Am Sa, den 30.07.2005 schrieb Jurgen Kramer um 14:14:
> On Sat, 2005-07-30 at 12:57 +0100, Paul Howarth wrote:
> > On Sat, 2005-07-30 at 11:48 +0200, Jurgen Kramer wrote:
> > > After the last selinux policy update I can no longer use squid to proxy
> > > FTP transfers. dmesg shows lots of:
> > >
> > > audit(1122716171.029:8): avc: denied { name_connect } for pid=2553
> > > comm="squid" dest=21 scontext=user_u:system_r:squid_t
> > > tcontext=system_u:object_r:ftp_port_t tclass=tcp_socket
> > > audit(1122716171.129:9): avc: denied { name_connect } for pid=2553
> > > comm="squid" dest=21 scontext=user_u:system_r:squid_t
> > > tcontext=system_u:object_r:ftp_port_t tclass=tcp_socket
> > > audit(1122716171.229:10): avc: denied { name_connect } for pid=2553
> > > comm="squid" dest=21 scontext=user_u:system_r:squid_t
> > > tcontext=system_u:object_r:ftp_port_t tclass=tcp_socket
> > >
> > > HTTP transfers still function fine. How can I fix this?
> >
> > Does this help?
> >
> > # setsebool -P squid_connect_any 1
>
> Yep, that worked. Is this a workaround? Does it survive reboots?
> Jurgen
Not a workaround, but a valid SELinux setting / adjustment. "man
setsebool" would answer you the last question, telling you what
parameter "-P" is for.
Alexander
--
Alexander Dalloz | Enger, Germany | GPG http://pgp.mit.edu 0xB366A773
legal statement: http://www.uni-x.org/legal.html
Fedora Core 2 GNU/Linux on Athlon with kernel 2.6.11-1.35_FC2smp
Serendipity 15:43:23 up 14 days, 20:15, load average: 0.02, 0.08, 0.08
Attachment:
signature.asc
Description: Dies ist ein digital signierter Nachrichtenteil
