edc4caa833
We've been using the httpd_can_network_connect boolean for years to allow httpd to connect to the openQA server processes. This is an unnecessarily large hammer when we only need it to be able to connect to exactly the two openQA ports. This uses a custom SELinux policy to allow connecting to those ports only, and ensures the boolean is set back to off. Signed-off-by: Adam Williamson <awilliam@redhat.com>
17 lines
449 B
Text
17 lines
449 B
Text
|
|
module httpd-openqa 1.0;
|
|
|
|
require {
|
|
type openqa_port_t;
|
|
type httpd_t;
|
|
type openqa_websockets_port_t;
|
|
class tcp_socket name_connect;
|
|
}
|
|
|
|
#============= httpd_t ==============
|
|
|
|
#!!!! This avc can be allowed using the boolean 'httpd_can_network_connect'
|
|
allow httpd_t openqa_port_t:tcp_socket name_connect;
|
|
|
|
#!!!! This avc can be allowed using the boolean 'httpd_can_network_connect'
|
|
allow httpd_t openqa_websockets_port_t:tcp_socket name_connect;
|