Split-off EPMD-related rules #16
Conversation
| @@ -0,0 +1,12 @@ | |||
| interface(`epmd_query',` | |||
There was a problem hiding this comment.
I don't understand why this change is needed.
Signed-off-by: Peter Lemenkov <[email protected]>
ejabberd.te
Outdated
| @@ -31,12 +31,12 @@ auth_use_nsswitch(ejabberd_t) | |||
| corecmd_exec_bin(ejabberd_t) | |||
| corecmd_exec_shell(ejabberd_t) | |||
|
|
|||
| corenet_tcp_bind_epmd_port(ejabberd_t) | |||
| epmd_query(rabbitmq_t) | |||
There was a problem hiding this comment.
You have here rabbitmq_t domain, which mean that you allowing rules in this macro for rabbitmq_t instead of ejabberd_t, but I still don't understand why you create epmd_query() interface. Do you have some BZ for this?
wrabcak
force-pushed
the
rawhide
branch
2 times, most recently
from
c60cd73
to
e269450
Compare
This should be ejabberd_t not rabbitmq_t. Signed-off-by: Peter Lemenkov <[email protected]>
|
@wrabcak fixed ejabberd_t / rabbitmq_t typo. Thanks for pointing me on this. Regarding your question about EPMD rules splitting off. It's a very generic application and the corresponding workflow is very similar for many other Erlang applications which require clustering. So better to split it off and reuse in dedicated *.te files, as I did for Ejabberd and RabbitMQ. Also any *ctl scripts for these native Erlang clustering application will likely require interaction with EPMD as well (think of monitoring, logs rotation, and any other similar operations), so we'll need to add necessary rules as well. To avoid duplication we'd better to split off EPMD operations into its own generic interface (epmd_query). Some Erlang applications won't require it. For example, CouchDB doesn't need it because it doesn't use native Erlang clustering. |
|
Any update here? |
wrabcak
force-pushed
the
rawhide
branch
2 times, most recently
from
f4d327c
to
77dce4d
Compare
|
Hi, Any update on this PR & #15 ? To give some context, these PR are meant to fix https://bugzilla.redhat.com/show_bug.cgi?id=1413775, which I'm currently facing as well. I don't know much about SELinux, but what would be needed to get these approved? Regards |
Signed-off-by: Peter Lemenkov [email protected]