3 ms·

Thanks, all of those links are very informative. Shame that it seems like quite a lot of work still to set up for my own applications.

• snuxoll 10y ago
  audit2allow takes care of 90% of the work for you, the rest is removing extraneous permissions and defining file context's (fcontext) which is pretty simple. Really, it's as simple as this, I swear: 1. Write an empty policy for your application, defining a type for your binary (myapp_exec_t) with no permissions at all. Label your binary with this using chcon. 2. Set SELinux in permissive mode, run your application through it's paces. 3. Run audit2allow to get a decent policy to start with 4. Figure out where your application stores data on disk, if at all. Create another type (myapp_t) and label those directories with it (you shouldn't be writing outside of these directories by default, if you allow it to be changed in a config file the administrator can label new directories with semanage), then grant your application access to this type. Also make sure the installed path of your binary is labeled with your myapp_exec_t type. 5. Clean up the messy policy that audit2allow created if so desired, it's likely more permissive than necessary and not overly pretty. This will become easier as you work with SELinux policies more. 6. You're done This will be time consuming the first couple times you do it, but you'll get quicker at it over time like anything else.