Bug 473391
| Summary: | [Patch] SELinux protection for unbound daemon | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Adam Tkac <atkac> | ||||||
| Component: | selinux-policy | Assignee: | Daniel Walsh <dwalsh> | ||||||
| Status: | CLOSED CURRENTRELEASE | QA Contact: | Fedora Extras Quality Assurance <extras-qa> | ||||||
| Severity: | medium | Docs Contact: | |||||||
| Priority: | medium | ||||||||
| Version: | 11 | CC: | dwalsh, jkubin, mgrepl, ovasik, pwouters | ||||||
| Target Milestone: | --- | ||||||||
| Target Release: | --- | ||||||||
| Hardware: | All | ||||||||
| OS: | Linux | ||||||||
| Whiteboard: | |||||||||
| Fixed In Version: | Doc Type: | Bug Fix | |||||||
| Doc Text: | Story Points: | --- | |||||||
| Clone Of: | Environment: | ||||||||
| Last Closed: | 2009-11-18 13:09:29 UTC | Type: | --- | ||||||
| Regression: | --- | Mount Type: | --- | ||||||
| Documentation: | --- | CRM: | |||||||
| Verified Versions: | Category: | --- | |||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||
| Embargoed: | |||||||||
| Attachments: |
|
||||||||
|
Description
Adam Tkac
2008-11-28 09:14:26 UTC
Created attachment 324951 [details]
.fc file
Created attachment 324952 [details]
.te file
Would it be better to just add it to the bind policy, since it has the same security requirements? that might change in the future anyway. I'd keep it separate. Well, it is possible but I don't think it is good. Unbound is recursive-only nameserver, it is not authoritative server as named. Unbound policy can be far more stricter than named's one. But if you think reuse of named policy makes more sence simply reuse it, I might be "security-paranoid" ;) (In reply to comment #4) > that might change in the future anyway. I'd keep it separate. Both are DNS servers so I don't expect major differences. If unbound needs less privs then bind, fine we can add a boolean to turn off privs. But adding an additional policy for basically the same security domain is a mistake. If we find they become very different in the future, we can separate the policy. But I think they are more similar then different, lastly there is probably little likelyhood that you would have bind data on the same machine as unbound, so I don't see them attacking each other. I think quite a few people will test with unbound having bind as a backup, or even using both on different IP's on the same box, while testing out things like DNSSEC. But we've tried to ensure that bind and unbound use the same files for DNSSEC keys and all. (In reply to comment #7) > I think quite a few people will test with unbound having bind as a backup, or > even using both on different IP's on the same box, while testing out things > like DNSSEC. I can imagine someone will use unbound and named on same box so one policy won't be good enough (unbound will be allowed to interfere named and opposite). That may be true, but for those users they are going to have to do some special stuff anyways to prevent the two domains from attacking each other since they both can use dns ports. Adding the following to F10 and Rawhide Policy. /etc/unbound(/.*)? gen_context(system_u:object_r:named_conf_t,s0) /etc/rc\.d/init\.d/unbound -- gen_context(system_u:object_r:named_initrc_exec_t,s0) /usr/sbin/unbound -- gen_context(system_u:object_r:named_exec_t,s0) /var/run/unbound(/.*)? gen_context(system_u:object_r:named_var_run_t,s0) Fixed in selinux-policy-3.5.13-33.fc10 This bug appears to have been reported against 'rawhide' during the Fedora 11 development cycle. Changing version to '11'. More information and reason for this action is here: http://fedoraproject.org/wiki/BugZappers/HouseKeeping |