Re: setting that ports httpd can connect to

--===============3100422608490823115==
Content-Type: multipart/alternative; boundary="000000000000507fbe060a04f673"

--000000000000507fbe060a04f673
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Mon, Nov 6, 2023 at 5:47=E2=80=AFAM Orion Poplawski <[email protected]> wro=
te:

> On 11/5/23 18:46, Orion Poplawski wrote:
> > Would there be any objections to moving the cobbler SELinux policy into
> > the Fedora cobbler package as has been done with other packages?
>
> As a follow up:
>
> cobbler is shifting to use a gunicorn started service to provide the
> XML-RPC interface that was previously done with a mod_wsgi interface.
> So we are going from:
>
> WSGIScriptAliasMatch ^/cblr/svc/([^/]*) @@webroot@
> @/cobbler/svc/services.py
> ProxyPass /cobbler_api http://127.0.0.1:25151/
>
> with port 25151 being defined as the "cobbler" port which the sebool
> httpd_can_network_connect_cobbler enables httpd to connect to.
>
> To:
>
> ProxyPass /cblr/svc/ http://localhost:8000/
> ProxyPass /cobbler_api http://127.0.0.1:25151/
>
> so now two ports to serve cobbler.
>
> What the current thinking on tuning what httpd can connect to?
>
Hi Orion,

The 8080 port is assigned the http_cache_port_t type. These booleans are
available for httpd:


# sesearch -A -s httpd_t -t http_cache_port_t -c tcp_socket -p name_connect
allow httpd_t http_cache_port_t:tcp_socket name_connect; [
httpd_can_network_relay ]:True
allow httpd_t port_type:tcp_socket name_connect; [
httpd_can_network_connect ]:True

Does that answer your question?


> Thanks.
>
> --
> Orion Poplawski
> he/him/his  - surely the least important thing about me
> IT Systems Manager                         720-772-5637
> NWRA, Boulder/CoRA Office             FAX: 303-415-9702
> 3380 Mitchell Lane                       [email protected]
> Boulder, CO 80301                 https://www.nwra.com/
>
> _______________________________________________
> selinux mailing list -- [email protected]
> To unsubscribe send an email to [email protected]
> Fedora Code of Conduct:
> https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
> https://lists.fedoraproject.org/archives/list/[email protected]=
.org
> Do not reply to spam, report it:
> https://pagure.io/fedora-infrastructure/new_issue
>


--=20

Zdenek Pytela
Security SELinux team

--000000000000507fbe060a04f673
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr"><br></div><br><div class=3D"gmail_quote">=
<div dir=3D"ltr" class=3D"gmail_attr">On Mon, Nov 6, 2023 at 5:47=E2=80=AFA=
M Orion Poplawski &lt;<a href=3D"mailto:[email protected]">[email protected]</a>&=
gt; wrote:<br></div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0=
px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">On 11=
/5/23 18:46, Orion Poplawski wrote:<br>
&gt; Would there be any objections to moving the cobbler SELinux policy int=
o <br>
&gt; the Fedora cobbler package as has been done with other packages?<br>
<br>
As a follow up:<br>
<br>
cobbler is shifting to use a gunicorn started service to provide the <br>
XML-RPC interface that was previously done with a mod_wsgi interface. <br>
So we are going from:<br>
<br>
WSGIScriptAliasMatch ^/cblr/svc/([^/]*) @@webroot@@/cobbler/svc/services.py=
<br>
ProxyPass /cobbler_api <a href=3D"http://127.0.0.1:25151/" rel=3D"noreferre=
r" target=3D"_blank">http://127.0.0.1:25151/</a><br>
<br>
with port 25151 being defined as the &quot;cobbler&quot; port which the seb=
ool <br>
httpd_can_network_connect_cobbler enables httpd to connect to.<br>
<br>
To:<br>
<br>
ProxyPass /cblr/svc/ <a href=3D"http://localhost:8000/" rel=3D"noreferrer" =
target=3D"_blank">http://localhost:8000/</a><br>
ProxyPass /cobbler_api <a href=3D"http://127.0.0.1:25151/" rel=3D"noreferre=
r" target=3D"_blank">http://127.0.0.1:25151/</a><br>
<br>
so now two ports to serve cobbler.<br>
<br>
What the current thinking on tuning what httpd can connect to?<br></blockqu=
ote><div>Hi Orion,</div><div><br></div><div><span style=3D"font-family:aria=
l,sans-serif">The 8080 port is assigned the <span style=3D"color:rgb(0,0,0)=
;background-color:rgb(255,255,255)">http_cache_port_t</span> type. These bo=
oleans are available for httpd:<br></span></div><div><span style=3D"font-fa=
mily:arial,sans-serif"><br></span></div><div><span style=3D"color:rgb(0,0,0=
);background-color:rgb(255,255,255);font-family:arial,sans-serif">
</span><span style=3D"font-family:monospace"><br># sesearch -A -s httpd_t -=
t http_cache_port_t -c tcp_socket -p name_connect
<br>allow httpd_t http_cache_port_t:tcp_socket name_connect; [ httpd_can_ne=
twork_relay ]:True
<br>allow httpd_t port_type:tcp_socket name_connect; [ httpd_can_network_co=
nnect ]:True<br>
</span><span style=3D"font-family:arial,sans-serif"><br></span></div><div><=
span style=3D"font-family:arial,sans-serif">Does that answer your question?=
<br></span></div><div><span style=3D"font-family:arial,sans-serif"><br></sp=
an></div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8e=
x;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<br>
Thanks.<br>
<br>
-- <br>
Orion Poplawski<br>
he/him/his=C2=A0 - surely the least important thing about me<br>
IT Systems Manager=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0720-772-5637<br>
NWRA, Boulder/CoRA Office=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0FA=
X: 303-415-9702<br>
3380 Mitchell Lane=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0 =C2=A0 =C2=A0 =C2=A0<a href=3D"mailto:[email protected]" target=3D"_bla=
nk">[email protected]</a><br>
Boulder, CO 80301=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =
=C2=A0<a href=3D"https://www.nwra.com/" rel=3D"noreferrer" target=3D"_blank=
">https://www.nwra.com/</a><br>
<br>
_______________________________________________<br>
selinux mailing list -- <a href=3D"mailto:[email protected]" =
target=3D"_blank">[email protected]</a><br>
To unsubscribe send an email to <a href=3D"mailto:[email protected]=
aproject.org" target=3D"_blank">[email protected]</a><b=
r>
Fedora Code of Conduct: <a href=3D"https://docs.fedoraproject.org/en-US/pro=
ject/code-of-conduct/" rel=3D"noreferrer" target=3D"_blank">https://docs.fe=
doraproject.org/en-US/project/code-of-conduct/</a><br>
List Guidelines: <a href=3D"https://fedoraproject.org/wiki/Mailing_list_gui=
delines" rel=3D"noreferrer" target=3D"_blank">https://fedoraproject.org/wik=
i/Mailing_list_guidelines</a><br>
List Archives: <a href=3D"https://lists.fedoraproject.org/archives/list/sel=
[email protected]" rel=3D"noreferrer" target=3D"_blank">https://=
lists.fedoraproject.org/archives/list/[email protected]</a><b=
r>
Do not reply to spam, report it: <a href=3D"https://pagure.io/fedora-infras=
tructure/new_issue" rel=3D"noreferrer" target=3D"_blank">https://pagure.io/=
fedora-infrastructure/new_issue</a><br>
</blockquote></div><br clear=3D"all"><br><span class=3D"gmail_signature_pre=
fix">-- </span><br><div dir=3D"ltr" class=3D"gmail_signature"><div dir=3D"l=
tr"><div><div dir=3D"ltr"><div><div dir=3D"ltr"><div><div dir=3D"ltr"><div>=
<div dir=3D"ltr"><div><div dir=3D"ltr"><div><div dir=3D"ltr"><br>
Zdenek Pytela</div><div dir=3D"ltr">Security SELinux team</div></div></div>=
</div></div></div></div></div></div></div></div></div></div></div></div>

--000000000000507fbe060a04f673--

--===============3100422608490823115==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: inline

X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18Kc2VsaW51eCBt
YWlsaW5nIGxpc3QgLS0gc2VsaW51eEBsaXN0cy5mZWRvcmFwcm9qZWN0Lm9yZwpUbyB1bnN1YnNj
cmliZSBzZW5kIGFuIGVtYWlsIHRvIHNlbGludXgtbGVhdmVAbGlzdHMuZmVkb3JhcHJvamVjdC5v
cmcKRmVkb3JhIENvZGUgb2YgQ29uZHVjdDogaHR0cHM6Ly9kb2NzLmZlZG9yYXByb2plY3Qub3Jn
L2VuLVVTL3Byb2plY3QvY29kZS1vZi1jb25kdWN0LwpMaXN0IEd1aWRlbGluZXM6IGh0dHBzOi8v
ZmVkb3JhcHJvamVjdC5vcmcvd2lraS9NYWlsaW5nX2xpc3RfZ3VpZGVsaW5lcwpMaXN0IEFyY2hp
dmVzOiBodHRwczovL2xpc3RzLmZlZG9yYXByb2plY3Qub3JnL2FyY2hpdmVzL2xpc3Qvc2VsaW51
eEBsaXN0cy5mZWRvcmFwcm9qZWN0Lm9yZwpEbyBub3QgcmVwbHkgdG8gc3BhbSwgcmVwb3J0IGl0
OiBodHRwczovL3BhZ3VyZS5pby9mZWRvcmEtaW5mcmFzdHJ1Y3R1cmUvbmV3X2lzc3VlCg==

--===============3100422608490823115==--