Hey everyone, So I've been doing a lot of SELinux/audit related work behind the scenes within our infrastructure for a while now, working closely with Dan Walsh and Steve Grubb. It's taken a lot of patience and hard work, but we're finally at the point where we can start switching large portions of our infrastructure over to SELinux Enforcing mode. The following server groups are now fully enforcing: o gateway o people o planet o fas o collab o releng o db o torrent o dns These are all groups of machines that have not had any SELinux denials in at least a month. If you notice any issues with regard to these groups, please speak up. I will be keeping a close eye on these machines, and I encourage anyone that is interested to do the same. I threw together a little tool that I've been using to monitor & manage SELinux on our machines. It uses func, and allows you to do the following: Get the SELinux status: selinux-overlord.py --status Display all enforced denials: selinux-overlord.py --enforced-denials Dump all raw AVCs to disk. Each minion will have it's own file: selinux-overlord.py --dump-avcs Upgrade the SELinux policy RPMs: selinux-overlord.py --upgrade-policy It defaults to querying all minions, but you can specify groups of them if you wish: selinux-overlord.py --status app* db* This script should ideally be it's own func module, but in the mean time I added it to the fedora-infrastructure git repository: http://git.fedorahosted.org/git/?p=fedora-infrastructure.git;a=blob_plain;f=scripts/selinux/selinux-overlord.py;hb=HEAD More information on our SELinux deployment can be found in our [out of date] SOP: http://fedoraproject.org/wiki/Infrastructure/SOP/SELinux luke
Attachment:
pgpal5ZOtSZ4m.pgp
Description: PGP signature
_______________________________________________ Fedora-infrastructure-list mailing list Fedora-infrastructure-list@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/fedora-infrastructure-list