blob: e01ca89124b68871f17ab13b7d51cb71f6d7e808 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
|
module ipa_httpd 1.2;
require {
type httpd_t;
type initrc_t;
type var_run_t;
type krb5kdc_t;
type cert_t;
class sock_file write;
class unix_stream_socket connectto;
class file write;
}
# Let Apache and the KDC talk to DS over ldapi
allow httpd_t var_run_t:sock_file write;
allow httpd_t initrc_t:unix_stream_socket connectto;
allow krb5kdc_t var_run_t:sock_file write;
allow krb5kdc_t initrc_t:unix_stream_socket connectto;
# Let Apache access the NSS certificate database so it can issue certs
# See ipa_httpd.fe for the list of files that are granted write access
allow httpd_t cert_t:file write;
|