On Sunday 28 November 2010 03:45:54 Nico Kadel-Garcia wrote:
> On Sat, Nov 27, 2010 at 9:21 PM, John R. Dennison <jrd@xxxxxxxxxxxx> wrote:
> > You run it in Permissive mode, you deal with the exceptions as
> > they arise while the software is running in its normal
> > environment and while its running normally using any of the
> > documented methods. You thoroughly test the application in such
> > a manner and once you have ironed out any and all issues by
> > putting together a custom policy, setting the right SElinux
> > booleans, etc, you then enable Enforcing mode. There is really
> > no reason that SElinux should have a negative impact on your
> > application or server if you use Permissive first.
>
> You forgot "take on becoming the SELinux integration manager for that
> project with every single update".
Every single update? Update of what?
SELinux policy updates do not modify any local policy configuration and
settings (if you have them set up in a proper way). It works just as John
explained above --- run SELinux in permissive mode in usual working
environment and see if there are any denials. To begin with, if all other apps
on your machine are ok, there shouldn't be any denials. If there are, it is
typically either a bug in the app causing the denial, or insecure configuration
settings for that app. In both cases it has nothing to do with SELinux and
should be addressed elsewhere. SELinux is actually doing you a favor by
pointing out security holes in your system. Still, if you decide that you
still want to use the buggy and insecure app/onfiguration, you can modify local
SELinux settings to allow access. You do it once, and it works. Updating
SELinux policy will not change that.
If you are talking about updating a custom app that keeps conflicting with
SELinux, then it's the problem with the app itself --- collect all denials and
report a bug upstream against that app. No program that works correctly should
ever produce any denials. If upstream don't care, you chose a bad app for your
system. Especially if it is a production system.
In either case, it doesn't require any serious maintenance time from the
sysadmin. Just one afternoon to learn how to use SELinux properly.
HTH, :-)
Marko
_______________________________________________
CentOS mailing list
CentOS@xxxxxxxxxx
http://lists.centos.org/mailman/listinfo/centos
