On 03/28/2013 07:15 AM, David Quigley wrote:
> I don't know what the project stance on SELinux enablement is for the
> agent but if you guys would be willing to work with me on getting an
> environment setup or providing access to an environment with several
> RHEL and Fedora machines I can help write some SELinux policies. For you
> AppArmor guys though you're on your own ;)
Hi Dave,
I'd love to see that happen. I can provide you access to a CentOS image
- and could do the same for Fedora - but it might be better for you to
have your own. I have notes on how I set mine up, and Jamie has made
packages out of everything (which would no doubt be better).
I confess that this was not high on my personal priority list (we have a
_lot_ to do in the short and mid-term), but the security of this system
- both Nanoprobes and CMA and for that matter Neo4j are all serious
concerns - both from an absolutely dead-serious perspective, and also
the perspective of acceptance of such a widely deployed piece of
software (or so we hope).
Nanoprobes - they run _everywhere_ -- there are just so many
opportunities for them to be compromised - and some of their work
/has/ to run as root.
CMA and Neo4j - contains critical infrastructure data that an
attacker would just _love_ to have to figure out where and how to target the
rest of the infrastructure.
And there's generally a lot of security work that needs to be done to
ensure that as little as possible is done as root.
For example: The CMA only runs as root so it can create a
pid file. But creating a project user id (or using neo4j) and chowning
the directory for pid files are all things I just
haven't gotten around to.
For something that's this much work, it'll likely have to go into the
next (i.e., second) release.
If you would kindly sign and return the contributor agreement as
explained below, that would be awesome!
http://linux-ha.org/source-doc/assimilation/html/_contributing.html#SigningContributorAgreement
Thanks Dave!
--
Alan Robertson <[email protected]> - @OSSAlanR
"Openness is the foundation and preservative of friendship... Let me claim
from you at all times your undisguised opinions." - William Wilberforce
_______________________________________________
Assimilation mailing list - Discovery-Driven Monitoring
[email protected]
http://lists.community.tummy.com/cgi-bin/mailman/listinfo/assimilation
http://assimmon.org/
