Few contrib updates
cover Few contrib updates
A few more contrib updates
Sven Vermeulen (2):
Grant write privileges to squid on its log files Use nscd socket for webalizer
squid.te | 2 +- webalizer.te | 4 ++++ 2 files changed, 5 insertions(+), 1 deletion(-)
Signature · 1 line
1.8.1.5
PATCH 1/2 Grant write privileges to squid on its log files
The squid daemon currently seems to require write privileges on the files (squid_log_t) - append no longer cuts it. This is confirmed for both the cache.log file as well as the netdb.state file.
Switching append_files_pattern to write_files_pattern.
--- squid.te | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
squid.te +1 -1
@@ -74,7 +74,7 @@ allow squid_t squid_conf_t:file read_file_perms; allow squid_t squid_conf_t:lnk_file read_lnk_file_perms; manage_dirs_pattern(squid_t, squid_log_t, squid_log_t) -append_files_pattern(squid_t, squid_log_t, squid_log_t) +write_files_pattern(squid_t, squid_log_t, squid_log_t) create_files_pattern(squid_t, squid_log_t, squid_log_t) setattr_files_pattern(squid_t, squid_log_t, squid_log_t) manage_lnk_files_pattern(squid_t, squid_log_t, squid_log_t)
Signature · 1 line
1.8.1.5
PATCH 1/2 Grant write privileges to squid on its log files
Quoted 3 lines · Sven Vermeulen
The squid daemon currently seems to require write privileges on the files (
squid_log_t) - append no longer cuts it. This is confirmed for both the cache.log file as well as the netdb.state file.
Merged with changes, thanks
You might as well use a single manage_files_pattern now
Quoted 21 lines
Switching
append_files_patterntowrite_files_pattern.Signed-off-by Sven Vermeulen <[email protected]>--- squid.te | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)squid.te +1
-1@@ -74,7 +74,7 @@ allow squid_t squid_conf_t:file read_file_perms; allow squid_t squid_conf_t:lnk_file read_lnk_file_perms; manage_dirs_pattern(squid_t, squid_log_t, squid_log_t) -append_files_pattern(squid_t, squid_log_t, squid_log_t) +write_files_pattern(squid_t, squid_log_t, squid_log_t) create_files_pattern(squid_t, squid_log_t, squid_log_t) setattr_files_pattern(squid_t, squid_log_t, squid_log_t) manage_lnk_files_pattern(squid_t, squid_log_t, squid_log_t)
PATCH 2/2 Use nscd socket for webalizer
In reply to Sven VermeulenThe webalizer application accesses the nscd service to optimize DNS queries.
--- webalizer.te | 4 ++++ 1 file changed, 4 insertions(+)
webalizer.te +4 -0
@@ -89,5 +89,9 @@ optional_policy(` ') optional_policy(` + nscd_socket_use(webalizer_t) +') + +optional_policy(` squid_read_log(webalizer_t) ')
Signature · 1 line
1.8.1.5
PATCH 2/2 Use nscd socket for webalizer
Quoted 1 line · Sven Vermeulen
The webalizer application accesses the nscd service to optimize DNS queries.
There is a boolean for that "nscd_use_shm" (also applies to webalizer)
nscd clients either use shm or socket
can you use audit2why on that avc denial to see if it suggests toggling the boolean?
Quoted 20 lines
Signed-off-by Sven Vermeulen <[email protected]>--- webalizer.te | 4 ++++ 1 file changed, 4 insertions(+)webalizer.te +4
-0@@ -89,5 +89,9 @@ optional_policy(` ') optional_policy(` + nscd_socket_use(webalizer_t) +') + +optional_policy(` squid_read_log(webalizer_t) ')
PATCH 2/2 Use nscd socket for webalizer
Quoted 9 lines · Dominick Grift
Quoted 1 line · Sven Vermeulen
The webalizer application accesses the nscd service to optimize DNS queries.
There is a boolean for that "
nscd_use_shm" (also applies to webalizer)nscd clients either use shm or socket
can you use audit2why on that avc denial to see if it suggests toggling the boolean?
Indeed, my bad. I should've known better.
Wkr,
Sven Vermeulen