Re: [PATCH] Contribute SELinux policy for EL7

[Eric Wong <e@80x24.org>]

Konstantin Ryabitsev <konstantin@linuxfoundation.org> wrote:
> On Wed, May 30, 2018 at 03:15:24AM +0000, Eric Wong wrote:
> > > - public-inbox-httpd and public-inbox-nntpd are running via systemd
> > >  on sane ports (119 and 80/8080)
> > > - /var/lib/public-inbox is the location for mainrepos
> > > - /var/run/public-inbox is the location for PERL_INLINE_DIRECTORY
> > > - /var/log/public-inbox is the location for logs
> > > - mail delivery is done via postfix-pipe (if you're using
> > >  public-inbox-watch, you shouldn't need to worry about this)
> > 
> > So nothing is needed for public-inbox-watch at all?
> 
> I'd considered writing something for it, but decided to limit myself to
> what I can actually cover via personal experience. In addition, my
> assumption is that people who are most likely to be running
> public-inbox-watch are not going to be running it as a system-level
> daemon (since in that case they are more likely to set up
> public-inbox-mda), but as a regular user inside screen -- and therefore
> wouldn't benefit from SELinux anyway.

Ah, ok. I was wondering why you thought that, and then I
realized I forgot to include a public-inbox-watch.service
example for systemd.  Anyways I run -watch via systemd,
but screen works, too.  Will add an example -watch.service
file in a separate patch.

> > Is it possible to use "\" or similar to wrap long lines?
> > 
> > (same comments applies to the .te file; I need to use a gigantic font)
> 
> I know what you mean, but I'm trying to stick with the upstream policy
> style, which doesn't use such approach (e.g. see
> https://github.com/TresysTechnology/refpolicy/tree/master/policy/modules/system).
> Theoretically, m4 supports doing that, but if the ultimate goal is to
> include it into the upstream policy, then I feel we should stick to the
> formatting style used there.

Fair enough.  There was a comment or two in the .te file which
should've been wrapped, at least.

> > > +# Run on http/httpcache and innd ports
> > 
> > innd?
> 
> Innd is the nntp daemon, and the 119/tcp port is labeled as innd_port_t,
> so just sticking with that nomenclature here.

Odd that they assume innd is the only 119 user, but they use
"http" instead of "apache" for 80.  Oh well, I suppose there
could be a comment clarifying we mean NNTP to not confuse people
into thinking we depend on innd.

> I'll send a second patch iteration in the near future, as I've missed a
> thing or two in the current one.

Sure thing, thanks.