Choosing A Webhost:
A web hosting service is a type of Internet hosting service that allows individuals and organizations to provide their own website accessible via the World Wide Web. Web hosts are companies that provide space on a server they own for use by their clients as well as providing Internet connectivity, typically in a data center. Web hosts can also provide data center space and connectivity to the Internet for servers they do not own to be located in their data center, called colocation. more...
|
Re: Adding two new booleans to httpd to tighten it's security.: msg#00035
|
Subject: |
Re: Adding two new booleans to httpd to tighten it's security. |
Nicklas Norling wrote:
> Daniel J Walsh wrote:
>
>>
>> Currently policy allows httpd to connect to relay ports and to
>> mysql/postgres ports.
>>
>> Adding these booleans
>> * httpd_can_network_relay
>> * httpd_can_network_connect_db
>>
>> And turning this feature off by default. This is going into tonights
>> reference policy and into FC4 test release.
>> If we had these turned off we would have prevented the last apache
>> worm virus.
I'd really appreciate if more effort was expanded in fixing existing
AVCs rather than adding new blocking rules.
The current ruleset is already strong enough a lot of people just turn
off selinux, perfect security isn't much use if no one enables it.
I'd rather aim for imperfect security some users actually use.
--
Nicolas Mailhot
was at fault. A new version of OCaml was
uploaded yesterday which has a work-around for this bug and appears to
produce working binaries on alpha.
The reason felix is segfaulting in the tests is because the binary used
to compile the test was produced with the misbehaving OCaml (and new
binutils). Thus, the resolution of this bug depended on having a fixed
OCaml package (I previously said binutils as that was what was suspected
at the time). Now that new packages have been uploaded, the Debian
OCaml team is putting together a list of packages built on alpha during
that time so they can be bin-NMU'd. felix is obviously one of these.
Hope this clears things up,
- -Mike
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (GNU/Linux)
iD8DBQFDmwRZ7ZPKKRJLJvMRAmw2AJ9eHb2movh8/C6M3i0IAVss0D/ltQCgn1Vs
NciZljAtwMG1nv7vzYfANyw=
=IhMW
-----END PGP SIGNATURE-----
|
| |
