Choosing A Webhost:
A web hosting service is a type of Internet hosting service that allows individuals and organizations to provide their own website accessible via the World Wide Web. Web hosts are companies that provide space on a server they own for use by their clients as well as providing Internet connectivity, typically in a data center. Web hosts can also provide data center space and connectivity to the Internet for servers they do not own to be located in their data center, called colocation. more...
|
Re: fedora-selinux-list Digest, Vol 18, Issue 9: msg#00045
|
Subject: |
Re: fedora-selinux-list Digest, Vol 18, Issue 9 |
fedora-selinux-list-request@xxxxxxxxxx wrote:
On Fri, Aug 05, 2005 at 02:49:37PM -0400, Daniel J Walsh wrote:
Joe Orton wrote:
No, when mod_proxy is used as a generic HTTP proxy (a not entirely
uncommon configuration) it needs to be able to connect to any remote
port on any remote address.
Defaulting apache to can_network_connect_any=1 could allow a subverted
apache web server to be setup as a spammer, or a launch site for further
attacks. So I don't think this would be a good idea.
Currently the following is known to be broken in the default
configuration:
1) web applications which connect to remote {my,postgre}SQL databases
(and similarly, I guess, the Apache SQL-based-authentication modules)
This answers my previous question about why a phpBB forum could not
connect to the postgreSQL database if SElinux is enforcing.
2) all mod_proxy configurations (reverse proxy, forward proxy)
3) the parent connect()-to-listening-port "reap idle children"
interface, which has the impact:
a) one log message written to error_log per second when the server
acquiesces after a period of above-normal load and tries to reap idle
children
b) graceful restart does not work properly
The above all represent important functionality.
Agreed.
I'm not convinced that the security vs usability tradeoff is being won
in favour of enabling the boolean by default.
I don't quite understand this sentence. Are you saying the boolean
should be enabled by default? We certainly need the functionality. When
security gets in the way of getting the job done, then we have lost the
war.
Regards,
John
Regards,
joe
--
fedora-selinux-list mailing list
fedora-selinux-list@xxxxxxxxxx
http://www.redhat.com/mailman/listinfo/fedora-selinux-list
|
|
| |
