|Main Archive Page > Month Archives > fedora-selinux archives|
> It means myapp_t can only tcp sendrecv on netif_lo_t.
> And it can connect to mysqld tcp ports.
> It can only connect to mysqld tcp ports using the lo interface because
> thats the only interface it can tcp sendrecv.
Yeah, but as part of the same policy I also need to bind to and
send/receive tcp packets on the tun0 interface (as I posted before - I
need 2 active interfaces)! Where does that go if I have to use the bind
Not to mention, that if I need to, say, connect and send/receive packets
on the https port on tun0 as part of the same policy - and therefore
need to add another 'corenet_tcp_connect_https_port' statement - where
would this go and which interface would be 'enabled' this on?
Your example above is fine if I only need one interface to connect to
and send/receive packets. That is not the case here!
>> What do you mean? I thought this is a part of the policy as statements
>> from this file are used by a lot of policy modules, or are you saying
>> this transforms to something else?
> I mean the corenetwork module works a bit different than the common
> modules. In that it uses a template to generate interfaces for declared
> port types automatically. Thats where it uses the file you were looking
> at for. Its not an normal interface file and it should not be used
> manually. Theres a script in refpolicy that does it for you.
> All you need to do is declare network object types and build the policy,
> then the script will generate the interfaces for you, unlike it does
> with most other modules.
Is there a way I could see the 'expanded' version of this as this would
be the key for me to use these statements in my policy file - just in
case I run out of alternatives?
-- selinux mailing list firstname.lastname@example.org https://admin.fedoraproject.org/mailman/listinfo/selinux