remove unconfined user

[Divya Vyas <dvyas@xxxxxxxxxx>]

Hi,

I am running a minimum policy  with unconfined policy

id -Z
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

This leads to my http process running to unconfined type

ps -efZ | grep http
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 root 2357 1  0 08:38 ? 00:00:00 /usr/sbin/httpd -k start
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 daemon 2358 2357  0 08:38 ? 00:00:00 /usr/sbin/httpd -k start
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 daemon 2359 2357  0 08:38 ? 00:00:00 /usr/sbin/httpd -k start
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 daemon 2360 2357  0 08:38 ? 00:00:00 /usr/sbin/httpd -k start
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 daemon 2361 2357  0 08:38 ? 00:00:00 /usr/sbin/httpd -k start
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 root 2458 2138  0 08:43 pts/0 00:00:00 grep http

I want my http process to run in confined user type so that apache.pp can be functional . I think it should run in httpd_exec_t type ? Am I correct.

I want to add some rules in apache policy.

Thanks,

Divya

_______________________________________________
Selinux mailing list
Selinux@xxxxxxxxxxxxx
To unsubscribe, send email to Selinux-leave@xxxxxxxxxxxxx.
To get help, send an email containing "help" to Selinux-request@xxxxxxxxxxxxx.