* [refpolicy] [PATCH] Allow spamd to connect to MySQL via TCP
@ 2010-04-26 18:48 Chris St. Pierre
2010-04-27 13:45 ` Christopher J. PeBenito
0 siblings, 1 reply; 4+ messages in thread
From: Chris St. Pierre @ 2010-04-26 18:48 UTC (permalink / raw)
To: refpolicy
Currently, spamd_t is only allowed to connect to a MySQL stream --
i.e., a local MySQL instance, not a remote one via TCP. This patch
fixes that issue.
diff --git a/policy/modules/services/spamassassin.te
b/policy/modules/services/spamassassin.te
index dd49d31..210a57a 100644
--- a/policy/modules/services/spamassassin.te
+++ b/policy/modules/services/spamassassin.te
@@ -412,6 +412,8 @@ optional_policy(`
optional_policy(`
mysql_search_db(spamd_t)
mysql_stream_connect(spamd_t)
+ corenet_tcp_connect_mysqld_port(spamd_t)
+ corenet_sendrecv_mysqld_client_packets(spamd_t)
')
optional_policy(`
--
Chris St. Pierre
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [refpolicy] [PATCH] Allow spamd to connect to MySQL via TCP
2010-04-26 18:48 [refpolicy] [PATCH] Allow spamd to connect to MySQL via TCP Chris St. Pierre
@ 2010-04-27 13:45 ` Christopher J. PeBenito
2010-04-27 14:14 ` Chris St. Pierre
0 siblings, 1 reply; 4+ messages in thread
From: Christopher J. PeBenito @ 2010-04-27 13:45 UTC (permalink / raw)
To: refpolicy
On Mon, 2010-04-26 at 13:48 -0500, Chris St. Pierre wrote:
> Currently, spamd_t is only allowed to connect to a MySQL stream --
> i.e., a local MySQL instance, not a remote one via TCP. This patch
> fixes that issue.
For completeness, something similar should also be added for postgresql.
> diff --git a/policy/modules/services/spamassassin.te
> b/policy/modules/services/spamassassin.te
> index dd49d31..210a57a 100644
> --- a/policy/modules/services/spamassassin.te
> +++ b/policy/modules/services/spamassassin.te
> @@ -412,6 +412,8 @@ optional_policy(`
> optional_policy(`
> mysql_search_db(spamd_t)
> mysql_stream_connect(spamd_t)
> + corenet_tcp_connect_mysqld_port(spamd_t)
> + corenet_sendrecv_mysqld_client_packets(spamd_t)
> ')
>
> optional_policy(`
>
--
Chris PeBenito
Tresys Technology, LLC
^ permalink raw reply [flat|nested] 4+ messages in thread
* [refpolicy] [PATCH] Allow spamd to connect to MySQL via TCP
2010-04-27 13:45 ` Christopher J. PeBenito
@ 2010-04-27 14:14 ` Chris St. Pierre
2010-04-27 14:32 ` Christopher J. PeBenito
0 siblings, 1 reply; 4+ messages in thread
From: Chris St. Pierre @ 2010-04-27 14:14 UTC (permalink / raw)
To: refpolicy
On Tue, Apr 27, 2010 at 8:45 AM, Christopher J. PeBenito
<cpebenito@tresys.com> wrote:
> On Mon, 2010-04-26 at 13:48 -0500, Chris St. Pierre wrote:
>> Currently, spamd_t is only allowed to connect to a MySQL stream --
>> i.e., a local MySQL instance, not a remote one via TCP. ?This patch
>> fixes that issue.
>
> For completeness, something similar should also be added for postgresql.
New patch:
diff --git a/policy/modules/services/spamassassin.te
b/policy/modules/services/spamassassin.te
index dd49d31..8a4089b 100644
--- a/policy/modules/services/spamassassin.te
+++ b/policy/modules/services/spamassassin.te
@@ -412,6 +412,8 @@ optional_policy(`
optional_policy(`
mysql_search_db(spamd_t)
mysql_stream_connect(spamd_t)
+ corenet_tcp_connect_mysqld_port(spamd_t)
+ corenet_sendrecv_mysqld_client_packets(spamd_t)
')
optional_policy(`
@@ -424,6 +426,8 @@ optional_policy(`
optional_policy(`
postgresql_stream_connect(spamd_t)
+ corenet_tcp_connect_postgresql_port(spamd_t)
+ corenet_sendrecv_postgresql_client_packets(spamd_t)
')
optional_policy(`
--
Chris St. Pierre
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [refpolicy] [PATCH] Allow spamd to connect to MySQL via TCP
2010-04-27 14:14 ` Chris St. Pierre
@ 2010-04-27 14:32 ` Christopher J. PeBenito
0 siblings, 0 replies; 4+ messages in thread
From: Christopher J. PeBenito @ 2010-04-27 14:32 UTC (permalink / raw)
To: refpolicy
On Tue, 2010-04-27 at 09:14 -0500, Chris St. Pierre wrote:
> On Tue, Apr 27, 2010 at 8:45 AM, Christopher J. PeBenito
> <cpebenito@tresys.com> wrote:
> > On Mon, 2010-04-26 at 13:48 -0500, Chris St. Pierre wrote:
> >> Currently, spamd_t is only allowed to connect to a MySQL stream --
> >> i.e., a local MySQL instance, not a remote one via TCP. This patch
> >> fixes that issue.
> >
> > For completeness, something similar should also be added for postgresql.
>
> New patch:
Merged. In the future, please use tabs for indentation, rather than
spaces.
> diff --git a/policy/modules/services/spamassassin.te
> b/policy/modules/services/spamassassin.te
> index dd49d31..8a4089b 100644
> --- a/policy/modules/services/spamassassin.te
> +++ b/policy/modules/services/spamassassin.te
> @@ -412,6 +412,8 @@ optional_policy(`
> optional_policy(`
> mysql_search_db(spamd_t)
> mysql_stream_connect(spamd_t)
> + corenet_tcp_connect_mysqld_port(spamd_t)
> + corenet_sendrecv_mysqld_client_packets(spamd_t)
> ')
>
> optional_policy(`
> @@ -424,6 +426,8 @@ optional_policy(`
>
> optional_policy(`
> postgresql_stream_connect(spamd_t)
> + corenet_tcp_connect_postgresql_port(spamd_t)
> + corenet_sendrecv_postgresql_client_packets(spamd_t)
> ')
>
> optional_policy(`
>
--
Chris PeBenito
Tresys Technology, LLC
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2010-04-27 14:32 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2010-04-26 18:48 [refpolicy] [PATCH] Allow spamd to connect to MySQL via TCP Chris St. Pierre
2010-04-27 13:45 ` Christopher J. PeBenito
2010-04-27 14:14 ` Chris St. Pierre
2010-04-27 14:32 ` Christopher J. PeBenito
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.