Hello, all:
I'm finally done with my very first selinux policy, and I would much appreciate if some of you could look over it to see if it's sane. Found here:
http://icon.fedorapeople.org/f/memcached/memcached.te http://icon.fedorapeople.org/f/memcached/memcached.fc
Nothing in the .if file. For reference, there's a .spec and daemon init files in the same directory
Any comments or improvement suggestions would be gratefully welcomed!
Cheers,
On Fri, 2007-09-07 at 20:00 -0400, Konstantin Ryabitsev wrote:
Hello, all:
I'm finally done with my very first selinux policy, and I would much appreciate if some of you could look over it to see if it's sane. Found here:
http://icon.fedorapeople.org/f/memcached/memcached.te http://icon.fedorapeople.org/f/memcached/memcached.fc
Nothing in the .if file. For reference, there's a .spec and daemon init files in the same directory
Any comments or improvement suggestions would be gratefully welcomed!
Looks nice. I don't have a clue what memcached is supposed to do to verify the security aspect, but the .te and .fc files look good.
Forrest
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Konstantin Ryabitsev wrote:
Hello, all:
I'm finally done with my very first selinux policy, and I would much appreciate if some of you could look over it to see if it's sane. Found here:
http://icon.fedorapeople.org/f/memcached/memcached.te http://icon.fedorapeople.org/f/memcached/memcached.fc
Nothing in the .if file. For reference, there's a .spec and daemon init files in the same directory
Any comments or improvement suggestions would be gratefully welcomed!
Cheers,
Looks good, I think you will need some interfaces though.
rpm -qi memcached ... Description : memcached is a high-performance, distributed memory object caching system, generic in nature, but intended for use in speeding up dynamic web applications by alleviating database load.
Do web applications communicate with this daemon over the network port?
Please submit to upstream for approval, Then lets get it into fedora.
On 9/12/07, Daniel J Walsh dwalsh@redhat.com wrote:
Do web applications communicate with this daemon over the network port?
Yes, normally via tcp. I don't think they actually use unix sockets. What kind of interface(s) would be useful for that?
Please submit to upstream for approval, Then lets get it into fedora.
By upstream, do you mean the packager, or the very upstream?
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Konstantin Ryabitsev wrote:
On 9/12/07, Daniel J Walsh dwalsh@redhat.com wrote:
Do web applications communicate with this daemon over the network port?
Yes, normally via tcp. I don't think they actually use unix sockets. What kind of interface(s) would be useful for that?
You need to define a port type memcached_port_t; port_type(memcached_port_t) allow memcached_t memcached_port_t:tcp_socket name_bind;
Interfaces would be something like
interface(`memcached_port_connect'. ` gen_require (` type memcached_port_t; ') allow $1 memcached_port_t:tcp_port name_connect; ')
Finally need to execute
semanage port -a -m memcached_port_t -P tcp 11211
Please submit to upstream for approval, Then lets get it into fedora.
By upstream, do you mean the packager, or the very upstream?
Either. If the packager wants to ship it with his product all the better.
selinux@lists.fedoraproject.org