Regards to all the list I was wondering if any of you have deployed Traffic Server under SELinux ´s policies? If it´s true, Where I can find the work?
On Wed, 2011-06-15 at 17:09 -0430, Marcos Ortiz wrote:
Regards to all the list I was wondering if any of you have deployed Traffic Server under SELinux ´s policies? If it´s true, Where I can find the work?
I suspect selinux does not "support" that yet. You can determine by grepping the "Traffic server" process in ps -auxZ. If it is running in the initrc_t domain then that means that SELinux is currently not aware of this application.
In that case we can work to make SELinux support this application. If you want to help us support this application let us know so that we can make arrangements to get this going.
-- selinux mailing list selinux@lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/selinux
On 06/15/2011 04:42 PM, Dominick Grift wrote:
On Wed, 2011-06-15 at 17:09 -0430, Marcos Ortiz wrote:
Regards to all the list I was wondering if any of you have deployed Traffic Server under SELinux ´s policies? If it´s true, Where I can find the work?
I suspect selinux does not "support" that yet. You can determine by grepping the "Traffic server" process in ps -auxZ. If it is running in the initrc_t domain then that means that SELinux is currently not aware of this application.
In that case we can work to make SELinux support this application. If you want to help us support this application let us know so that we can make arrangements to get this going.
-- selinux mailing list selinux@lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/selinux
Ok, thanks a lot, Dominick. I think that´s a good start to me. Well, for anyone that don´t know what is Apache Traffic Server, I let its description from its own official site:
Apache Traffic Server™ is fast, scalable and extensible HTTP/1.1 compliant caching proxy server. Formerly a commercial product, Yahoo! donated it to the Apache Foundation, and is now an Apache TLP.
TS can be deployed in three modes: - as a web proxy proxy cache - as a reverse proxy - In a cache hierarchy
Everything can be read here for version 2: http://trafficserver.apache.org/docs/v2/admin/intro.htm and here for version 3 http://trafficserver.apache.org/docs/v3/admin/intro.htm
There are there processes that work together to serve TS request and manage/control/monitor the health of the completed system: - The traffic_server process is the transaction processing engine of Traffic Server. It is responsible for accepting connections, processing protocol requests, and serving documents from the cache or origin server.
- The traffic_manager process is the command and control facility of the Traffic Server, responsible for launching, monitoring, and reconfiguring the traffic_server process. The traffic_manager process is also responsible for the proxy autoconfiguration port, the statistics interface, cluster administration, and virtual IP failover. If the traffic_manager process detects a traffic_server process failure, it instantly restarts the process but also maintains a connection queue of all incoming requests. All incoming connections that arrive in the several seconds before full server restart are saved in the connection queue and processed in first-come, first-served order. This connection queueing shields users from any server restart downtime.
- The traffic_cop process monitors the health of both the traffic_server and traffic_manager processes. The traffic_cop process periodically (several times each minute) queries the traffic_server and traffic_manager process by issuing heartbeat requests to fetch synthetic web pages. In the event of failure (if no response is received within a timeout interval or if an incorrect response is received) , traffic_cop restarts the traffic_manager and traffic_server processes.
On Wed, 2011-06-15 at 17:54 -0430, Marcos Ortiz wrote:
Ok, thanks a lot, Dominick. I think that´s a good start to me.
So i gather that you determined that SELinux currently does not support this application?
Can i ask you:
what made you come here? Were you facing SELinux related issues with this application?
To be able to add SELinux support for your application, we would need to work toether a bit. That is to say: Someone with some knowledge about how to configure this app lication would need to be able to test the policy and provide feedback.
Is this application available in the Fedora repository?
Would you be able to help us test any provided SELinux configuration and give us feedback.
There are currently a thousand and one applications not "supported" by SELinux in one sense or another. To be able to add that support for your application it would help if you could help us make this work by providing information, help us test policy and provide feedback.
Some of the first questions i usually ask are:
Can you make the application work with SELinux in permissive mode and if so can you provide a listing of all the files that this package installs (rpm -ql $package_name)
Yes, I can help to test this application under SELinux
El 6/15/2011 6:07 PM, Dominick Grift escribió:x
On Wed, 2011-06-15 at 17:54 -0430, Marcos Ortiz wrote:
Ok, thanks a lot, Dominick. I think that´s a good start to me.
So i gather that you determined that SELinux currently does not support this application?
Can i ask you:
what made you come here? Were you facing SELinux related issues with this application?
I have not done anything yet
To be able to add SELinux support for your application, we would need to work toether a bit. That is to say: Someone with some knowledge about how to configure this app lication would need to be able to test the policy and provide feedback.
Is this application available in the Fedora repository?
I read about this a message from the Traffic Server's user list and I found this
https://bugzilla.redhat.com/show_bug.cgi?id=683463
from Jan-Frode Myklebust (janfrode@tanso.net) I think that TS is on the EPEL repository, I will look for this.
Would you be able to help us test any provided SELinux configuration and give us feedback.
Yes, I will provide all the feedback that I could
There are currently a thousand and one applications not "supported" by SELinux in one sense or another. To be able to add that support for your application it would help if you could help us make this work by providing information, help us test policy and provide feedback.
Some of the first questions i usually ask are:
Can you make the application work with SELinux in permissive mode and if so can you provide a listing of all the files that this package installs (rpm -ql $package_name)
That's the first action that I want to take. I will install the completed test environment and I will send you all the files that this application uses, read and write.
selinux@lists.fedoraproject.org