Okay to move cobbler SELinux policy into the cobbler package?

[Orion Poplawski]

Would there be any objections to moving the cobbler SELinux policy into 
the Fedora cobbler package as has been done with other packages?


-- 
Orion Poplawski
he/him/his  - surely the least important thing about me
IT Systems Manager                         720-772-5637
NWRA, Boulder/CoRA Office             FAX: [phone]
3380 Mitchell Lane                       orion(a)nwra.com
Boulder, CO 80301                 https://www.nwra.com/

setting that ports httpd can connect to

[Orion Poplawski]

On 11/5/23 18:46, Orion Poplawski wrote:
>  Would there be any objections to moving the cobbler SELinux policy
> into 
>  the Fedora cobbler package as has been done with other packages? 
As a follow up:

cobbler is shifting to use a gunicorn started service to provide the 
XML-RPC interface that was previously done with a mod_wsgi interface. 
So we are going from:

WSGIScriptAliasMatch ^/cblr/svc/([^/]*) @@webroot@(a)/cobbler/svc/services.py
ProxyPass /cobbler_api http://127.0.0.1:25151/

with port 25151 being defined as the "cobbler" port which the sebool 
httpd_can_network_connect_cobbler enables httpd to connect to.

To:

ProxyPass /cblr/svc/ http://localhost:8000/
ProxyPass /cobbler_api http://127.0.0.1:25151/

so now two ports to serve cobbler.

What the current thinking on tuning what httpd can connect to?

Thanks.

-- 
Orion Poplawski
he/him/his  - surely the least important thing about me
IT Systems Manager                         720-772-5637
NWRA, Boulder/CoRA Office             FAX: [phone]
3380 Mitchell Lane                       orion(a)nwra.com
Boulder, CO 80301                 https://www.nwra.com/

setting that ports httpd can connect to

[Zdenek Pytela]

On Mon, Nov 6, 2023 at 5:47 AM Orion Poplawski <orion(a)nwra.com&gt; wrote:

>  On 11/5/23 18:46, Orion Poplawski wrote:
>  > Would there be any objections to moving the cobbler SELinux policy into
>  > the Fedora cobbler package as has been done with other packages?
>
>  As a follow up:
>
>  cobbler is shifting to use a gunicorn started service to provide the
>  XML-RPC interface that was previously done with a mod_wsgi interface.
>  So we are going from:
>
>  WSGIScriptAliasMatch ^/cblr/svc/([^/]*) @@webroot@
>  @/cobbler/svc/services.py
>  ProxyPass /cobbler_api http://127.0.0.1:25151/
>
>  with port 25151 being defined as the "cobbler" port which the sebool
>  httpd_can_network_connect_cobbler enables httpd to connect to.
>
>  To:
>
>  ProxyPass /cblr/svc/ http://localhost:8000/
>  ProxyPass /cobbler_api http://127.0.0.1:25151/
>
>  so now two ports to serve cobbler.
>
>  What the current thinking on tuning what httpd can connect to?
>  
Hi Orion,

The 8080 port is assigned the http_cache_port_t type. These booleans are
available for httpd:


# sesearch -A -s httpd_t -t http_cache_port_t -c tcp_socket -p name_connect
allow httpd_t http_cache_port_t:tcp_socket name_connect; [
httpd_can_network_relay ]:True
allow httpd_t port_type:tcp_socket name_connect; [
httpd_can_network_connect ]:True

Does that answer your question?


>  Thanks.
>
>  --
>  Orion Poplawski
>  he/him/his  - surely the least important thing about me
>  IT Systems Manager                         720-772-5637
>  NWRA, Boulder/CoRA Office             FAX: [phone]
>  3380 Mitchell Lane                       orion(a)nwra.com
>  Boulder, CO 80301                 https://www.nwra.com/
>
>  _______________________________________________
>  selinux mailing list -- selinux(a)lists.fedoraproject.org
>  To unsubscribe send an email to selinux-leave(a)lists.fedoraproject.org
>  Fedora Code of Conduct:
>  https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives:
>  https://lists.fedoraproject.org/archives/list/[e-mail]...
>  Do not reply to spam, report it:
>  https://pagure.io/fedora-infrastructure/new_issue
>  

-- 

Zdenek Pytela
Security SELinux team

[Zdenek Pytela]

On Mon, Nov 6, 2023 at 2:46 AM Orion Poplawski <orion(a)nwra.com&gt; wrote:

>  Would there be any objections to moving the cobbler SELinux policy
> into
>  the Fedora cobbler package as has been done with other packages?
>  
Hi Orion,

Please follow the steps in

https://fedoraproject.org/wiki/SELinux/IndependentPolicy#The_Preamble

and go ahead. Feel free to ask any questions.


>  --
>  Orion Poplawski
>  he/him/his  - surely the least important thing about me
>  IT Systems Manager                         720-772-5637
>  NWRA, Boulder/CoRA Office             FAX: [phone]
>  3380 Mitchell Lane                       orion(a)nwra.com
>  Boulder, CO 80301                 https://www.nwra.com/
>  _______________________________________________
>  selinux mailing list -- selinux(a)lists.fedoraproject.org
>  To unsubscribe send an email to selinux-leave(a)lists.fedoraproject.org
>  Fedora Code of Conduct:
>  https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives:
>  https://lists.fedoraproject.org/archives/list/[e-mail]...
>  Do not reply to spam, report it:
>  https://pagure.io/fedora-infrastructure/new_issue
>  

-- 

Zdenek Pytela
Security SELinux team