On Wed, 20 Oct 2004 23:12:25 +0800, Paolo Alexis Falcone <[EMAIL PROTECTED]> wrote: > On Wed, 20 Oct 2004 15:49:56 +0300, str tux <[EMAIL PROTECTED]> wrote: > > Any comment/experience about this? > > Hard to administrate. > > Good-quality rulesets are hard to find, as you create them for your > own personal case. It's easy to lock yourself out of your own machine > with Type Enforcement enabled. > > Imho, this will be good for banks (which require explicit security > policies orthogonal to administration policies) if you would get it > right. >
We're currently running an FC3-test box at the office with SELinux on permissive mode (i.e., SELinux policies aren't enforced, but anything going against the policy is audited and logged). If you want or do need to deploy an SELinux environment, I suggest you run it in permissive mode for a month or two (with all the apps running, etc), and gather up the audit logs. The audit log entries are pretty opaque, so you'll have to do a lot of googling and document consultation though; however, if by any luck (or because the policy fits your system), you don't encounter any audited policy failures, you can go ahead and switch over to enforcing mode. In my case, I still have to figure out how to craft a custom policy for the FC3-test box, as several apps are triggering policy violations (Apache, in particular, since I'm using mod_auth_pam + pam_winbind to do some funky authorization against our ADS, and I don't think mod_auth_pam is a good SELinux citizen). As always, YMMV when going off the beaten path of prepared scripts and configurations, especially when it comes to pre-written SELinux policy files. As Paolo said, be careful-- you just might lock yourself out of the box (worse than shooting yourself in the foot). (If you do get locked out, you'll have to bear the agony of booting init=1 with enforcing off, and worrying about getting your filesystem relabeled) **** DISCLAIMER: I am most definitely NOT an SELinux guru. Just a masochist, thank you very much. ;) **** -- JM Ibanez - A million monkeys can't go wrong... http://www.livejournal.com/~jmibanez/ http://www.mycgiserver.com/~butiki/ -- Philippine Linux Users' Group (PLUG) Mailing List [EMAIL PROTECTED] (#PLUG @ irc.free.net.ph) Official Website: http://plug.linux.org.ph Searchable Archives: http://marc.free.net.ph . To leave, go to http://lists.q-linux.com/mailman/listinfo/plug . Are you a Linux newbie? To join the newbie list, go to http://lists.q-linux.com/mailman/listinfo/ph-linux-newbie
