Hi,
I have a script, executed by apache, which is running in httpd_svn_script_t domain. This script calls svn-mailer(bin_t) which in turns calls /usr/sbin/sendmail.sendmail(sendmail_exec_t) and since there is no transition defined, sendmail still runs in httpd_svn_script_t and I get humongous amount of avc's. What would be the proper rule to add to the local policy to make sendmail running in the proper domain, sendmail_t? And for that matter if httpd_can_sendmail --> on, shouldn't it be happening automatically? Thank you.
Sincerely yours, Vadym Chepkov
On Sat, 2009-07-18 at 20:35 -0700, Vadym Chepkov wrote:
Hi,
I have a script, executed by apache, which is running in httpd_svn_script_t domain. This script calls svn-mailer(bin_t) which in turns calls /usr/sbin/sendmail.sendmail(sendmail_exec_t) and since there is no transition defined, sendmail still runs in httpd_svn_script_t and I get humongous amount of avc's. What would be the proper rule to add to the local policy to make sendmail running in the proper domain, sendmail_t? And for that matter if httpd_can_sendmail --> on, shouldn't it be happening automatically? Thank you.
Not sure about all this (sesearch and review of source policy might reveal the answer). I am not in my usual location so i cannot verify at the moment, however my personal opinion is that you might as well write some policy yourself to make this happen. Those httpd booleans are generally coarse grained.
If you write a policy for your script and do a transition from httpd_svn_script_t to myscript_t and than allow myscript_t to transition to the mail domain (probably something like sendmail_domtrans(myscript_t)). That way you do not pollute your httpd_svn_script_t domain too much with access vectors that are really meant for your script and not svn.
Sincerely yours, Vadym Chepkov
-- fedora-selinux-list mailing list fedora-selinux-list@redhat.com https://www.redhat.com/mailman/listinfo/fedora-selinux-list
I created httpd_svn_script_t for this exact purpose, I don't think another one is required.
sendmail_domtrans(httpd_svn_script_t) is the rule then? Thank you, I will try it.
Sincerely yours, Vadym Chepkov
--- On Sun, 7/19/09, Dominick Grift domg472@gmail.com wrote:
From: Dominick Grift domg472@gmail.com Subject: Re: add a transition rule To: "Vadym Chepkov" chepkov@yahoo.com Cc: "Fedora SELinux" fedora-selinux-list@redhat.com Date: Sunday, July 19, 2009, 7:06 AM On Sat, 2009-07-18 at 20:35 -0700, Vadym Chepkov wrote:
Hi,
I have a script, executed by apache, which is running
in httpd_svn_script_t domain. This script calls svn-mailer(bin_t) which in turns calls /usr/sbin/sendmail.sendmail(sendmail_exec_t) and since there is no transition defined, sendmail still runs in httpd_svn_script_t and I get humongous amount of avc's. What would be the proper rule to add to the local policy to make sendmail running in the proper domain, sendmail_t?
And for that matter if httpd_can_sendmail --> on,
shouldn't it be happening automatically? Thank you. Not sure about all this (sesearch and review of source policy might reveal the answer). I am not in my usual location so i cannot verify at the moment, however my personal opinion is that you might as well write some policy yourself to make this happen. Those httpd booleans are generally coarse grained.
If you write a policy for your script and do a transition from httpd_svn_script_t to myscript_t and than allow myscript_t to transition to the mail domain (probably something like sendmail_domtrans(myscript_t)). That way you do not pollute your httpd_svn_script_t domain too much with access vectors that are really meant for your script and not svn.
Sincerely yours, Vadym Chepkov
-- fedora-selinux-list mailing list fedora-selinux-list@redhat.com https://www.redhat.com/mailman/listinfo/fedora-selinux-list
On 07/19/2009 09:33 AM, Vadym Chepkov wrote:
I created httpd_svn_script_t for this exact purpose, I don't think another one is required.
sendmail_domtrans(httpd_svn_script_t) is the rule then? Thank you, I will try it.
Sincerely yours, Vadym Chepkov
--- On Sun, 7/19/09, Dominick Grift domg472@gmail.com wrote:
From: Dominick Grift domg472@gmail.com Subject: Re: add a transition rule To: "Vadym Chepkov" chepkov@yahoo.com Cc: "Fedora SELinux" fedora-selinux-list@redhat.com Date: Sunday, July 19, 2009, 7:06 AM On Sat, 2009-07-18 at 20:35 -0700, Vadym Chepkov wrote:
Hi,
I have a script, executed by apache, which is running
in httpd_svn_script_t domain. This script calls svn-mailer(bin_t) which in turns calls /usr/sbin/sendmail.sendmail(sendmail_exec_t) and since there is no transition defined, sendmail still runs in httpd_svn_script_t and I get humongous amount of avc's. What would be the proper rule to add to the local policy to make sendmail running in the proper domain, sendmail_t?
And for that matter if httpd_can_sendmail --> on,
shouldn't it be happening automatically? Thank you. Not sure about all this (sesearch and review of source policy might reveal the answer). I am not in my usual location so i cannot verify at the moment, however my personal opinion is that you might as well write some policy yourself to make this happen. Those httpd booleans are generally coarse grained.
If you write a policy for your script and do a transition from httpd_svn_script_t to myscript_t and than allow myscript_t to transition to the mail domain (probably something like sendmail_domtrans(myscript_t)). That way you do not pollute your httpd_svn_script_t domain too much with access vectors that are really meant for your script and not svn.
Sincerely yours, Vadym Chepkov
-- fedora-selinux-list mailing list fedora-selinux-list@redhat.com https://www.redhat.com/mailman/listinfo/fedora-selinux-list
-- fedora-selinux-list mailing list fedora-selinux-list@redhat.com https://www.redhat.com/mailman/listinfo/fedora-selinux-list
mta_send_mail is probably better, since it will cover all possible mailers, not just sendmail
Hi Vadym,
On 19/07/09 04:35, Vadym Chepkov wrote:
I have a script, executed by apache, which is running in httpd_svn_script_t domain. This script calls svn-mailer(bin_t) which in turns calls /usr/sbin/sendmail.sendmail(sendmail_exec_t) and since there is no transition defined, sendmail still runs in httpd_svn_script_t and I get humongous amount of avc's. What would be the proper rule to add to the local policy to make sendmail running in the proper domain, sendmail_t? And for that matter if httpd_can_sendmail --> on, shouldn't it be happening automatically? Thank you.
Sincerely yours, Vadym Chepkov
I'm just back off vacation and saw your email. Funnily enough I wrote an svnmailer policy a few weeks ago, so it would be interesting to compare notes:
I've actually split it into two modules, svnmailer for the policy itself, and svnmailer-extras for additional interfaces needed in other policy modules. I find this arrangement is easier to manage when getting policy merged upstream.
I made my hook scripts httpd_sys_script_exec_t and transition from there to httpd_svnmailer_script_t via a domtrans. The svn repository itself is httpd_sys_content_rw_t.
Paul.
Hi,
My policy is very simplistic
local.te apache_content_template(svn) domain_auto_trans(httpd_svn_script_t, sendmail_exec_t, sendmail_t)
local.fc # svn /var/svn(/.*)? gen_context(system_u:object_r:httpd_svn_script_ro_t,s0) /var/svn/(.*/)?hooks(/.*)? gen_context(system_u:object_r:httpd_svn_script_exec_t,s0) /var/svn/(.*/)?dav(/.*)? gen_context(system_u:object_r:httpd_svn_script_rw_t,s0) /var/svn/(.*/)?locks(/.*)? gen_context(system_u:object_r:httpd_svn_script_rw_t,s0) /var/svn/(.*/)?db(/.*)? gen_context(system_u:object_r:httpd_svn_script_rw_t,s0)
Works well
Sincerely yours, Vadym Chepkov
--- On Tue, 7/28/09, Paul Howarth paul@city-fan.org wrote:
From: Paul Howarth paul@city-fan.org Subject: Re: add a transition rule To: "Vadym Chepkov" chepkov@yahoo.com Cc: "Fedora SELinux" fedora-selinux-list@redhat.com Date: Tuesday, July 28, 2009, 9:46 AM Hi Vadym,
On 19/07/09 04:35, Vadym Chepkov wrote:
I have a script, executed by apache, which is running
in httpd_svn_script_t domain. This script calls svn-mailer(bin_t) which in turns calls /usr/sbin/sendmail.sendmail(sendmail_exec_t) and since there is no transition defined, sendmail still runs in httpd_svn_script_t and I get humongous amount of avc's. What would be the proper rule to add to the local policy to make sendmail running in the proper domain, sendmail_t?
And for that matter if httpd_can_sendmail -->
on, shouldn't it be happening automatically? Thank you.
Sincerely yours, Vadym Chepkov
I'm just back off vacation and saw your email. Funnily enough I wrote an svnmailer policy a few weeks ago, so it would be interesting to compare notes:
I've actually split it into two modules, svnmailer for the policy itself, and svnmailer-extras for additional interfaces needed in other policy modules. I find this arrangement is easier to manage when getting policy merged upstream.
I made my hook scripts httpd_sys_script_exec_t and transition from there to httpd_svnmailer_script_t via a domtrans. The svn repository itself is httpd_sys_content_rw_t.
Paul.
selinux@lists.fedoraproject.org
-
Daniel J Walsh -
Dominick Grift -
Paul Howarth -
Vadym Chepkov