On 11/3/19 9:31 AM, Sam Varshavchik wrote:
Does anyone happen to know if the dhcp failover configuration that's documented
here: https://kb.isc.org/docs/aa-00502 is supported by Fedora's selinux policy.
Perusing it, failover seems to use a dedicated port(s), so selinux needs to
bless dhcp's binding to that port(s).
I couldn't figure out what is or isn't in Fedora's selinux polixy by searching
what's in the selinux-policy-targeted and selinux-policy-devel rpms; and I was
unable to find any useful selinux documentation, either in the supplied rpm or
web searches.
It would be nice to know this in advance before attempting to wreck my LAN for
an afternoon, trying to get this to work with selinux enabled.
I thought I could determine whether Fedora's selinux with respect to dhcp and
ports 647 and 7911 (the dhcpd.conf man pages makes it clear that ports 519 and
520 from the above docs are outdated) by figuring out where is the selinux
policy restricts privoxy to port 8118; but a grep of all the files in
selinux-policy-targeted or selinux-policy-devel finds nothing that appears to
specify that the privoxy_t domain is allowed to bind port 8118. The selinux-doc
RPM appears to be just robo-generated documentation that just repeats the stuff
that I found in the other RPMs.
I believe doing
sepolicy network -d privoxy_t
will supply you with the info you need.
sepolicy is provided by the policycoreutils-devel package.
FWIW, when looking for selinux guidance I find it useful to post to their
dedicated list.
--
The key to getting good answers is to ask good questions.
_______________________________________________
users mailing list -- users@lists.fedoraproject.org
To unsubscribe send an email to users-le...@lists.fedoraproject.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/users@lists.fedoraproject.org
