[no subject]

> Success! Found the tool audit2allow and added the following to the
> policy.conf file:

Good deal -- that's what I was going to recommend doing with the avc: 
denied's. The main thing to watch with that is that what it does will often 
be too permissive....

> #line 83
> allow httpd_sys_script_t port_type:{ tcp_socket udp_socket } { send_msg
> recv_msg };
> #line 83
> allow httpd_sys_script_t sysctl_kernel_t:dir search;
> #line 83
> allow httpd_sys_script_t sysctl_t:dir search;
> #line 83
> allow httpd_sys_script_t tmp_t:sock_file write;
> #line 83
> allow httpd_sys_script_t httpd_sys_content_t:lnk_file read;
> #line 83
> allow httpd_sys_script_t sysctl_kernel_t:file read;
> #line 83
> allow httpd_sys_script_t unconfined_t:unix_stream_socket connectto;
> 
> 
> NOTE** This allows sql-ledger to run on FC3. I have NOT done a full
> policy analysis to determine if this opens up more than I want to have
> open.

I'd think you probably want to change the domain of sql-ledger to be
different from any other CGIs, and do your allows just for whatever domain
you use for sql-ledger. Right now, it's going to treat the entire
httpd_sys_script_t domain (which includes all CGIs) the same.... If that's
the only CGI you plan on having on there, though, I wouldn't worry about it.

later,
chris


</pre>
<!--X-Body-of-Message-End-->
<!--X-MsgBody-End-->
<!--X-Follow-Ups-->
<hr>
<ul><li><strong>Follow-Ups</strong>:
<ul>
<li><strong><a name="01025" href="msg01025.html">[ale] SElinux, Fedora3, and postgresql</a></strong>
<ul><li><em>From:</em> jkinney at localnetsolutions.com (James P. Kinney III)</li></ul></li>
</ul></li></ul>
<!--X-Follow-Ups-End-->
<!--X-References-->
<ul><li><strong>References</strong>:
<ul>
<li><strong><a name="01019" href="msg01019.html">[ale] SElinux, Fedora3, and postgresql</a></strong>
<ul><li><em>From:</em> jkinney at localnetsolutions.com (James P. Kinney III)</li></ul></li>
<li><strong><a name="01020" href="msg01020.html">[ale] SElinux, Fedora3, and postgresql</a></strong>
<ul><li><em>From:</em> kaboom at gatech.edu (Chris Ricker)</li></ul></li>
<li><strong><a name="01021" href="msg01021.html">[ale] SElinux, Fedora3, and postgresql</a></strong>
<ul><li><em>From:</em> jkinney at localnetsolutions.com (James P. Kinney III)</li></ul></li>
<li><strong><a name="01022" href="msg01022.html">[ale] SElinux, Fedora3, and postgresql</a></strong>
<ul><li><em>From:</em> jkinney at localnetsolutions.com (James P. Kinney III)</li></ul></li>
</ul></li></ul>
<!--X-References-End-->
<!--X-BotPNI-->
<ul>
<li>Prev by Date:
<strong><a href="msg01022.html">[ale] SElinux, Fedora3, and postgresql</a></strong>
</li>
<li>Next by Date:
<strong><a href="msg01024.html">[ale] Q: directing stream I/O _the_C++_way_</a></strong>
</li>
<li>Previous by thread:
<strong><a href="msg01022.html">[ale] SElinux, Fedora3, and postgresql</a></strong>
</li>
<li>Next by thread:
<strong><a href="msg01025.html">[ale] SElinux, Fedora3, and postgresql</a></strong>
</li>
<li>Index(es):
<ul>
<li><a href="maillist.html#01023"><strong>Date</strong></a></li>
<li><a href="threads.html#01023"><strong>Thread</strong></a></li>
</ul>
</li>
</ul>

<!--X-BotPNI-End-->
<!--X-User-Footer-->
<!--X-User-Footer-End-->
</body>
</html>