Changes between Version 5 and Version 6 of RubyCASServer

Timestamp:

Feb 7, 2012 12:03:16 PM (13 years ago)

Author:

brose

Comment:

--

RubyCASServer

@@ -119 +119 @@
 }}}
 [[BR]]
-Note that I disabled SELinux. This should be used only for testing purposes, to generate policy files. Here is an example SELinux policy file that worked for me (but needs a serious cleanup):[[BR]]
+Note that I disabled SELinux. This should be used only for testing purposes, to generate policy files. Here is an example SELinux policy file that worked for me (but may still be a little lax):[[BR]]
 {{{
-module rubycasserver 1.0;
+module cscas 1.1;
 
 require {
-        type unconfined_t;
-        type init_t;
-        type auditd_t;
-        type mysqld_t;
-        type syslogd_t;
-        type getty_t;
-        type initrc_t;
-        type var_log_t;
-        type tmp_t;
-        type rpm_script_t;
-        type mysqld_db_t;
-        type dhcpc_t;
-        type local_login_t;
-        type httpd_tmp_t;
-        type kernel_t;
-        type mysqld_var_run_t;
-        type usr_t;
-        type postfix_qmgr_t;
-        type passenger_t;
-        type postfix_master_t;
-        type udev_t;
-        type mysqld_safe_t;
-        type postfix_pickup_t;
-        type groupadd_t;
-        type crond_t;
-        type rpm_t;
-        type system_cronjob_t;
-        type plymouthd_t;
-        type httpd_t;
-        type sshd_t;
-        class unix_stream_socket connectto;
-        class capability { sys_resource sys_ptrace sys_tty_config };
-        class tcp_socket listen;
-        class file { setattr read create write getattr unlink open append };
-        class sock_file { write getattr setattr create unlink };
-        class dir { search setattr read create write getattr rmdir remove_name add_name };
+        type unconfined_t;
+        type automount_t;
+        type rpcbind_t;
+        type passenger_tmp_t;
+        type var_log_t;
+        type httpd_t;
+        type mysqld_port_t;
+        type rpcd_t;
+        type passenger_t;
+        class sock_file { write getattr setattr create unlink };
+        class tcp_socket { name_connect listen };
+        class capability { sys_resource sys_ptrace };
+        class dir { write getattr search add_name };
+        class file { write getattr setattr read create open append };
 }
 
 #============= httpd_t ==============
-allow httpd_t tmp_t:sock_file write;
+allow httpd_t passenger_tmp_t:dir { write search getattr add_name };
+allow httpd_t passenger_tmp_t:file { write create open setattr };
+allow httpd_t passenger_tmp_t:sock_file write;
 
 #============= passenger_t ==============
-allow passenger_t auditd_t:dir { getattr search };
-allow passenger_t auditd_t:file { read open };
-allow passenger_t crond_t:dir { getattr search };
-allow passenger_t crond_t:file { read open };
-allow passenger_t dhcpc_t:dir { getattr search };
-allow passenger_t dhcpc_t:file { read open };
-allow passenger_t getty_t:dir { getattr search };
-allow passenger_t getty_t:file { read open };
-allow passenger_t groupadd_t:dir { getattr search };
-allow passenger_t groupadd_t:file { read open };
+allow passenger_t automount_t:dir { getattr search };
+allow passenger_t automount_t:file { read open };
 allow passenger_t httpd_t:dir { getattr search };
 allow passenger_t httpd_t:file { read open };
-allow passenger_t httpd_tmp_t:file { getattr unlink setattr };
-allow passenger_t init_t:dir { getattr search };
-allow passenger_t init_t:file { read open };
-allow passenger_t initrc_t:dir { getattr search };
-allow passenger_t initrc_t:file { read open };
-allow passenger_t kernel_t:dir { getattr search };
-allow passenger_t kernel_t:file { read open };
-allow passenger_t local_login_t:dir { getattr search };
-allow passenger_t local_login_t:file { read open };
-allow passenger_t mysqld_db_t:dir search;
-allow passenger_t mysqld_safe_t:dir { getattr search };
-allow passenger_t mysqld_safe_t:file { read open };
-allow passenger_t mysqld_t:dir { getattr search };
-allow passenger_t mysqld_t:file { read open };
-allow passenger_t mysqld_t:unix_stream_socket connectto;
-allow passenger_t mysqld_var_run_t:sock_file write;
-allow passenger_t plymouthd_t:dir { getattr search };
-allow passenger_t plymouthd_t:file { read open };
-allow passenger_t postfix_master_t:dir { getattr search };
-allow passenger_t postfix_master_t:file { read open };
-allow passenger_t postfix_pickup_t:dir { getattr search };
-allow passenger_t postfix_pickup_t:file { read open };
-allow passenger_t postfix_qmgr_t:dir { getattr search };
-allow passenger_t postfix_qmgr_t:file { read open };
-allow passenger_t rpm_script_t:dir { getattr search };
-allow passenger_t rpm_script_t:file { read open };
-allow passenger_t rpm_t:dir { search getattr };
-allow passenger_t rpm_t:file { read open };
-allow passenger_t self:capability { sys_resource sys_ptrace sys_tty_config };
-allow passenger_t self:tcp_socket listen;
-allow passenger_t sshd_t:dir { getattr search };
-allow passenger_t sshd_t:file { read open };
-allow passenger_t syslogd_t:dir { getattr search };
-allow passenger_t syslogd_t:file { read open };
-allow passenger_t system_cronjob_t:dir { getattr search };
-allow passenger_t system_cronjob_t:file { read open };
-allow passenger_t tmp_t:dir { write rmdir setattr read remove_name create add_name };
-allow passenger_t tmp_t:file { write getattr setattr read create unlink open };
-allow passenger_t tmp_t:sock_file { write create unlink getattr setattr };
-allow passenger_t udev_t:dir { getattr search };
-allow passenger_t udev_t:file { read open };
+allow passenger_t mysqld_port_t:tcp_socket name_connect;
+allow passenger_t passenger_tmp_t:sock_file { write create unlink getattr setattr };
+allow passenger_t rpcbind_t:dir { getattr search };
+allow passenger_t rpcbind_t:file { read open };
+allow passenger_t rpcd_t:dir { getattr search };
+allow passenger_t rpcd_t:file { read open };
+allow passenger_t self:capability { sys_resource sys_ptrace };
 allow passenger_t unconfined_t:dir { getattr search };
 allow passenger_t unconfined_t:file { read open };
-allow passenger_t usr_t:file { read getattr open };
 allow passenger_t var_log_t:file { getattr open append };
 }}}