Skip to contentSkip to conversation

Allow spamd to connect to MySQL via TCP

PATCH New Chris St. Pierre 2 participants 4 messages Apr 26, 2010 – Apr 27, 2010

lore
Share & tools
lore

Chris St. Pierre

author
#0 lore raw

PATCH 1/1 Allow spamd to connect to MySQL via TCP

Currently, spamd_t is only allowed to connect to a MySQL stream -- i.e., a local MySQL instance, not a remote one via TCP. This patch fixes that issue.

(quoted diff) +0 -0

b/policy/modules/services/spamassassin.te
index dd49d31..210a57a 100644

policy/modules/services/spamassassin.te +2 -0
@@ -412,6 +412,8 @@ optional_policy(`
 optional_policy(`
        mysql_search_db(spamd_t)
        mysql_stream_connect(spamd_t)
+       corenet_tcp_connect_mysqld_port(spamd_t)
+       corenet_sendrecv_mysqld_client_packets(spamd_t)
 ')
 
 optional_policy(`
Signature · 1 line
Chris St. Pierre
#1 lore raw

PATCH 1/1 Allow spamd to connect to MySQL via TCP

Quoted 3 lines · Chris St. Pierre

Currently, spamd_t is only allowed to connect to a MySQL stream -- i.e., a local MySQL instance, not a remote one via TCP. This patch fixes that issue.

For completeness, something similar should also be added for postgresql.

Quoted 15 lines
policy/modules/services/spamassassin.te +2 -0
index dd49d31..210a57a 100644
@@ -412,6 +412,8 @@ optional_policy(`
 optional_policy(`
        mysql_search_db(spamd_t)
        mysql_stream_connect(spamd_t)
+       corenet_tcp_connect_mysqld_port(spamd_t)
+       corenet_sendrecv_mysqld_client_packets(spamd_t)
 ')
 
 optional_policy(`
Signature · 2 lines
Chris PeBenito
Tresys Technology, LLC
author
#2 lore raw

PATCH 1/1 Allow spamd to connect to MySQL via TCP

Quoted 6 lines · Christopher J. PeBenito
Quoted 3 lines · Chris St. Pierre

Currently, spamd_t is only allowed to connect to a MySQL stream -- i.e., a local MySQL instance, not a remote one via TCP. ?This patch fixes that issue.

For completeness, something similar should also be added for postgresql.

New patch:

(quoted diff) +0 -0

b/policy/modules/services/spamassassin.te
index dd49d31..8a4089b 100644

policy/modules/services/spamassassin.te +4 -0
@@ -412,6 +412,8 @@ optional_policy(`
 optional_policy(`
        mysql_search_db(spamd_t)
        mysql_stream_connect(spamd_t)
+       corenet_tcp_connect_mysqld_port(spamd_t)
+       corenet_sendrecv_mysqld_client_packets(spamd_t)
 ')
 
 optional_policy(`

@@ -424,6 +426,8 @@ optional_policy(`
 
 optional_policy(`
        postgresql_stream_connect(spamd_t)
+       corenet_tcp_connect_postgresql_port(spamd_t)
+       corenet_sendrecv_postgresql_client_packets(spamd_t)
 ')
 
 optional_policy(`
Signature · 1 line
Chris St. Pierre
#3 lore raw

PATCH 1/1 Allow spamd to connect to MySQL via TCP

Quoted 10 lines · Chris St. Pierre
Quoted 6 lines · Christopher J. PeBenito
Quoted 3 lines · Chris St. Pierre

Currently, spamd_t is only allowed to connect to a MySQL stream -- i.e., a local MySQL instance, not a remote one via TCP. This patch fixes that issue.

For completeness, something similar should also be added for postgresql.

New patch:

Merged. In the future, please use tabs for indentation, rather than spaces.

Quoted 24 lines
policy/modules/services/spamassassin.te +4 -0
index dd49d31..8a4089b 100644
@@ -412,6 +412,8 @@ optional_policy(`
 optional_policy(`
        mysql_search_db(spamd_t)
        mysql_stream_connect(spamd_t)
+       corenet_tcp_connect_mysqld_port(spamd_t)
+       corenet_sendrecv_mysqld_client_packets(spamd_t)
 ')
 
 optional_policy(`

@@ -424,6 +426,8 @@ optional_policy(`
 
 optional_policy(`
        postgresql_stream_connect(spamd_t)
+       corenet_tcp_connect_postgresql_port(spamd_t)
+       corenet_sendrecv_postgresql_client_packets(spamd_t)
 ')
 
 optional_policy(`
Signature · 2 lines
Chris PeBenito
Tresys Technology, LLC