2 ms·
Why aren't you testing things with SELinux before you deploy them to production? Also, if you constantly need to alter your policy it sounds more like your appl
by snuxoll 10y ago
Why aren't you testing things with SELinux before you deploy them to production? Also, if you constantly need to alter your policy it sounds more like your application is poorly-behaved, not that SELinux is your problem.
audit2allow is a great tool for simplifying the development of SELinux policies, but it doesn't remove some hand-crafted modifications to policies, especially in regards to file contexts (fcontext).
- justanotherbody 10y agoKeep in mind there are a LOT of apps deployed on systems with SELinux with few, if any, tests Further, the divide between ops and developers in many cases leaves this as an unsolvable problem - it's not the dev's job to do sysadmin, and ops lacks the expertise (or time) to comprehensively analyze the code base You're right that this makes the app poorly behaved, but if that can't be addressed then... permissive mode it is
- snuxoll 10y agoEveryone keeps telling sysadmins they need to be able to write code, how about developers start learning more about how their applications are deployed. I wear both hats, and then some more on top of that - if someone on my team is doing something that will make deployment and security difficult I make sure to nip it in the bud during testing.