Re: SELinux ddclient and ca-certificates

Robert Sharp <selinux-/[email protected]> Mon, 19 Jun 2017 22:20:06 +0100
Newsgroups	gmane.linux.gentoo.hardened
Message-ID	<[email protected]>
This is a multi-part message in MIME format.
--------------00F6C912AEB4CD34091A0E7F
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit

On 18/06/17 17:29, Sven Vermeulen wrote:
> It's okay to use it. Manipulating the directory seems to be something I
> would want to verify with the application itself first. If it is a Perl
> script, then it might be easy to find out why.

Looking at the error messages and the script itself the problem occurs 
within the Perl module IO::Socket::SSL. Looks like if a call to new does 
not work then ddclient raises the message. A quick search led me to 
http://search.cpan.org/~sullr/IO-Socket-SSL-2.049/lib/IO/Socket/SSL.pod 
<http://search.cpan.org/%7Esullr/IO-Socket-SSL-2.049/lib/IO/Socket/SSL.pod> 
and a little way down there is a good description of "Essential 
Information About SSL/TLS". Seems to me that the module is acting as 
expected and I cannot see that ddclient is doing anything else that 
might be suspect.

So I will add the privilege and try to force ddclient to update to see 
what happens.

Best,
Robert


--------------00F6C912AEB4CD34091A0E7F
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: 7bit

<html>
  <head>
    <meta content="text/html; charset=utf-8" http-equiv="Content-Type">
  </head>
  <body bgcolor="#FFFFFF" text="#000000">
    <div class="moz-cite-prefix">On 18/06/17 17:29, Sven Vermeulen
      wrote:<br>
    </div>
    <blockquote cite="mid:[email protected]" type="cite">
      <pre wrap="">It's okay to use it. Manipulating the directory seems to be something I
would want to verify with the application itself first. If it is a Perl
script, then it might be easy to find out why.</pre>
    </blockquote>
    <p><font face="Arial">Looking at the error messages and the script
        itself the problem occurs within the Perl module IO::Socket::SSL.
        Looks like if a call to new does not work then ddclient raises
        the message. A quick search led me to <a
href="http://search.cpan.org/%7Esullr/IO-Socket-SSL-2.049/lib/IO/Socket/SSL.pod">http://search.cpan.org/~sullr/IO-Socket-SSL-2.049/lib/IO/Socket/SSL.pod</a>
        and a little way down there is a good description of "Essential
        Information About SSL/TLS". Seems to me that the module is
        acting as expected and I cannot see that ddclient is doing
        anything else that might be suspect. <br>
      </font></p>
    <p><font face="Arial">So I will add the privilege and try to force
        ddclient to update to see what happens.</font></p>
    <p><font face="Arial">Best,<br>
        Robert</font><br>
    </p>
  </body>
</html>

--------------00F6C912AEB4CD34091A0E7F--