
I thought I sent this but my MUA disagrees....
A user (one among many) writes:
Do we have better advice than just "disable SELinux" to offer?
I ask because "solving" the DMARC "problem" seems to involve trust of Mediators (the technical RFC term for middlemen like Mailman) by Author Domains (RFC-ese for domains with DMARC policies about verifying From:). Asking upstream to trust sites which have deliberately disabled security features seems like poor strategy at best.
Note: reply-to set to Mailman-Developers. Please follow up there. If you want to follow but not subscribe to MM-D, perhap the archives are an option: http://www.mail-archive.com/mailman-developers%40python.org/.
Steve

On 06/18/2014 09:51 AM, Stephen J. Turnbull wrote:
Do we have better advice than just "disable SELinux" to offer?
I'm not sure why the OP had a problem. I suspect it that to do with his moving lists from an older Fedora server to a newer RHEL server and something to do with security policy settings or lack thereof on the moved files.
In any case, RHEL Mailman is supposed to be SELinux compatible. See the FAQ at <http://wiki.list.org/x/KYCB>.
However, that doesn't address the larger question of how to make Mailman in general, particularly if installed from our distribution, SELinux friendly. Unfortunately, I'm not familiar with SELinux or similar security policy management configuration beyond what's in the mailman-developers thread (from almost 10 years ago now) linked from the FAQ article. Thus, I'm not the best person to address the larger question.
-- Mark Sapiro <mark@msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan

For your information, I have written a small SELinux module for Mailman3, it's included in my Fedora RPM and works fine. In the future (when MM3 is out), I'll ask for integration in the core policy.
Aurélien

On 06/18/2014 09:51 AM, Stephen J. Turnbull wrote:
Do we have better advice than just "disable SELinux" to offer?
I'm not sure why the OP had a problem. I suspect it that to do with his moving lists from an older Fedora server to a newer RHEL server and something to do with security policy settings or lack thereof on the moved files.
In any case, RHEL Mailman is supposed to be SELinux compatible. See the FAQ at <http://wiki.list.org/x/KYCB>.
However, that doesn't address the larger question of how to make Mailman in general, particularly if installed from our distribution, SELinux friendly. Unfortunately, I'm not familiar with SELinux or similar security policy management configuration beyond what's in the mailman-developers thread (from almost 10 years ago now) linked from the FAQ article. Thus, I'm not the best person to address the larger question.
-- Mark Sapiro <mark@msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan

For your information, I have written a small SELinux module for Mailman3, it's included in my Fedora RPM and works fine. In the future (when MM3 is out), I'll ask for integration in the core policy.
Aurélien
participants (3)
-
Aurelien Bompard
-
Mark Sapiro
-
Stephen J. Turnbull