News for hackers. Stuff that matters.
Re:Docker 0-Day Stopped Cold by SELinux by snuxoll on Saturday January 14, 2017 @04:01PM (#13400533)
A packager is generally responsible for selinux policies if they aren't suitable for inclusion in the core policy, as a developer if you want to write them please do but certain aspects rely on things like where binaries and application data are stored so you can't always write a policy that won't need tweaking on a specific distribution.

SELinux policies take some time to write the first time or two, but typically running in permissive mode and running your app with a permissionless context will give you everything you need to include in one.

Admins have the hard job when they move default data directories around, takes time to get used to running 'semanage fcontext' in addition to setting file system permissions.

There are no comments on this comment yet.