tripwire

["Ryan Bergauer" <privateryan@mindspring.com>]

[-- Attachment #1: Type: text/plain, Size: 1206 bytes --]

I just installed Tripwire on my SELinux play box. I have no problem
doing an integrity check when I'm logged in as root and newroled into
sysadm_r. However, the default system cron job for integrity checking
fails miserably because system_crond_t isn't granted the permissions
necessary to check and sign most files on my system (and with good
reason.) My first thought was to create a domain just for Tripwire, but
unfortunately, the fact that Tripwire needs access to just about every
file type on the disk results in a domain that not only would take quite
some time to create, but would also require a fair degree of
maintenance. Creating a cron job run by a user also appears out of the
question, since my sysadm has no root access, and root runs user_crond_t
cron jobs by default (which I feel would be wise to keep that way.)
 
Either I'm overlooking something (very likely) or I'm going to have to
suck it up and write that Tripwire domain. Any suggestions? If the
Tripwire domain is the answer, are there any good ways to give it a
large number of privileges very quickly?
 
Thanks in advance - you guys are a huge help! I appreciate you bearing
with those of us still getting used to this.
-Ryan

[-- Attachment #2: Type: text/html, Size: 4773 bytes --]