Bill McCarty wrote:
Hi all,
I've run into an architectural headache that someone else must already have visited, and perhaps solved. But, I find no mention of the problem in list archives or elsewhere.
I have several Python scripts that run under Cron. Some of these scripts access or modify sensitive data, and so I'd like to define one or more domains by means of which to limit their privileges. However, the exe name associated with such scripts is /usr/bin/python2.3, rather than the name of the script. Consistent with the principle of least privilege, I'd prefer to define distinct domains for each script, rather than an overly broad python_t domain, for instance.
Has anyone else been here already? What techniques are useful for constraining the privileges given to scripts?
Instead of running python script
Change script to start with #! /usr/bin/python
And you can set context on the script
One idea: Would it be a good thing to modify Run-parts to transition to a domain named for the Cron script it launches? Doing so would seem to solve my problem, but it might create others <g>.
Thanks,
