Re: [Freeswitch-dev] [freeswitch-sec] FreeSWITCH selinux policy sponsorship
Kristian, I personally do not have any experience in this area, Maybe someone on the Dev/Users list would be interested in this topic? /b -- Brian West brian@freeswitch.org FreeSWITCH Solutions, LLC PO BOX PO BOX 2531 Brookfield, WI 53008-2531 Twitter: @FreeSWITCH_Wire , @briankwest http://www.freeswitchbook.com http://www.freeswitchcookbook.com T: +1.918.420.9001 | F: +1.918.420.9002 | M: +1.918.424.WEST iNUM: +883 5100 1420 9001 ISN: 410*543 Skype:briankwest PGP Key: http://www.bkw.org/key.txt (AB93356707C76CED) On Sep 9, 2013, at 10:10 AM, Kristian Kielhofner <kris@kriskinc.com> wrote:
Hello all,
My company would like to sponsor the development of a proper selinux policy for FreeSWITCH. How should we get this going?
-- Kristian Kielhofner
_______________________________________________ freeswitch-sec mailing list freeswitch-sec@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-sec
On 09/09/2013 05:20 PM, Brian West wrote:
Kristian, I personally do not have any experience in this area, Maybe someone on the Dev/Users list would be interested in this topic?
Failing that, perhaps you can find someone in #selinux on freenode.net. Regards, Patrick
On Mon, 9 Sep 2013, Brian West wrote:
I personally do not have any experience in this area, Maybe someone on the Dev/Users list would be interested in this topic?
On Sep 9, 2013, at 10:10 AM, Kristian Kielhofner <kris@kriskinc.com> wrote:
My company would like to sponsor the development of a proper selinux policy for FreeSWITCH. How should we get this going?
been travelling -- sorry for the delay in reply Hi, Kristian Writing SElinux rules that are durable is tied to getting repeatable packaging together (so that the binaries are predictably in the same places), and talking across the same network ports, etc. As FreeSwitch is somewhat a moving target, and not 'packaged' in a 'major' distribution's main line -- really, RHEL, CentOS or Fedora here -- a set of rules need to be crafted and maintained locally Are you using a packaging such as that from sipXecs / eZuce? If so, I can probably guide you through the ruleset generation. In which FS ML shall we do this? Cross-posting to three is probably rather rude ... fwiw, I've posted pretty sharply to the negative about pelple NOT using SELinux with FreeSwitch [1] in the past -- Russ herrold [1] http://orcorc.blogspot.com/2010/12/ripping-out-safeties.html
FreeSWITCH has had official RPMs from the Project for the stable branch for quite a while... We publish these regularly and the locations of files do not change... It anything changes in them, its the addition of a new file or the deletion of old stuff (the later rarely happens) If theres a problem with the way we are doing this, I would appreciate a direct email on this as to what the problems are or even better a jira opened so we can track such things. K On 9/19/13 1:10 PM, "R P Herrold" <herrold@owlriver.com> wrote:
On Mon, 9 Sep 2013, Brian West wrote:
I personally do not have any experience in this area, Maybe someone on the Dev/Users list would be interested in this topic?
On Sep 9, 2013, at 10:10 AM, Kristian Kielhofner <kris@kriskinc.com> wrote:
My company would like to sponsor the development of a proper selinux policy for FreeSWITCH. How should we get this going?
been travelling -- sorry for the delay in reply
Hi, Kristian
Writing SElinux rules that are durable is tied to getting repeatable packaging together (so that the binaries are predictably in the same places), and talking across the same network ports, etc. As FreeSwitch is somewhat a moving target, and not 'packaged' in a 'major' distribution's main line -- really, RHEL, CentOS or Fedora here -- a set of rules need to be crafted and maintained locally
Are you using a packaging such as that from sipXecs / eZuce? If so, I can probably guide you through the ruleset generation. In which FS ML shall we do this? Cross-posting to three is probably rather rude
... fwiw, I've posted pretty sharply to the negative about pelple NOT using SELinux with FreeSwitch [1] in the past
-- Russ herrold
[1] http://orcorc.blogspot.com/2010/12/ripping-out-safeties.html
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-dev mailing list FreeSWITCH-dev@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-dev UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-dev http://www.freeswitch.org
-- Ken http://www.FreeSWITCH.org http://www.ClueCon.com http://www.OSTAG.org irc.freenode.net #freeswitch
On Thu, 19 Sep 2013, Ken Rice wrote:
FreeSWITCH has had official RPMs from the Project for the stable branch for
If theres a problem with the way we are doing this, I would appreciate a
( chuckle ) I missed that, as my automated processes had not broken for my local builds Thanks for the update -- I will look into drilling a SELinux ruleset into it if absent -- Russ herrold
participants (4)
-
Brian West
-
Ken Rice
-
Patrick Lists
-
R P Herrold