News for hackers. Stuff that matters.

A comment on Stop Disabling SELinux: A Real-World Guide. Parent comment

Re:Stop Disabling SELinux: A Real-World Guide by snuxoll on Thursday February 02, 2017 @11:25AM (#13551713)
audit2allow is the single greatest tool I've ever used for dealing with SELinux, people need to hear it's name sung from the mountains.

I actually write SELinux policies for software I develop, first thing I do is put them in the most restrictive context imaginable with no permissions, set SELinux in permissive mode and run the application through it's paces, at the end run audit2allow and there's 90% of the work done for you outside of defining fcontext's.

[ Parent | on HN ]
Re:Stop Disabling SELinux: A Real-World Guide by blockoperation on Thursday February 02, 2017 @12:24PM (#13552317)
It must be used with care though, otherwise you'll end up with so many holes in your policy that you defeat whole point of using SELinux in the first place. Definitely don't use the output directly.
[ Parent | on HN ]
Re:Stop Disabling SELinux: A Real-World Guide by snuxoll on Thursday February 02, 2017 @12:26PM (#13552348)
Certainly not, but it's a great first step.
[ Parent | on HN ]