ <command>chcon</command>. Rendere semplicemente un file world-readable
+ con il comando Unix <command>chmod a+r
+ <replaceable>filename</replaceable></command> non sar��, con
+ &SEL;, in generale permesso a qualsiasi processo di leggere il file. Ogni
+ processo dovr�� essere esplicitamente autorizzato nella policy &SEL; per
+ accedere ad un particolare tipo di file.
</para>
</section>
<section id="sn-security-overview">
- <title>Discussion of Overall Security</title>
+ <title>Discussione sulla sicurezza in generale</title>
<para>
- Having gained an understanding of some basic &SEL; concepts, it
- is useful to step back and see what you have achieved so far, and
- examine some of the philosophy behind &SEL;.
- </para>
- <para>
- Running &APACHE; as <computeroutput>httpd_t</computeroutput>
- does ensure that even if the part of &APACHE; that is running as
- root is compromised or misconfigured, it is isolated from the
- rest of the system, and cannot delete or deface your website.
- </para>
- <para>
- This mention of misconfiguration is useful to elaborate on. At
- a fundamental level, a hostile attacker trying to break into
- &APACHE; is not very different from a webmaster misconfiguring
- it. Given &APACHE;'s extremely complex configuration file, all
- it takes is a one-line mistake such as the following to cause
- serious problems on your system:
+ Avendo ottenuto e compreso alcuni concetti base di &SEL;, ��
+ utile fare un passo indietro e vedere cosa hai ottenuto alla fine, ed
+ esaminare alcune delle filosofie dietro &SEL;.
+ </para>
+ <para>
+ Eseguire &APACHE; come <computeroutput>httpd_t</computeroutput>
+ assicura che anche se la parte di &APACHE; che viene eseguita come
+ root �� compromessa o misconfigurata, �� isolata dal
+ resto del sistema, e non pu�� cancellare o defacciare il tuo sito web.
+ </para>
+ <para>
+ Sulla menzione di misconfigurazione sar�� utile tornarci sopra.
+ Fondamentalmente, un attacker ostile che prova ad irrompere in
+ &APACHE; non �� molto differente da un webmaster che lo misconfiguri.
+ Dato che il file di configurazione di &APACHE; �� estremamente complesso,
+ basterebbe una sola linea sbagliata come la seguente per causare
+ seri problemi al sistema:
</para>
<programlisting>
PidFile /etc/passwd
</programlisting>
<para>
- And there are plenty of other easier to make mistakes in your
- Apache configuration.
+ E ci sono molti altri semplici modi di fare errori nella
+ configurazione Apache.
</para>
<para>
- &SEL; lets you separate your security policy (&APACHE; should
- never have direct access to <filename>/etc/passwd</filename>)
- from the rest of all the complexity in
- <filename>/etc/httpd/conf/httpd.conf</filename>. Having
- specific labels for your Web content and &APACHE; also ensures a
- compromised or misconfigured name server
- (<computeroutput>named_t</computeroutput>) cannot read the
- website at all (which is useful if some parts of the website are
- password-protected by &APACHE;, for example).
+ &SEL; ti permette di separare la tua policy di sicurezza (&APACHE; non dovrebbe
+ mai avere accesso diretto a <filename>/etc/passwd</filename>)
+ dal resto della complessit�� di
+ <filename>/etc/httpd/conf/httpd.conf</filename>. Avendo
+ specifiche etichette per i tuoi contenuti Web ed &APACHE; assicura che
+ un server dei nomi compromesso o misconfigurato
+ (<computeroutput>named_t</computeroutput>) non possa leggere
+ affatto il sito web (che �� utile se alcune parti del sito sono
+ state protette con password da &APACHE;, per esempio).
</para>
<para>
- For a much more thorough discussion of the philosophy behind
- &SEL;, refer to <citetitle>The Inevitability Of
+ Per un maggior approfondimento sulla discussione sulla filosofia dietro
+ &SEL;, fa referimento a <citetitle>The Inevitability Of
Failure</citetitle> (<ulink url="http://www.nsa.gov/selinux/papers/inevit-abs.cfm">http://www.nsa.gov/selinux/papers/inevit-abs.cfm</ulink>.)
</para>
</section>
<section id="sn-suexec-and-cgi-scripts">
- <title>Virtual Hosting, CGI scripts and suEXEC</title>
+ <title>Hosting viryuale, CGI scripts e suEXEC</title>
<para>
- Most installations of &APACHE; have some sort of dynamic
- content; in particular, CGI scripts are very common. This
- section examines a much more complicated use case for
- &SEL;: A website that has a number of users, each of whom owns
- a virtual host, out of which they are allowed to run CGI
- content.
+ La maggior parte delle installazioni di &APACHE; hanno qualche sorta di contenuto
+ dinamico; in particolare, gli scripts CGI sono molto comuni. Questa
+ sezione esamina un caso molto pi�� complicato per
+ &SEL;: Un sito web che ha un numero di utenti, ognuno dei quali ha il proprio
+ host virtuale, nel quale gli �� permesso eseguire contenuti
+ CGI.
</para>
<para>
- In this situation, we have a number of security goals:
+ In questa situazione, abbiamo un certo numero di obiettivi di sicurezza:
<itemizedlist>
<listitem>
<para>
- Protect the system from the users
+ Proteggere il sistema dagli utenti
</para>
</listitem>
<listitem>
<para>
- Protect the users from each other
+ Proteggere gli utenti gli uni dagli altri
</para>
</listitem>
<listitem>
<para>
- Protect the user's home directory from their own CGI scripts
+ Proteggere la home directory degli utenti dai propri scripts CGI
</para>
</listitem>
</itemizedlist>
</para>
<para>
- One common method for approaching the first two goals on a
- non-&SEL; setup is to use an &APACHE; module called <firstterm>suEXEC</firstterm>.
- You can read more about suEXEC at <ulink
+ Un metodo comune di approcciare ai primi due obbiettivi su un
+ installazione non-&SEL; �� usare un modulo di &APACHE; chiamato <firstterm>suEXEC</firstterm>.
+ Puoi leggere di pi�� su suEXEC su <ulink
url="http://httpd.apache.org/docs-2.0/suexec.html">http://httpd.apache.org/docs-2.0/suexec.html</ulink>.
- Using suEXEC protection, user CGI scripts run under their own
-uid. This
- ensures that user CGI scripts cannot interfere with the system
- &APACHE; daemon (since it runs under its own uid), nor with
- each other (since each user has their own uid).
- </para>
- <para>
- However, when CGI scripts are run via suEXEC using standard
- Linux security, a compromised, misconfigured, or simply buggy
- user CGI script has complete access to any other file the user
- owns, such as their home directory. It also has access to any
- process running under the same uid, and so forth. Given the
- security track record of Web software, protecting the user's
- personal data from CGI programs they may install is very
- desirable.
- </para>
- <para>
- The &SEL; policy specifies that when a user CGI script is
- executed by suEXEC, a <firstterm>domain transition</firstterm>
- occurs to change the script's security label to the
- <computeroutput>httpd_sys_script_t</computeroutput> type. This
- means the user's CGI scripts run in their own confined domain
- (but still the same uid). In the default &FC; setup, the
- <computeroutput>httpd_sys_script_t</computeroutput> domain can read
- <emphasis>and write</emphasis> to files and directories that
- have the <computeroutput>httpd_sys_content_t</computeroutput>
- type. But they still cannot access files with type
- <computeroutput>user_home_t</computeroutput>, in other words the
- user's home directory.
- </para>
- <para>
- To illustrate this, here are example user names, file names,
- and websites involved. In this example, the virtual hosting
- provider has each user store their website in
+ Usando la protezione suEXEC, gli scripts CGI degli utenti vengono eseguiti sotto la loro propria
+ uid. Questo
+ assicura che gli scripts CGI degli utenti non possano interferire con il demone
+ di sistema &APACHE; (poich�� �� eseguito sotto la propria uid), e neanche
+ l'uno con l'altro (poich�� ogni utente possiede la propria uid).
+ </para>
+ <para>
+ Comunque, quando gli scripts CGI vengono eseguiti via suEXEC usando la normale
+ sicurezza di Linux, uno script CGI di un utente, compromesso,
+ misconfigurato, o semplicemente bacato ha completo accesso ad ogni altro file
+ posseduto dall'utente, tipo la loro home directory. Esso ha anche accesso a ogni
+ processo che viene eseguito sotto lo stesso uid, e cos�� via. Dare
+ traccia della sicurezza del software Web, proteggendo i dati personali
+ degli utenti dai programmi CGI che essi possono installare �� molto
+ desiderabile.
+ </para>
+ <para>
+ La policy &SEL; specifica che quando uno script CGI utente ��
+ eseguito da suEXEC, avviene una <firstterm>transizione di dominio</firstterm>
+ per cambiare l'etichetta di sicurezza dello script al
+ tipo <computeroutput>httpd_sys_script_t</computeroutput>. Questo
+ vuol dire che lo script CGI dell'utente viene eseguito nel proprio confinato dominio
+ (ma ancora sotto la stessa uid). Nelle normali installazioni &FC;, il
+ dominio <computeroutput>httpd_sys_script_t</computeroutput> pu�� leggere
+ <emphasis>e scrivere</emphasis> nei files e directories che
+ hanno il tipo <computeroutput>httpd_sys_content_t</computeroutput>.
+ Ma non possono ancora accedere ai files con il tipo
+ <computeroutput>user_home_t</computeroutput>, in altre parole
+ la home directory utente.
+ </para>
+ <para>
+ Per illustrarvi questo, ecco un esempio di nomi utente, nomi di files,
+ e siti web coinvolti. In questo esempio, il fornitore
+ dell'host virtuale ha ogni utente con il proprio sito web in
<filename>/var/www/<replaceable>sitename</replaceable></filename>,
- and the content is all owned by the user. CGI scripts are
- allowed, and they can be installed anywhere in the user's site;
- the filename just has to end in <filename>.cgi</filename>. Here
- is an overview of the filesystem layout:
+ ed il contenuto �� completamente di propriet�� dell'utente. Gli scripts sono
+ permessi, e possono essere installati ovunque nel sito web dell'utente;
+ il nome del file devono solo terminare in <filename>.cgi</filename>. Ecco
+ una descrizione della conformazione del sistema:
</para>
<screen>
<command>ls -Z /var/www/</command>
@@ -548,10 +549,10 @@
drwxr-xr-x sam sam system_u:object_r:httpd_sys_content_t sammy.net
</screen>
<para>
- Here is a sample of how the &APACHE; configuration for the
- <computeroutput>example.com</computeroutput> domain might look.
- Note particularly that &APACHE; has been configured to run CGI
- scripts as the user <computeroutput>bob</computeroutput>.
+ Ecco un esempio di come la configurazione di &APACHE; per il
+ dominio <computeroutput>example.com</computeroutput> potrebbe essere.
+ Nota in particolare che &APACHE; �� stato configurato per eseguire gli scripts
+ CGI come l'utente <computeroutput>bob</computeroutput>.
</para>
<programlisting>
NameVirtualHost 10.23.54.2:80
@@ -572,42 +573,42 @@
</VirtualHost>
</programlisting>
<para>
- By using the normal &APACHE; suEXEC mechanism, together with
- &SEL;, you have achieved the major security goals set out at the
- beginning of this section. However, this is still only a
- fraction of &SEL;'s power.
+ Usando il normale meccanismo suEXEC &APACHE;, insieme a
+ &SEL;, hai ottenuto l'obiettivo di sicurezza principale descritto
+ all'inizio di questa sezione. Comunque, questa �� solo
+ una frazione del potere di &SEL;.
</para>
</section>
<section id="sn-using-other-types">
- <title>Using Other Types To Lock Down CGI Scripts</title>
+ <title>Usare altri Tipi per bloccare gli scripts CGI</title>
<para>
- In the section <xref linkend="sn-suexec-and-cgi-scripts"/> you
- saw that a user's CGI script running in the
- <computeroutput>httpd_sys_script_t</computeroutput> domain can
- read and write all Web content. In many scenarios, this is
- undesirable. For example, the Pyblosxom blog software (<ulink
- url="http://roughingit.subtlehints.net/pyblosxom/">http://roughingit.subtlehints.net/pyblosxom/</ulink>)
- reads in a number of plain text blog entry files, and renders
- them to HTML on the fly to the client. For this, it only needs
- read access to the blog entry files. Ideally, if Pyblosxom was
- compromised or had a bug, it would not have the ability to
- modify or delete your Web log entries.
- </para>
- <para>
- &SEL; allows you to achieve this by defining more types. You
- grant <computeroutput>httpd_sys_script_t</computeroutput> the
- access to those types that you desire. The default &APACHE;
- policy defines a number of other types by default.
+ Nella sezione <xref linkend="sn-suexec-and-cgi-scripts"/> hai
+ visto che uno script CGI eseguito nel
+ dominio <computeroutput>httpd_sys_script_t</computeroutput> pu��
+ leggere e scrivere tutto il contenuto Web. In molti scenari, ci��
+ �� indesiderato. Per esempio, il software di blog Pyblosxom (<ulink
+ url="http://roughingit.subtlehints.net/pyblosxom/">http://roughingit.subtlehints.net/pyblosxom/</ulink>)
+ legge da un certo numero di file di semplice testo, e li renderizza
+ in HTML al volo per il client. Per questo, ha solo bisogno
+ di accesso in lettura ai file di contenuto del blog. Idealmente, se Pyblosxom fosse
+ compromesso o avesse un errore, esso non avrebbe la capacit�� di
+ modificare o cancellare le tue immissioni Web.
+ </para>
+ <para>
+ &SEL; ti permette di ottenere questo con la definizione di pi�� tipi. Tu
+ garantirai ad <computeroutput>httpd_sys_script_t</computeroutput> di
+ accedere ai quei tipi che desideri. La policy predefinita di &APACHE;
+ definisce gi�� un certo numero di tipi diversi.
</para>
<variablelist>
- <title>User-controllable types defined by the &SEL;
- policy</title>
+ <title>Tipi definiti dalla policy di &SEL; controllabili
+ dall'utente</title>
<varlistentry>
<term><computeroutput>httpd_sys_script_ro_t</computeroutput></term>
<listitem>
<para>
- A CGI script may only read files and directories with this
- type.
+ Uno script CGI pu�� solo leggere files e directories con questo
+ tipo.
</para>
</listitem>
</varlistentry>
@@ -615,8 +616,8 @@
<term><computeroutput>httpd_sys_script_ra_t</computeroutput></term>
<listitem>
<para>
- Like the previous type, except a CGI script may also
- append more data (useful for log files, etc).
+ Come il tipo precedente, eccettuato che uno script CGI pu�� anche
+ appendere dati (utile per i files di log, etc).
</para>
</listitem>
</varlistentry>
@@ -624,8 +625,8 @@
<term><computeroutput>httpd_sys_script_rw_t</computeroutput></term>
<listitem>
<para>
- Content that a CGI script may change in any way, including
- deletion.
+ Contentenuti che uno script CGI pu�� cambiare in qualsiasi modo, inclusa
+ la cancellazione.
</para>
</listitem>
</varlistentry>
@@ -633,7 +634,7 @@
<term><computeroutput>httpd_sys_content_t</computeroutput></term>
<listitem>
<para>
- See below.
+ Vedi sotto.
</para>
</listitem>
</varlistentry>
@@ -641,41 +642,41 @@
<term><computeroutput>httpd_sys_script_exec_t</computeroutput></term>
<listitem>
<para>
- The type for CGI executables.
- <computeroutput>httpd_t</computeroutput> cannot execute
- other types such as
+ Il tipo per gli eseguibili CGI.
+ <computeroutput>httpd_t</computeroutput> non pu�� eseguire
+ altri tipi come
<computeroutput>httpd_sys_script_rw_t</computeroutput>.
</para>
</listitem>
</varlistentry>
</variablelist>
<para>
- The &FC; &LOCALVER; release introduces a new <firstterm>policy
- boolean</firstterm> called
- <computeroutput>httpd_unified</computeroutput>. If this boolean
- is enabled, it means that
- <computeroutput>httpd_sys_content_t</computeroutput> (the type
- used for everything up until this point) is treated as the
- <emphasis>union</emphasis> of all the other types above. If
- this boolean is disabled, it means that (for example) in order
- for a CGI script to be executed by
- <computeroutput>httpd_t</computeroutput>, it must be labeled
- with the
- <computeroutput>httpd_sys_script_exec_t</computeroutput> type.
- And it also means that in order for a CGI script to write data,
- the target file must be labeled with
- <computeroutput>httpd_sys_script_rw_t</computeroutput>, as
- above.
- </para>
- <para>
- The <computeroutput>httpd_unified</computeroutput> boolean
- was introduced so that one could, for the most part, use
- a typical &APACHE; installation without a good grasp on file labeling
- and security contexts. However, disabling this boolean grants
- far greater security, and is highly recommended.
+ La versione &FC; &LOCALVER; introduce una nuova <firstterm>policy
+ booleana</firstterm> chiamata
+ <computeroutput>httpd_unified</computeroutput>. Se questa booleana
+ �� abilitata, questo vuol dire che
+ <computeroutput>httpd_sys_content_t</computeroutput> (ol tipo
+ usato per ogni cosa fino a questo punto) �� trattato come
+ l'<emphasis>unione</emphasis> di tutti gli altri tipi succitati. Se
+ questa booleana �� disabilitata, vuol dire che (per esempio) un CGI script
+ per poter essere eseguito da
+ <computeroutput>httpd_t</computeroutput>, deve essere etichettato
+ con il tipo
+ <computeroutput>httpd_sys_script_exec_t</computeroutput>.
+ E vuol dire anche che un CGI script per poter scrivere dati,
+ il file destinazione deve essere etichettato con
+ <computeroutput>httpd_sys_script_rw_t</computeroutput>, come
+ sopra.
+ </para>
+ <para>
+ La booleana <computeroutput>httpd_unified</computeroutput>
+ �� stata introdotta affinch�� chiunque possa, per la maggior parte, usare
+ una installazione tipica di &APACHE; senza conoscenza stretta sull'etichettatura
+ dei files e dei contesti di sicurezza. Comunque, disabilitando questa boleana si garantisce
+ una sicurezza di gran lunga superiore, ed �� caldamente raccomandato.
</para>
<para>
- Now, examine how Bob might set up a Pyblosxom installation:
+ Ora, esaminiamo come Bob potrebbe configurare un installazione Pyblosxom:
</para>
<screen>
# cd /var/www/example.com
@@ -696,124 +697,124 @@
-rw-r--r-- bob bob user_u:object_r:httpd_sys_script_ro_t firstpost.txt
...
</screen>
- <para>Note that the index.cgi executable is marked as
- <computeroutput>httpd_sys_script_exec_t</computeroutput>, and
- the rest of the data is marked as
- <computeroutput>httpd_sys_script_ro_t</computeroutput>. This
- protects all the blog data from a compromised, misconfigured, or
- buggy Pyblosxom.
- </para>
- <para>
- One other important thing to note about these types is that by
- default, <computeroutput>httpd_t</computeroutput>
- <emphasis>cannot</emphasis> access any of them except for
- <computeroutput>httpd_sys_content_t</computeroutput>. In other
- words, by default &APACHE; cannot directly access content
- intended for your CGI scripts.
- </para>
- <para>
- Consider the case of a small intranet, accessed via a CGI
- script, which has some public content, and some
- password-protected content. It stores its data in a large
- database file. In this case, you would label the database file
- as <computeroutput>httpd_sys_script_rw_t</computeroutput> so
- that the intranet CGI could write to it. But if you allow
- <computeroutput>httpd_t</computeroutput> access to
- <computeroutput>httpd_sys_script_rw_t</computeroutput>, then if
- &APACHE; was compromised or simply misconfigured, it could gain
- access to the database directly, bypassing the access control
- that the CGI script was doing for the password-protected
- content.
+ <para>Nota che l'eseguibile index.cgi �� marcato come
+ <computeroutput>httpd_sys_script_exec_t</computeroutput>, ed
+ il resto dei dati �� marcato come
+ <computeroutput>httpd_sys_script_ro_t</computeroutput>. Questo
+ protegge tutti i dati del blog da un compromesso, misconfigurato, o
+ bacato Pyblosxom.
+ </para>
+ <para>
+ Un altra cosa importante da notare su questi tipi �� che per
+ impostazione predefinita, <computeroutput>httpd_t</computeroutput>
+ <emphasis>non pu��</emphasis> accedere a nessuno di loro eccettuato
+ <computeroutput>httpd_sys_content_t</computeroutput>. In altre
+ parole, di base &APACHE; non pu�� accedere direttamente al contenuto
+ inteso per i tuoi script CGI.
+ </para>
+ <para>
+ Considera il caso di una piccola intranet, a cui si pu�� accedere via CGI
+ script, che ha qualche contenuto pubblico e qualche
+ contenuto protetto da password. Essa registra i dati in un grande
+ file database. In questo caso, vorrai etichettare il file database
+ come <computeroutput>httpd_sys_script_rw_t</computeroutput> affinch��
+ lo script CGI possa scriverci su. Ma se permetti
+ ad <computeroutput>httpd_t</computeroutput> l'accesso a
+ <computeroutput>httpd_sys_script_rw_t</computeroutput>, allora se
+ &APACHE; venisse compromesso o semplicemente misconfigurato, esso potrebbe ottenere
+ l'accesso diretto al database, bypassando il controllo d'accesso
+ che lo script CGI faceva per il contenuto protetto da
+ password.
</para>
</section>
<section id="sn-debugging-and-customizing">
<title>Debugging Problems and Customizing the Policy</title>
<para>
- When first deploying &SEL; and &APACHE;, if your &APACHE;
- configuration varies far from the &FC; or &RHEL; defaults, you
- will likely encounter issues related to the &SEL; policy. This
- section discusses analyzing policy denials, and doing simple
- customizations of the policy.
+ Quando applichi per la prima volta &SEL; e &APACHE;, se la tua configurazione
+ &APACHE; varia molto da quella predefinita di &FC; o &RHEL;, potrai
+ incorrere in alcuni problemi con la policy &SEL;. Questa
+ sezione discute analizzando i dinieghi della policy, e facendo semplici
+ personalizzazioni della policy.
</para>
<section id="sn-httpd-booleans">
- <title>Simple Customization</title>
+ <title>Semplice personalizzazione</title>
<para>
- The first major tool for policy customization is
- <command>system-config-securitylevel</command>. It
- has a number of policy booleans:
+ Il primo principale strumento per la personalizzazione delle policy ��
+ <command>system-config-securitylevel</command>. Esso
+ possiede un certo numero di policy boolene:
</para>
<variablelist>
- <title>Boolean options for &APACHE;</title>
- <varlistentry><term><computeroutput>httpd_enable_cgi</computeroutput> (Allow httpd cgi support)</term>
+ <title>Opzioni booleane per &APACHE;</title>
+ <varlistentry><term><computeroutput>httpd_enable_cgi</computeroutput> (Permette ad httpd il supporto cgi)</term>
<listitem>
- <para>Whether or not to allow CGI scripts to run at all.</para>
+ <para> Quando o no permettere agli script CGI di essere eseguiti.</para>
</listitem>
</varlistentry>
- <varlistentry><term><computeroutput>httpd_enable_homedirs</computeroutput> (Allow httpd to read home directories)</term>
+ <varlistentry><term><computeroutput>httpd_enable_homedirs</computeroutput> (Permette ad httpd di leggere le home directories)</term>
<listitem>
<para>
- Whether or not to allow &APACHE; to access top-level home
- directories. This does not allow for reading of the
- <emphasis>content</emphasis> of home directories
+ Quando o no permettere ad &APACHE; di accedere alle home
+ directories. Questo non consente la lettura del
+ <emphasis>contenuto</emphasis> delle home directories
(<computeroutput>user_home_t</computeroutput>).
</para>
</listitem>
</varlistentry>
- <varlistentry><term><computeroutput>httpd_ssi_exec</computeroutput> (Allow httpd to run SSI executables in the same domain as system CGI scripts)</term>
+ <varlistentry><term><computeroutput>httpd_ssi_exec</computeroutput> (Permette ad httpd di eseguire gli eseguibili SSI nello stesso dominio dei CGI scripts di sistema)</term>
<listitem>
<para>
- If enabled, this boolean causes &APACHE; to transition to the
- <computeroutput>httpd_sys_script_t</computeroutput> when
- executing a shell.
+ Se abilitata, questa booleana causa la transizione di &APACHE; verso
+ <computeroutput>httpd_sys_script_t</computeroutput> quando
+ esegue una shell.
</para>
</listitem>
</varlistentry>
- <varlistentry><term><computeroutput>httpd_unified</computeroutput> (Unify httpd handling of all content files)</term>
+ <varlistentry><term><computeroutput>httpd_unified</computeroutput> (Unifica il modo in cui httpd manipola tutti i files dei contenuti)</term>
<listitem>
<para>
- This boolean controls whether
- <computeroutput>httpd_sys_content_t</computeroutput> is
- treated as the union of all the other types such as
- <computeroutput>httpd_sys_script_exec_t</computeroutput>. See
+ Questa booleana controlla quando
+ <computeroutput>httpd_sys_content_t</computeroutput> ��
+ trattata come l'unione di tutti gli altri tipi come
+ <computeroutput>httpd_sys_script_exec_t</computeroutput>. Vedi
<xref linkend="sn-using-other-types"/>
</para>
</listitem>
</varlistentry>
</variablelist>
<para>
- In addition, you can disable &SEL; enforcement for &APACHE;
- entirely with <application>system-config-securitylevel</application>.
+ Inoltre, con <application>system-config-securitylevel</application>,
+ puoi interamente disabilitare il &SEL; enforcement per &APACHE;.
</para>
<procedure>
<step>
<para>
- First, click the <guilabel>&SEL;</guilabel> tab.
+ Primo, clicca il tab <guilabel>&SEL;</guilabel>.
</para>
</step>
<step>
<para>
- Click on the <guimenu>Transition</guimenu> tree.
+ Clicca sull'albero <guimenu>Transizioni</guimenu>.
</para>
</step>
<step>
<para>
- Check <guilabel>Disable &SEL; protection for
+ Controlla <guilabel>Disabilita la protezione &SEL; per
&APACHE;</guilabel>
</para>
</step>
<step>
<para>
- Execute <command>/etc/init.d/httpd restart</command>
+ Esegui <command>/etc/init.d/httpd restart</command>
</para>
</step>
</procedure>
</section>
<section id="sn-policy-debugging">
- <title>Policy Debugging</title>
+ <title>Debugging della Policy </title>
<para>
- It is very important to monitor
- <filename>/var/log/messages</filename> for any denials due to
- the &SEL; policy. Suppose that you see the following denial:
+ E' importantissimo controllare
+ <filename>/var/log/messages</filename> per ogni diniego causato dalla
+ policy &SEL;. Supponi di vedere il seguente diniego:
</para>
<screen>
Oct 19 17:54:59 hostname kernel: audit(1098050626.859:0): avc: denied { write } \
@@ -822,72 +823,72 @@
tcontext=user_u:object_r:httpd_sys_script_ro_t tclass=dir
</screen>
<para>
- The <computeroutput>{ write }</computeroutput> is telling you
- that the denial involves writing to an object. The
- <computeroutput>tclass=dir</computeroutput> says that the object
- in question is a directory. The two most crucial parts are the
- <computeroutput>scontext</computeroutput> and
- <computeroutput>tcontext</computeroutput>, which contain the
- types of the subject
- (<computeroutput>httpd_sys_script_t</computeroutput>) and the
- object (<computeroutput>httpd_sys_script_ro_t</computeroutput>).
- Notice there is other auxilliary information as well; since the
- object is a file, there is its name
- (<computeroutput>pyblosxom</computeroutput>) and inode number
+ La <computeroutput>{ write }</computeroutput> ti dice
+ che il diniego riguarda la scrittura di un oggetto. La
+ <computeroutput>tclass=dir</computeroutput> ti dice che l'oggetto
+ in questione �� una directory. Le due parti pi�� cruciali sono
+ l'<computeroutput>scontext</computeroutput> e
+ <computeroutput>tcontext</computeroutput>, che contengono i
+ tipi del soggetto
+ (<computeroutput>httpd_sys_script_t</computeroutput>) e
+ l'oggetto (<computeroutput>httpd_sys_script_ro_t</computeroutput>).
+ Nota che c'�� un'altra informazione ausiliaria comunque; poich��
+ l'oggetto �� un file, c'�� il suo nome
+ (<computeroutput>pyblosxom</computeroutput>) ed il suo numero di inode
(<computeroutput>4374593</computeroutput>).
</para>
<para>
- In other words, the Python CGI script is trying to write to
- a directory that is marked read-only. There are many reasons this could
- happen; perhaps the script was misconfigured or buggy, for
- example. But in this particular case, it turns out that the
- Python interpreter normally tries to generate
- <filename>.pyc</filename> files for each
- <filename>.py</filename> file it encounters. If the directory
- is marked as
- <computeroutput>httpd_sys_script_ro_t</computeroutput>, then it
- will not be able to create new files in it, and you will see the
- denial. This is a very common problem with Python CGI scripts.
+ In altre parole, il CGI script in Python sta provando a scrivere in
+ una directory che �� contrassegnata di sola lettura. Ci sono diverse ragioni percui ci�� pu��
+ accadere; potrebbe essere che lo script sia misconfigurato o bacato, per
+ esempio. Ma in questo caso particolare, viene fuori che
+ l'interprete Python normalmente usa generare
+ files <filename>.pyc</filename> per ogni file
+ <filename>.py</filename> che incontra. Se questa directory
+ �� marcata come
+ <computeroutput>httpd_sys_script_ro_t</computeroutput>, allora
+ non avr�� la possibilit�� di creare nuovi files, e vedrai
+ il diniego. Questo �� un problema molto comune con gli script CGI in Python.
</para>
</section>
<section id="sn-simple-changes-to-policy-source">
- <title>Simple Changes to Policy Sources</title>
+ <title>Semplici cambiamenti al sorgente della Policy</title>
<para>
- The issue with Python mentioned in <xref
- linkend="sn-policy-debugging"/> is not an issue with &SEL;,
- since it is Python that is trying to write to a directory of
- supposedly read-only objects. To deal with these spurious
- errors that don't affect the functionality of the CGI script,
- you can direct &SEL; to ignore them. &SEL; supports a
- <computeroutput>dontaudit</computeroutput> directive in the
- policy sources, but you must rebuild a policy from the source.
- To install the policy sources, use <command>up2date</command> or
- <command>yum</command> to install the
- <computeroutput>selinux-policy-targeted-sources</computeroutput>
- package.
- </para>
- <para>
- To get the rule syntax you need, you can use a
- <command>audit2allow</command>, which will generate the SELinux
- policy to allow a set of logged denials. For example, you
- could invoke <command>audit2allow -i /var/log/messages
- -l</command>. This generates allow rules for every denial since
- a policy was last loaded. The output for the denial in <xref
- linkend="sn-policy-debugging"/> would look like this:
+ Il problema con Python menzionato nella <xref
+ linkend="sn-policy-debugging"/> non �� un problema di &SEL;,
+ poich�� �� Python che prova a scrivere in una directory di
+ supposti oggetti di sola lettura. Per risolvere questi errori
+ spuri, che non hanno effetto sulla funzionalit�� dello script CGI,
+ puoi direttamente dire a &SEL; di ignorarli. &SEL; supporta una
+ direttiva <computeroutput>dontaudit</computeroutput> nei
+ sorgenti delle policy, ma devi ricompilare la policy dai sorgenti.
+ Per installare i sorgenti della policy, usa il tool <command>up2date</command> o
+ <command>yum</command> per installare il
+ pacchetto
+ <computeroutput>selinux-policy-targeted-sources</computeroutput>.
+ </para>
+ <para>
+ Per avere la sintassi della regola di cui hai bisogno, puoi usare un
+ <command>audit2allow</command>, che generer�� la policy
+ SELinux per permettere un gruppo di dinieghi loggati. Per esempio, puoi
+ invocare <command>audit2allow -i /var/log/messages
+ -l</command>. Questo generer�� regole di consenso per ogni diniego finch��
+ una policy verr�� alla fine caricata. L'output per il diniego nella <xref
+ linkend="sn-policy-debugging"/> sar�� come questo:
</para>
<screen>
<command>audit2allow -i /var/log/messages -l</command>
allow httpd_sys_script_t httpd_sys_script_ro_t:dir { write };
</screen>
<para>
- However, in this case you don't want to actually
- <emphasis>allow</emphasis> this operation, you simply want to
- avoid audit messages from it. &SEL; supports a directive called
- <computeroutput>dontaudit</computeroutput> instead of
- <computeroutput>allow</computeroutput>. Now your generated
- policy is <computeroutput>dontaudit httpd_sys_script_t
- httpd_sys_script_ro_t:dir { write };</computeroutput>. To
- add this to the system policy, follow these steps:
+ Comunque, in questo caso, non vorrai attualmente
+ <emphasis>permettere</emphasis> questa operazione, semplicemente vorrai
+ evitare di avere ulteriori messaggi di audit. &SEL; supporta una direttiva chiamata
+ <computeroutput>dontaudit</computeroutput> da usare al posto di
+ <computeroutput>allow</computeroutput>. Ora la tua policy generata
+ �� <computeroutput>dontaudit httpd_sys_script_t
+ httpd_sys_script_ro_t:dir { write };</computeroutput>. Per
+ aggiungerla alla policy di sistema, seguite i seguenti passi:
</para>
<procedure>
<step>
@@ -897,9 +898,9 @@
</step>
<step>
<para>
- Use your favorite editor to create the file
- <filename>domains/misc/local.te</filename>, and
- add the rule above to it (or <command>echo "dontaudit httpd_sys_script_t httpd_sys_script_ro_t:dir { write };" > domains/misc/local.te</command>).
+ Usa il tuo editor di testi preferito per creare il file
+ <filename>domains/misc/local.te</filename>, ed
+ aggiungi la regola succitata (oppure <command>echo "dontaudit httpd_sys_script_t httpd_sys_script_ro_t:dir { write };" > domains/misc/local.te</command>).
</para>
</step>
<step>
@@ -909,128 +910,128 @@
</step>
</procedure>
<caution>
- <title>Analyze <command>audit2allow</command> output carefully</title>
+ <title>Analizza l'output di <command>audit2allow</command> con attezione</title>
<para>
- You should not simply place all of the output from
- <command>audit2allow</command> in your
- <filename>domains/misc/local.te</filename>. It is very easy to
- compromise the security of your system that way; for example,
- using <computeroutput>allow</computeroutput> instead of
- <computeroutput>dontaudit</computeroutput> above would have
- rendered the security from the
- <computeroutput>httpd_sys_script_ro_t</computeroutput> type
- useless.
- </para>
- <para>
- For more information about policy debugging and customization
- in general, refer to the <citetitle>Red Hat &SEL; Policy
- Guide</citetitle>, available online at <ulink
+ Non dovrai semplicemente mettere tutto l'output di
+ <command>audit2allow</command> nel tuo
+ <filename>domains/misc/local.te</filename>. E' molto facile
+ compromettere la sicurezza del sistema in questo modo; per esempio,
+ usando <computeroutput>allow</computeroutput> invece di
+ <computeroutput>dontaudit</computeroutput> si render��
+ inusabile la sicurezza
+ fornita dal tipo
+ <computeroutput>httpd_sys_script_ro_t</computeroutput>.
+ </para>
+ <para>
+ Per maggiori informazioni sul debugging e la personalizzazione
+ in generale, fa riferimento alla <citetitle>Red Hat &SEL; Policy
+ Guide</citetitle>, disponibile online su <ulink
url="http://www.redhat.com/docs">http://www.redhat.com/docs</ulink>.
</para>
</caution>
</section>
</section>
<section id="sn-strict-policy">
- <title>Differences Between Strict and Targeted Policy</title>
+ <title>Differenze fra policy Strict e Targeted</title>
<para>
- The fundamental difference with the strict policy is that it
- restricts every process, including user logins, instead of just
- a few selected daemons. This has important ramifications for
- &APACHE;, because ordinary users are often involved in providing
- and controlling Web content.
+ La differenza fondamentale con la policy strict �� che questa
+ restringe ogni processo, inclusi i login utente, invece di soli
+ pochi demoni selezionati. Questo ha importanti ramificazioni per
+ &APACHE;, perch�� gli utenti ordinari sono spesso coinvolti nel fornire
+ e controllare il contenuto Web.
</para>
<para>
- In the default strict policy, there are two user login types,
- <computeroutput>user_t</computeroutput> and
- <computeroutput>staff_t</computeroutput>. The strict Apache
- policy defines an additional set of types for each user login
- type, replacing
+ Nella policy strict predefinita, ci sono due tipi di login utente,
+ <computeroutput>user_t</computeroutput> e
+ <computeroutput>staff_t</computeroutput>. La policy strict
+ di Apache definisce un ulteriore gruppo di tipi per ogni tipo
+ di login utente, sostituendo
<computeroutput><replaceable>_sys_</replaceable></computeroutput>
- with <computeroutput>_user_</computeroutput> and
- <computeroutput>_staff_</computeroutput>. For example, this gives
- <computeroutput>httpd_user_script_ro_t</computeroutput> and
+ con <computeroutput>_user_</computeroutput> e
+ <computeroutput>_staff_</computeroutput>. Per esempio, questo ti da
+ <computeroutput>httpd_user_script_ro_t</computeroutput> e
<computeroutput>httpd_staff_script_exec_t</computeroutput>.
- This provides for a stronger, mandatory separation between
- users, administrators, and the system. An ordinary user is
- prevented from reading system Web content directly, and a
- compromised or misconfigured system CGI script is prevented from
- reading a user's content.
+ Questo fornisce una pi�� forte, mandatoria separazione tra gli
+ utenti, administratori, ed il sistema. Un utente ordinario ��
+ prevenuto dal leggere il contenuto Web di sistema direttamente, ed un
+ compromesso o misconfigurato script CGI di sistema �� prevenuto dal
+ leggere il contenuto di un utente.
</para>
</section>
<section id="sn-further-approaches">
- <title>Further Approaches for Stronger Security</title>
+ <title>Ulteriori approcci per una maggior sicurezza</title>
<para>
- For some, the default &APACHE; policy may actually not be
- expressive enough. This section discusses extending
- and fundamentally rewriting the &APACHE; policy for even
- stronger security. It is assumed that you are familiar with
- the concepts discussed earlier. This section will generally
- only outline solutions, instead of going into step-by-step
- detail.
+ Per alcuni, la policy predefinita per &APACHE; pu�� attualmente non
+ sembrare abbastanza espressiva. Questa sezione discute l'estensione
+ e fondamentalmente la riscrittura della policy &APACHE; per ottenere
+ una sicurezza pi�� forte. Si da per assunto che hai familiarit�� con
+ i concetti discussi prima. Questa sezione generalmente indicher��
+ soluzioni a grandi linee, invece di scendere nel dettaglio
+ passo passo.
</para>
<section id="sn-cgi-subdomains">
- <title>Individual Domains for Particular CGI Scripts</title>
+ <title>Domini individuali per particolari scripts CGI</title>
<para>
- Using the default policy, a compromise of one CGI script means
- a compromise of <emphasis>all</emphasis> of them. This is
- because they all run in the same domain
- (<computeroutput>httpd_sys_script_t</computeroutput>) with
- access to the same other types (e.g.
- <computeroutput>httpd_sys_script_rw_t</computeroutput>). Put a
- different way, types are security equivalence classes.
- </para>
- <para>
- Most of the type definitions and permissions regarding CGI
- scripts are in
- <filename>/etc/selinux/<replaceable>policyname</replaceable>/src/policy/macros/program/apache_macros.te</filename>.
- Open that file up in your favorite editor. This entire file
- is definining an <command>m4</command> macro called
- <computeroutput>apache_domain</computeroutput>.
+ Usando la policy predefinita, la compromissione di uno script CGI vuol dire
+ comprometterli <emphasis>tutti</emphasis>. Questo perch��
+ vengono eseguiti tutti sotto lo stesso dominio
+ (<computeroutput>httpd_sys_script_t</computeroutput>) con
+ accesso agli stessi altri tipi (es.
+ <computeroutput>httpd_sys_script_rw_t</computeroutput>). Mettiamola
+ in un altro modo, i tipi sono classi di sicurezza equivalente.
+ </para>
+ <para>
+ Molte delle definizioni e dei permessi che riguardano gli scripts
+ CGI sono in
+ <filename>/etc/selinux/<replaceable>policyname</replaceable>/src/policy/macros/program/apache_macros.te</filename>.
+ Aprite il file con il vostro editor di testi preferito. Questo intero file
+ definisce una macro <command>m4</command> chiamata
+ <computeroutput>apache_domain</computeroutput>.
</para>
<note>
- <title>Understanding <command>m4</command> in one paragraph</title>
+ <title>Comprendere <command>m4</command> in un paragrafo</title>
<para>
- The
+ La
<computeroutput>define(`apache_domain',`</computeroutput>
- begins the macro definition. Inside the definition, the
- <computeroutput>$1</computeroutput> represents the parameter
- passed to the macro.
+ cominica la definizione della macro. All'interno della definizione, il
+ <computeroutput>$1</computeroutput> rappresenta il parametro
+ passato alla macro.
</para>
</note>
<para>
- If you then look in
+ Se quindi dai uno sguardo in
<filename>/etc/selinux/<replaceable>policyname</replaceable>/src/policy/domains/program/apache.te</filename>,
- you'll see the following invocation:
+ vedrai la seguente invocazione:
</para>
<programlisting>
apache_domain(sys)
</programlisting>
<para>
- This single line then generates a large set of types and
- rules, substituting <computeroutput>sys</computeroutput> for
- every <computeroutput>$1</computeroutput>. Suppose that you
- have two CGI programs you want to protect: a blog
- installation, and a wiki installation. Because these domains
- will be largely similar, you will create a macro. Open up the
- file you are using for local policy,
+ Questa singola linea quindi genera un gran numero di tipi e
+ regole, sostituendo <computeroutput>sys</computeroutput> per
+ ogni <computeroutput>$1</computeroutput>. Supponi che
+ hai due programmi CGI che vuoi proteggere: una installazione
+ blog, ed una installazione wiki. Siccome questi domini
+ sono molto similari, creerai una macro. Apri il
+ file che stai usando per la policy locale,
<filename>/etc/selinux/<replaceable>policyname</replaceable>/src/policy/domains/misc/local.te</filename>.
</para>
<para>
- In order to separate the blog and the wiki, you need to create
- separate types (domains) for them, allow
- <computeroutput>httpd_t</computeroutput> the ability to
- transition to those domains, and create new derived types to
- label their data. This is very similar to what most of
- <computeroutput>apache_domain</computeroutput> already does,
- but unfortunately that macro does too much for your simple
- needs. However, you can use that macro as a guide for creating
- your macro.
+ Per poter separare il blog dalla wiki, avrai bisogno di creare
+ per loro tipi separati (domini), permettere ad
+ <computeroutput>httpd_t</computeroutput> la capacit�� di
+ transitare verso questi domini, e creare nuovi tipi derivati per
+ etichettare i loro dati. Tutto ci�� �� abbastanza simile a quello che
+ il dominio <computeroutput>apache_domain</computeroutput> gi�� fa,
+ ma sfortunatamente quella macro fa fin troppo per le tue semplici
+ esigenze. Comunque, puoi usare questa macro come guida per crearne
+ una tua.
</para>
<procedure>
<step>
<para>
- Start with the macro skeleton:
+ Comincia con lo scheletro della macro:
</para>
<programlisting>
define(`apache_script_domain',`
@@ -1042,13 +1043,13 @@
</step>
<step>
<para>
- Define types for the CGI script executables (similar to
- <computeroutput>httpd_sys_script_exec_t</computeroutput>),
- and domains for the script processes (similar to
- <computeroutput>httpd_sys_script_t</computeroutput>). You
- also need to authorize the
- <computeroutput>system_r</computeroutput> role for the
- type.
+ Definisci i tipi per gli script eseguibili CGI (similmente ad
+ <computeroutput>httpd_sys_script_exec_t</computeroutput>),
+ ed i domini per i processi degli scripts (similmente a
+ <computeroutput>httpd_sys_script_t</computeroutput>). Hai
+ anche bisogno di autorizzare il
+ ruolo <computeroutput>system_r</computeroutput> per il
+ tipo.
</para>
<programlisting>
type httpd_sys_$1_exec_t, file_type, sysadmfile;
@@ -1058,9 +1059,9 @@
</step>
<step>
<para>
- Allow &APACHE; to execute the script, and cause it to
- transition to the script domain. You also want it to be
- able to signal your CGI script.
+ Permetti ad &APACHE; di eseguire lo script, e provocane la
+ transizione verso il dominio dello script. Vorrai altres�� che sia
+ capace di segnalare il tuo script CGI.
</para>
<programlisting>
domain_auto_trans(httpd_t, httpd_sys_$1_exec_t, httpd_sys_$1_t)
@@ -1069,11 +1070,11 @@
</step>
<step>
<para>
- Define new types for content. The following demonstrates
- a read-only type and a read-write type, but you can easily
- define different, more refined types. After defining
- them, grant your CGI domain the access to them that you
- want.
+ Definisci nuovi tipi per i contenuti. Cio che segue mostra
+ un tipo sola-lettura ed un tipo sola scrittura, ma puoi facilmente
+ definirne differenti, tipi pi�� raffinati. Dopo averli
+ definiti, garantisci al tuo dominio CGI l'accesso a quelli che
+ vuoi.
</para>
<programlisting>
type httpd_sys_$1_ro_t, file_type, sysadmfile;
@@ -1085,18 +1086,18 @@
<note>
<title>User domains in strict policy</title>
<para>
- On a strict policy system, you also need to allow the
- user domain to manage files with your new types. See
+ Su un sistema con policy strict, devi anche permettere al
+ dominio utente di manipolare i files con i nuovi tipi. Vedi
<computeroutput>apache_domain</computeroutput>.
</para>
</note>
</step>
<step>
<para>
- Now at this point, you need to give your new domain
- permissions. There are a lot of permissions defined in
- <computeroutput>apache_domain</computeroutput>. You can
- copy the core of those.
+ Adesso a questo punto, devi fornire i permessi al nuovo
+ dominio. Ci sono molti permessi definiti nel dominio
+ <computeroutput>apache_domain</computeroutput>. Puoi
+ copiarne il cuore.
</para>
<programlisting>
# Copied from apache_macros, more is needed
@@ -1113,85 +1114,85 @@
...
</programlisting>
<para>
- There are actually more permissions likely to be
- necessary; they have been omitted for brevity.
+ Attualmente ci sono ancora permessi che potrebbero essere
+ necessari; sono stati omessi per brevit��.
</para>
</step>
<step>
<para>
- You can now use your new macro to create the actual types:
+ Adesso puoi usare la nuova macro per creare i tipi attuali:
</para>
<programlisting>
apache_script_domain(wiki)
apache_script_domain(blog)
</programlisting>
<para>
- Looking at your macro definition, you can mentally
- substitute <computeroutput>wiki</computeroutput> and
- <computeroutput>blog</computeroutput> for
- <computeroutput>$1</computeroutput> and see what has
- happened. You can easily define quite a bit of policy,
- having built the macro.
+ Osservando le definizioni della tua macro, puoi mentalmente
+ sostituire <computeroutput>wiki</computeroutput> e
+ <computeroutput>blog</computeroutput> con
+ <computeroutput>$1</computeroutput> e vedere cos'��
+ successo. Puoi facilmente definire che specie di policy,
+ ha costruito la macro.
</para>
</step>
<step>
<para>
- Execute a <command>make reload</command> in the source
- directory. Debug any problems that occur.
+ Eseguite un <command>make reload</command> nella directory
+ dei sorgenti. Esegui il debug di ogni problema che occorre.
</para>
</step>
<step>
<para>
- Finally, you need to label your data. Use the
- <command>chcon</command> command to do this. For example,
- the wiki CGI executable should be labeled as
- <computeroutput>httpd_sys_wiki_exec_t</computeroutput>,
- its read-only data as
- <computeroutput>httpd_sys_wiki_ro_t</computeroutput>, and
- its database as
- <computeroutput>httpd_sys_wiki_rw_t</computeroutput>, etc.
- Similarly for the blog.
+ In fine, dovrai rietichettare i tuoi dati. Usa il
+ comando <command>chcon</command> per farlo. Per esempio,
+ gli eseguibili del CGI wiki dovranno essere etichettati come
+ <computeroutput>httpd_sys_wiki_exec_t</computeroutput>,
+ ed i suoi dati di sola lettura come
+ <computeroutput>httpd_sys_wiki_ro_t</computeroutput>, ed
+ il suo database come
+ <computeroutput>httpd_sys_wiki_rw_t</computeroutput>, etc.
+ In modo simile per il blog.
</para>
</step>
</procedure>
</section>
<section id="sn-multiple-httpd-subdomains">
- <title>Multiple HTTP Subdomains</title>
+ <title>Sottodomini HTTP multipli</title>
<para>
- In the virtual hosting setup outlined in <xref
- linkend="sn-suexec-and-cgi-scripts"/>, a compromise or
- misconfiguration of the main &APACHE;
- (<computeroutput>httpd_t</computeroutput>) means all sites are
- affected. It would be nice if you could actually have
- multiple &APACHE; servers, each running in their own domain;
- for example,
- <computeroutput>httpd_<replaceable>site</replaceable>_t</computeroutput>.
- This subsection simply discusses the problems and outlines
- possible solutions.
- </para>
- <para>
- Looking at the current policy, it is fairly obvious that in
- order to accomplish this goal, you will need to essentially
- rewrite it from scratch. The entire policy is predicated on a
- single <computeroutput>httpd_t</computeroutput>. The main
- idea would be to change it into a macro, along the lines of what you did
- with <computeroutput>apache_script_domain</computeroutput> in
+ Nell'installazione hosting virtuale descritta in <xref
+ linkend="sn-suexec-and-cgi-scripts"/>, una compromisione o
+ misconfigurazione del server principale &APACHE;
+ (<computeroutput>httpd_t</computeroutput>) significa che tutti i siti sono
+ affetti. Sarebbe bello se tu potessi attalmente avere
+ servers &APACHE; multipli, ogniuno eseguito nel proprio dominio;
+ per esempio,
+ <computeroutput>httpd_<replaceable>site</replaceable>_t</computeroutput>.
+ Questa sottosezione discute semplicemente i problemi e ne delinea
+ le possibili soluzioni.
+ </para>
+ <para>
+ Osservando la policy corrente, sembra abbastanza ovvio che per
+ conseguire un simile obbiettivo, hai bisogno essenzialmente
+ di riscriverla da capo. L'intera policy �� impostata su un
+ singolo <computeroutput>httpd_t</computeroutput>. L'idea
+ principale potrebbe essere di trasformarla in una macro, sulla falsa riga di quello che
+ hai fatto con <computeroutput>apache_script_domain</computeroutput> in
<xref linkend="sn-cgi-subdomains"/>.
- In fact, if you also want to have individual domains on
- CGI scripts, you will end up with types of the form:
- <computeroutput>httpd_<replaceable>vhost</replaceable>_sys_<replaceable>script</replaceable>_t</computeroutput>.
- For example,
- <computeroutput>httpd_examplecom_sys_wiki_t</computeroutput> would be
- a wiki CGI for <computeroutput>example.com</computeroutput>.
+ Infatti, se vuoi anche avere domini individuali sugli
+ scripts CGI, dovrai finire con tipi nella seguente forma:
+ <computeroutput>httpd_<replaceable>vhost</replaceable>_sys_<replaceable>script</replaceable>_t</computeroutput>.
+ Per esempio,
+ <computeroutput>httpd_examplecom_sys_wiki_t</computeroutput> sar��
+ un CGI wiki per <computeroutput>example.com</computeroutput>.
</para>
<para>
- Assuming that you have a macro
- <computeroutput>apache_server_domain</computeroutput> which
- defines all of the desired types and rules. If you are
- fortunate enough that you have an IP address per domain, one
- approach is simply to copy the
- <computeroutput>/usr/sbin/httpd</computeroutput> binary
- multiple times, but label each one differently:
+ Assumendo che tu abbia una macro
+ <computeroutput>apache_server_domain</computeroutput> che
+ definisca tutti i tipi e le regole che desideri. Se sei
+ abbastanza fortunato da avere un indirizzo ip per dominio, un
+ approccio �� semplicemente di copiare il
+ binario <computeroutput>/usr/sbin/httpd</computeroutput>
+ tutte le volte, ma rietichettando ogniuno differentemente:
</para>
<screen>
<command> ls -aZ /usr/sbin/httpd.*</command>
@@ -1199,54 +1200,54 @@
-rwxr-xr-x root root system_u:object_r:httpd_barorg_exec_t /usr/sbin/httpd.barorg
</screen>
<para>
- Next, have your init scripts give each one a separate
- configuration, for example <command>/usr/sbin/httpd.foocom -f
+ Successivamente, daremo a ciascuno dei nostri init scripts una configurazione
+ separata, per esempio <command>/usr/sbin/httpd.foocom -f
foocom.com</command>.
</para>
<para>
- If you have to serve multiple virtual sites from one IP
- address, one approach might be to modify the &APACHE; source
- code so that once it has read the desired domain from a
- requesting client, it passes off the request to a child which
- is running in the domain for that site.
+ Se devi servire molteplici siti virtuali da un singolo indirizzo
+ IP, un approccio potrebbe essere quello di modificare il codice
+ sorgente di &APACHE; affinch�� una volta letto il dominio desiderato da un
+ client richiedente, passi la richiesta ad un figlio che
+ corra nel dominio per quel sito.
</para>
</section>
<section id="sn-defining-webmaster">
- <title>Defining a Webmaster Role</title>
+ <title>Definizione del ruolo Webmaster</title>
<para>
- This guide has posited that, from a security point of view, a
- misconfigured &APACHE; is no different from a compromised one.
- &SEL; deliberately separates the security policy from the
- configuration of every daemon on the system. One neat
- consequence of this is that it allows you to actually create a
- <firstterm>webmaster</firstterm> role that is allowed to
- modify the &APACHE; configuration file
- <filename>/etc/httpd/conf/httpd.conf</filename>, restart the
- daemon, etc. But no matter how the webmaster changes the
- configuration, <command>httpd</command> is still restricted by
- the security policy.
- </para>
- <para>
- In order to do this, you would need to use the strict policy.
- The overall approach is to create a new account with a uid of
- 0, but only allowed to log in with the
- <computeroutput>webmaster_r</computeroutput> role, which is
- only authorized for the
- <computeroutput>webmaster_t</computeroutput> type. You could
- create <computeroutput>webmaster_t</computeroutput> with
- <computeroutput>full_user_role(webmaster)</computeroutput>,
- and then proceeed to add a few permissions, such as:
+ Questa guida ha supposto che, dal punto di vista della sicurezza, un
+ &APACHE; misconfigurato non �� differente da uno compromesso.
+ &SEL; separa deliberatamente la policy di sicurezza dalla
+ configurazione di ogni demone sul sistema. Una netta
+ conseguenza di ci��, �� che attualmente ti permette di creare un
+ ruolo <firstterm>webmaster</firstterm> a cui �� permesso di
+ modificare il file di configurazione di &APACHE;
+ <filename>/etc/httpd/conf/httpd.conf</filename>, riavviare il
+ demone, etc. Ma non ha importanza come il webmaster cambi la
+ configurazione, <command>httpd</command> �� ancora ristretto dalla
+ policy di sicurezza.
+ </para>
+ <para>
+ Per far questo, avrai bisogno di usare la policy strict.
+ L'approccio generale �� quello di creare un nuovo account con uid pari a
+ 0, ma a cui sia consentito il login esclusivamente
+ con il ruolo <computeroutput>webmaster_r</computeroutput>, che ��
+ solo autorizzato per il
+ tipo <computeroutput>webmaster_t</computeroutput>. Potresti
+ creare <computeroutput>webmaster_t</computeroutput> con
+ <computeroutput>full_user_role(webmaster)</computeroutput>,
+ e quindi procedere all'aggiunta di un po di permessi, tipo:
</para>
<programlisting>
create_dir_file(webmaster_t, httpd_config_t)
</programlisting>
<para>
- Since you are giving uid 0
- (<computeroutput>root</computeroutput>) access to the
- webmaster, in this setup you are entirely relying on the &SEL;
- policy. There is more to do here (making init scripts work
- will be slightly tricky), but this outlines the general idea.
- The remainder is left as an exercise for you.
+ Poich�� stai dando accesso uid 0
+ (<computeroutput>root</computeroutput>) al
+ webmaster, in questo tipo di installazione stai contando interamente sulla policy
+ &SEL;. C'�� molto altre da fare qui (rendere gli init scripts funzionanti
+ sar�� un po macchinoso), ma questo delinea l'idea generale.
+ Il resto ti �� lasciato come un esercizio.
</para>
</section>
</section>
18 years, 5 months
docs-common/bin copy-figs,1.1,1.2
by fedora-docs-commits@redhat.com
Author: jtr
Update of /cvs/docs/docs-common/bin
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv3253
Modified Files:
copy-figs
Log Message:
Always copy files with multiple dashes, as a courtesy to legacy files.
Added check for a "figs/Manifest-${LANG}" file. If found, get the
filenames to copy from that, else search the source tree by name.
Index: copy-figs
===================================================================
RCS file: /cvs/docs/docs-common/bin/copy-figs,v
retrieving revision 1.1
retrieving revision 1.2
diff -u -r1.1 -r1.2
--- copy-figs 11 Dec 2005 03:26:16 -0000 1.1
+++ copy-figs 12 Dec 2005 16:35:02 -0000 1.2
@@ -114,20 +114,47 @@
leadin=$(/usr/bin/dirname "${SRC}")
[ "${DEBUG}" ] || echo >&2 "leadin=|${leadin}|"
-find "${SRC}" -print |
+haveManifest=$(
+ [ "${DEBUG}" ] || echo >&2 "Checking ${SRC}/Manifest-${targetLang}"
+ if [ -f "${SRC}/Manifest-${targetLang}" ]; then
+ echo yes
+ else
+ echo no
+ fi
+)
+[ "${DEBUG}" ] || echo >&2 "haveManifest=|${haveManifest}|"
+
+(
+ if [ "${haveManifest}" = "yes" ]; then
+ # We have a manifest file, so get the list of
+ # RELATIVE filenames from there. Generate the
+ # "Manifest-${targetLang}" file like this:
+ # cd figs; find * -print >"Manifest-${targetLang}"
+ # or something similar
+ cat "${SRC}/Manifest-${targetLang}"
+ else
+ # No manifest, resort to a search
+ find "${SRC}" -print
+ fi
+) |
while read fn
do
# Skip anything that even looks like CVS or SVN
case "${fn}" in
- *CVS* | *svn* )
+ *CVS* | *.svn* )
continue
;;
esac
# Figure out the relative path for this pathname chunk
- rp=$(
- echo $(/usr/bin/dirname "${fn}")/$(/bin/basename "${fn}") |
- /bin/sed "s;^${leadin}/*;;"
- )
+ if [ "${haveManifest}" = "yes" ]; then
+ rp="${fn}"
+ fn="${SRC}/${rp}"
+ else
+ rp=$(
+ echo $(/usr/bin/dirname "${fn}")/$(/bin/basename "${fn}") |
+ /bin/sed "s;^${leadin}/*;;"
+ )
+ fi
[ "${DEBUG}" ] || echo >&2 "rp=|${rp}|"
# Copy directories, even if they are going to be empty.
# Inodes are cheap, as long as you have enough.
@@ -139,18 +166,22 @@
# May not want this file under any circumstances
bn=$(/bin/basename "${rp}")
filteredBn=$(echo "${bn}" | sed -n ${bnFilter})
- if [ -z "${filteredBn}" ]; then
+ if [ "${haveManifest}" = "no" -a -z "${filteredBn}" ]; then
[ "${DEBUG}" ] || echo >&2 "Filter rejects |${fn}|"
continue
fi
# We want this file if the language matches or if it is
# language neutral
- copyIt=no
+ copyIt=${haveManifest}
case "${bn}" in
- *-${LANG}.* )
+ *-${targetLang}.* )
# Has matching language
copyIt=yes
;;
+ *-*-* )
+ # Multiple dashes imply ambiguous filename
+ copyIt=yes
+ ;;
*-* )
# Doesn't match target language
;;
18 years, 5 months
docs-common Makefile.common,1.20,1.21
by fedora-docs-commits@redhat.com
Author: jtr
Update of /cvs/docs/docs-common
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv3219
Modified Files:
Makefile.common
Log Message:
Dolt! Pass the desired language to the script that needs to look at it!
Index: Makefile.common
===================================================================
RCS file: /cvs/docs/docs-common/Makefile.common,v
retrieving revision 1.20
retrieving revision 1.21
diff -u -r1.20 -r1.21
--- Makefile.common 11 Dec 2005 03:26:10 -0000 1.20
+++ Makefile.common 12 Dec 2005 16:32:16 -0000 1.21
@@ -85,8 +85,8 @@
[ -z "${HTMLCSSEXTRA}" ] || \
cp ${HTMLCSSEXTRA} $(DOCBASE)-$(1)/watermark.png
[ ! -d figs ] || \
- ${FDPDIR}/docs-common/bin/copy-figs -v -f '*.png' \
- figs $(DOCBASE)-$(1)
+ ${FDPDIR}/docs-common/bin/copy-figs -v -f '*.png' \
+ -l ${LANG} figs $(DOCBASE)-$(1)
endef
#
html:: $(foreach LANG,${LANGUAGES},$(DOCBASE)-$(LANG)/index.html)
18 years, 5 months
install-guide fedora-install-guide-adminoptions-en.xml, NONE, 1.1 Makefile, 1.14, 1.15 fedora-install-guide-en.xml, 1.30, 1.31 fedora-install-guide-intro-en.xml, 1.23, 1.24 fedora-install-guide-nextsteps-en.xml, 1.9, 1.10
by fedora-docs-commits@redhat.com
Author: elliss
Update of /cvs/docs/install-guide
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv9167
Modified Files:
Makefile fedora-install-guide-en.xml
fedora-install-guide-intro-en.xml
fedora-install-guide-nextsteps-en.xml
Added Files:
fedora-install-guide-adminoptions-en.xml
Log Message:
- Added "Management Options" section to cover boot options, and various other oddments.
- Amended URL tagging to XML-style.
--- NEW FILE fedora-install-guide-adminoptions-en.xml ---
<!-- $Id: -->
<chapter id="ch-admin-options">
<title>Appendix: Management Options</title>
<para>
The &FED; installation system includes a range of options and
functions for administrators.
</para>
<section id="sn-bootoptions">
<title>Boot Options</title>
<para>
To use boot options, enter <userinput>linux
<replaceable>option</replaceable></userinput> at the
<prompt>boot:</prompt>
prompt.
</para>
<para>
If you specify more than one option, separate each of the options
by a single space. For example:
</para>
<screen>
<userinput>linux <replaceable>option1</replaceable> <replaceable>option2</replaceable></userinput>
</screen>
<section id="sn-mode-rescue">
<title>Booting Your Computer with Rescue Mode</title>
<para>
You may use installation disc #1 to boot a command-line Linux
system without installing &FED; on the computer. This rescue
system may access the drives on your computer. Rescue mode
enables you to use the utilities and functions of a running
system to modify or repair an installed system.
</para>
<para>
To load the rescue mode, enter:
</para>
<screen>
<userinput>linux rescue</userinput>
</screen>
<para>
Specify the language, keyboard layout and network settings for
the rescue system with the screens that follow.
</para>
</section>
<section id="sn-mode-expert">
<title>Installing &FC; with Expert Mode</title>
<para>
The expert mode enables you to run the installation process with
additional options for hardware configuration.
</para>
<para>
To run the installation process in expert mode, enter:
</para>
<screen>
<userinput>linux expert</userinput>
</screen>
<para>
<remark role="FIXME">This is untested.
</remark>
</para>
</section>
<section id="sn-automating-installation">
<title>Automating the Installation</title>
<para>
<remark role="FIXME">Kickstart.
</remark>
</para>
</section>
<section id="sn-bootoptions-networking">
<title>Networking Options</title>
<para>
<remark role="FIXME">VNC, remote syslog, and options for network settings.
</remark>
</para>
</section>
<section id="sn-bootoptions-interface">
<title>Interface Options</title>
<para>
To run the installation process in text mode, enter:
</para>
<screen>
<userinput>linux text</userinput>
</screen>
<para>
<remark role="FIXME"> Add information on enabling serial console.
</remark>
</para>
</section>
<section id="sn-bootoptions-hardware">
<title>Hardware Compatibility Options</title>
<para>
<remark role="FIXME">Most of these options turn off configuring or using certain systems. Consider a table to summarise them.
</remark>
</para>
</section>
</section>
<section id="sn-memtest">
<title>Performing a Memory (RAM) Test</title>
<para>
Faults in memory modules may cause your system to freeze or crash
unpredictably. In some cases, memory faults may only cause errors
with particular combinations of software. For this reason, you
should test the memory of a computer before you install &FED; for
the first time, even if it has previously run other operating
systems.
</para>
<para>
To load the <command>memtest86</command> memory test utility,
enter <userinput>memtest86</userinput> at the
<prompt>boot:</prompt>
. The utility immediately starts the first test. By default,
<command>memtest86</command> carries out a total of ten tests.
</para>
<para>
To halt testing and reboot your computer, enter
<keycap>Esc</keycap> at any time.
</para>
</section>
<section id="sn-consoles-installation">
<title>Accessing the Consoles</title>
<para>
In addition to the main interface, or
<firstterm>console</firstterm>, the installation process provides
three other consoles. The shell console enables you to access the
command-line of the installation system. The two other consoles
display events as the installation proceeds. You may find these
consoles useful for diagnosing errors in the installation process.
</para>
<para>
To switch between the consoles of installation process, press the
key combinations shown below:
</para>
<table id="tb-consoles">
<title>Installation Consoles</title>
<tgroup cols="2">
<colspec colnum="1" colname="Console"/>
<colspec colnum="2" colname="Key Combination"/>
<thead>
<row>
<entry>Console</entry>
<entry>Key Combination</entry>
</row>
</thead>
<tbody>
<row>
<entry>
<para>
Main Console
</para>
</entry>
<entry>
<para>
<keycombo><keycap>Ctrl</keycap><keycap>Alt</keycap><keycap>F7</keycap>
</keycombo>
</para>
</entry>
</row>
<row>
<entry>
<para>
Shell Console
</para>
</entry>
<entry>
<para>
<keycombo><keycap>Ctrl</keycap><keycap>Alt</keycap><keycap>F2</keycap>
</keycombo>
</para>
</entry>
</row>
<row>
<entry>
<para>
Main Log Console
</para>
</entry>
<entry>
<para>
<keycombo><keycap>Ctrl</keycap><keycap>Alt</keycap><keycap>F3</keycap>
</keycombo>
</para>
</entry>
</row>
<row>
<entry>
<para>
Boot Log Console
</para>
</entry>
<entry>
<para>
<keycombo><keycap>Ctrl</keycap><keycap>Alt</keycap><keycap>F4</keycap>
</keycombo>
</para>
</entry>
</row>
</tbody>
</tgroup>
</table>
</section>
<section id="sn-aborting-installation">
<title>Aborting the Installation</title>
<para>
To abort the installation process at any time before the
<guilabel>Installing Packages</guilabel> screen, either press
<keycombo><keycap>Ctrl</keycap><keycap>Alt</keycap><keycap>Del</keycap>
</keycombo>
or power off the computer with the power switch. &FED; makes no
changes to your computer until package installation begins.
</para>
</section>
</chapter>
<!--
Local variables:
mode: xml
sgml-parent-document:("fedora-install-guide-en.xml" "book" "chapter")
fill-column: 72
End:
-->
Index: Makefile
===================================================================
RCS file: /cvs/docs/install-guide/Makefile,v
retrieving revision 1.14
retrieving revision 1.15
diff -u -r1.14 -r1.15
--- Makefile 4 Dec 2005 23:15:24 -0000 1.14
+++ Makefile 12 Dec 2005 02:21:54 -0000 1.15
@@ -14,7 +14,7 @@
DOCBASE = fedora-install-guide
define XMLEXTRAFILES_template
-XMLEXTRAFILES-$(1)=fedora-install-guide-abouttoinstall-$(1).xml fedora-install-guide-acknowledgements-$(1).xml fedora-install-guide-beginninginstallation-$(1).xml fedora-install-guide-bootloader-$(1).xml fedora-install-guide-diskpartitioning-$(1).xml fedora-install-guide-$(1).xml fedora-install-guide-firstboot-$(1).xml fedora-install-guide-installingpackages-$(1).xml fedora-install-guide-intro-$(1).xml fedora-install-guide-locale-$(1).xml fedora-install-guide-networkconfig-$(1).xml fedora-install-guide-nextsteps-$(1).xml fedora-install-guide-other-instmethods-$(1).xml fedora-install-guide-packageselection-$(1).xml fedora-install-guide-rootpassword-$(1).xml fedora-install-guide-timezone-$(1).xml fedora-install-guide-upgrading-$(1).xml
+XMLEXTRAFILES-$(1)=fedora-install-guide-abouttoinstall-$(1).xml fedora-install-guide-acknowledgements-$(1).xml fedora-install-guide-adminoptions-$(1).xml fedora-install-guide-beginninginstallation-$(1).xml fedora-install-guide-bootloader-$(1).xml fedora-install-guide-diskpartitioning-$(1).xml fedora-install-guide-$(1).xml fedora-install-guide-firstboot-$(1).xml fedora-install-guide-installingpackages-$(1).xml fedora-install-guide-intro-$(1).xml fedora-install-guide-locale-$(1).xml fedora-install-guide-networkconfig-$(1).xml fedora-install-guide-nextsteps-$(1).xml fedora-install-guide-other-instmethods-$(1).xml fedora-install-guide-packageselection-$(1).xml fedora-install-guide-rootpassword-$(1).xml fedora-install-guide-timezone-$(1).xml fedora-install-guide-upgrading-$(1).xml
endef
$(foreach LANG,${LANGUAGES},$(eval $(call XMLEXTRAFILES_template,${LANG})))
Index: fedora-install-guide-en.xml
===================================================================
RCS file: /cvs/docs/install-guide/fedora-install-guide-en.xml,v
retrieving revision 1.30
retrieving revision 1.31
diff -u -r1.30 -r1.31
--- fedora-install-guide-en.xml 10 Dec 2005 17:51:38 -0000 1.30
+++ fedora-install-guide-en.xml 12 Dec 2005 02:21:54 -0000 1.31
@@ -6,8 +6,8 @@
<!ENTITY DOCNAME "fedora-install-guide">
<!ENTITY DOCLANG "en">
-<!ENTITY DOCVERSION "1.0.6">
-<!ENTITY DOCDATE "2005-12-10">
+<!ENTITY DOCVERSION "1.0.7">
+<!ENTITY DOCDATE "2005-12-12">
<!ENTITY BOOKID "&DOCNAME;-&DOCLANG;-&DOCVERSION; (&DOCDATE;)">
<!ENTITY LEGALNOTICE SYSTEM "../docs-common/common/legalnotice-en.xml">
@@ -15,7 +15,7 @@
<!-- Bugzilla bug number for the draft notice -->
<!ENTITY BUG-NUM "129911">
<!ENTITY FCLOCALVER "5">
-<!ENTITY DOCLOCALVER "1.0.6"> <!-- what's this for again? -->
+<!ENTITY DOCLOCALVER "1.0.7"> <!-- what's this for again? -->
<!ENTITY INTRODUCTION SYSTEM "fedora-install-guide-intro-en.xml">
@@ -33,6 +33,7 @@
<!ENTITY INSTALLINGPACKAGES SYSTEM "fedora-install-guide-installingpackages-en.xml">
<!ENTITY FIRSTBOOT SYSTEM "fedora-install-guide-firstboot-en.xml">
<!ENTITY NEXTSTEPS SYSTEM "fedora-install-guide-nextsteps-en.xml">
+<!ENTITY ADMINOPTIONS SYSTEM "fedora-install-guide-adminoptions-en.xml">
<!ENTITY ACKNOWLEDGEMENTS SYSTEM "fedora-install-guide-acknowledgements-en.xml">
]>
@@ -174,6 +175,16 @@
</para>
</revdescription>
</revision>
+ <revision>
+ <revnumber>1.0.7</revnumber>
+ <date>2005-12-12</date>
+ <authorinitials>StuartEllis</authorinitials>
+ <revdescription>
+ <para>
+ Added Management Options section.
+ </para>
+ </revdescription>
+ </revision>
</revhistory>
</bookinfo>
@@ -207,6 +218,8 @@
&NEXTSTEPS;
+ &ADMINOPTIONS;
+
&ACKNOWLEDGEMENTS;
<index id="generated-index">
Index: fedora-install-guide-intro-en.xml
===================================================================
RCS file: /cvs/docs/install-guide/fedora-install-guide-intro-en.xml,v
retrieving revision 1.23
retrieving revision 1.24
diff -u -r1.23 -r1.24
--- fedora-install-guide-intro-en.xml 10 Dec 2005 22:54:33 -0000 1.23
+++ fedora-install-guide-intro-en.xml 12 Dec 2005 02:21:54 -0000 1.24
@@ -339,32 +339,31 @@
<title>Preparing Media</title>
<para>
- You may use the first CD or DVD installation disc from the
- complete &FC; distribution to boot your computer. For instructions
- to download and prepare this CD or DVD installation media, refer
+ To install &FC; from discs, you need five installation CDs, or the
+ installation DVD. There are separate disc sets for each supported
+ architecture.
+ </para>
+
+ <para>
+ For instructions to download and prepare this CD or DVD installation media, refer
to <ulink url="http://fedora.redhat.com/download/"/>. If you
already have the full set of &FC; installation media, skip to
<xref
linkend="sn-booting-from-disc"/>.
</para>
- <para>
- To install &FC; from discs, you need five installation CDs, or the
- installation DVD. There are separate disc sets for each supported
- architecture.
- </para>
-
<important>
<title>Architecture-Specific Distributions</title>
<para>
- To install &FC; you need the boot or installation media that is
+ To install &FC;, you must use the boot and installation media that is
particular to your architecture.
</para>
</important>
<para>
- The &FC; distribution also includes <firstterm>image
+ You may use the first CD or DVD installation disc from the
+ complete &FC; distribution to boot your computer. The &FC; distribution also includes <firstterm>image
files</firstterm> for boot-only CD or DVD media and USB media.
These files can be converted into bootable media using standard
Linux utilities or third-party programs on other operating
Index: fedora-install-guide-nextsteps-en.xml
===================================================================
RCS file: /cvs/docs/install-guide/fedora-install-guide-nextsteps-en.xml,v
retrieving revision 1.9
retrieving revision 1.10
diff -u -r1.9 -r1.10
--- fedora-install-guide-nextsteps-en.xml 8 Dec 2005 00:27:16 -0000 1.9
+++ fedora-install-guide-nextsteps-en.xml 12 Dec 2005 02:21:54 -0000 1.10
@@ -153,7 +153,7 @@
<para>
<ulink
- url="http://fedora.redhat.com/docs/">http://fedora.redhat.com/docs/</ulink>
+ url="http://fedora.redhat.com/docs/"/>
</para>
<para>
@@ -163,7 +163,7 @@
<para>
<ulink
- url="http://www.tldp.org/">http://www.tldp.org/</ulink>
+ url="http://www.tldp.org/"/>
</para>
<para>
@@ -173,7 +173,7 @@
<para>
<ulink
- url="http://www.redhat.com/docs/manuals/enterprise/">http://www.redhat.com/docs/manuals/enterprise/</ulink>
+ url="http://www.redhat.com/docs/manuals/enterprise/"/>
</para>
<para>
@@ -184,7 +184,7 @@
<para>
<ulink
- url="http://www.google.com/linux/">http://www.google.com/linux/</ulink>
+ url="http://www.google.com/linux/"/>
</para>
</section>
<section id="sn-community-help">
@@ -201,7 +201,7 @@
<para>
<ulink
- url="http://forums.fedoraforum.org/">http://forums.fedoraforum.org/</ulink>
+ url="http://forums.fedoraforum.org/"/>
</para>
</section>
<section id="sn-community">
@@ -221,7 +221,7 @@
<para>
<ulink
- url="http://fedora.redhat.com/participate/">http://fedora.redhat.com/participate/</ulink>
+ url="http://fedora.redhat.com/participate/"/>
</para>
</section>
</chapter>
18 years, 5 months