Joe Orton wrote:
On Mon, Aug 15, 2005 at 11:21:51AM -0400, Daniel J Walsh wrote:
Latest policy has
can_ldap(httpd_t) which should allow httpd scripts to connect to the ldap port. Could I give a similar connect to mysql to solve your problem?
That won't fix (2) or (3), either of which alone would be sufficient justification to enable the boolean by default:
reminder for 2 and 3:
all mod_proxy configurations (reverse proxy, forward proxy)
the parent connect()-to-listening-port "reap idle children"
interface, which has the impact:
joe
-- fedora-selinux-list mailing list fedora-selinux-list@redhat.com http://www.redhat.com/mailman/listinfo/fedora-selinux-list
How about...
######################################## # Set up networking ########################################
can_network(httpd_t) can_kerberos(httpd_t) can_resolve(httpd_t) can_ypbind(httpd_t) can_ldap(httpd_t) allow httpd_t { http_port_t http_cache_port_t }:tcp_socket name_bind; # allow httpd to connect to mysql/posgresql allow httpd_t { postgresql_port_t mysqld_port_t }:tcp_socket name_connect; # allow httpd to work as a relay allow httpd_t { gopher_port_t ftp_port_t http_port_t http_cache_port_t }:tcp_socket name_connect;