Konstantin Ryabitsev <[email protected]> wrote: > On Wed, May 30, 2018 at 03:15:24AM +0000, Eric Wong wrote: > > > - public-inbox-httpd and public-inbox-nntpd are running via systemd > > > on sane ports (119 and 80/8080) > > > - /var/lib/public-inbox is the location for mainrepos > > > - /var/run/public-inbox is the location for PERL_INLINE_DIRECTORY > > > - /var/log/public-inbox is the location for logs > > > - mail delivery is done via postfix-pipe (if you're using > > > public-inbox-watch, you shouldn't need to worry about this) > > > > So nothing is needed for public-inbox-watch at all? > > I'd considered writing something for it, but decided to limit myself to > what I can actually cover via personal experience. In addition, my > assumption is that people who are most likely to be running > public-inbox-watch are not going to be running it as a system-level > daemon (since in that case they are more likely to set up > public-inbox-mda), but as a regular user inside screen -- and therefore > wouldn't benefit from SELinux anyway.
Ah, ok. I was wondering why you thought that, and then I realized I forgot to include a public-inbox-watch.service example for systemd. Anyways I run -watch via systemd, but screen works, too. Will add an example -watch.service file in a separate patch. > > Is it possible to use "\" or similar to wrap long lines? > > > > (same comments applies to the .te file; I need to use a gigantic font) > > I know what you mean, but I'm trying to stick with the upstream policy > style, which doesn't use such approach (e.g. see > https://github.com/TresysTechnology/refpolicy/tree/master/policy/modules/system). > Theoretically, m4 supports doing that, but if the ultimate goal is to > include it into the upstream policy, then I feel we should stick to the > formatting style used there. Fair enough. There was a comment or two in the .te file which should've been wrapped, at least. > > > +# Run on http/httpcache and innd ports > > > > innd? > > Innd is the nntp daemon, and the 119/tcp port is labeled as innd_port_t, > so just sticking with that nomenclature here. Odd that they assume innd is the only 119 user, but they use "http" instead of "apache" for 80. Oh well, I suppose there could be a comment clarifying we mean NNTP to not confuse people into thinking we depend on innd. > I'll send a second patch iteration in the near future, as I've missed a > thing or two in the current one. Sure thing, thanks. -- unsubscribe: [email protected] archive: https://public-inbox.org/meta/
