From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from jazzband.ncsc.mil (jazzband.ncsc.mil [144.51.5.4]) by tycho.ncsc.mil (8.9.3/8.9.3) with ESMTP id RAA00493 for ; Thu, 18 Jul 2002 17:02:53 -0400 (EDT) Received: from jazzband.ncsc.mil (localhost [127.0.0.1]) by jazzband.ncsc.mil with ESMTP id VAA24626 for ; Thu, 18 Jul 2002 21:01:22 GMT Received: from albatross.prod.itd.earthlink.net (albatross.mail.pas.earthlink.net [207.217.120.120]) by jazzband.ncsc.mil with ESMTP id VAA24616 for ; Thu, 18 Jul 2002 21:01:21 GMT Received: from crtntx1-ar7-4-35-055-079.crtntx1.elnk.dsl.genuity.net ([4.35.55.79] helo=donkey) by albatross.prod.itd.earthlink.net with esmtp (Exim 3.33 #1) id 17VIQA-0001Tk-00 for selinux@tycho.nsa.gov; Thu, 18 Jul 2002 14:02:46 -0700 From: "Ryan Bergauer" To: Subject: tripwire Date: Thu, 18 Jul 2002 16:02:46 -0500 Message-ID: <000501c22e9e$7807c200$0300a8c0@donkey> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0006_01C22E74.8F31BA00" Sender: owner-selinux@tycho.nsa.gov List-Id: selinux@tycho.nsa.gov This is a multi-part message in MIME format. ------=_NextPart_000_0006_01C22E74.8F31BA00 Content-Type: text/plain; charset="US-ASCII" Content-Transfer-Encoding: 7bit I just installed Tripwire on my SELinux play box. I have no problem doing an integrity check when I'm logged in as root and newroled into sysadm_r. However, the default system cron job for integrity checking fails miserably because system_crond_t isn't granted the permissions necessary to check and sign most files on my system (and with good reason.) My first thought was to create a domain just for Tripwire, but unfortunately, the fact that Tripwire needs access to just about every file type on the disk results in a domain that not only would take quite some time to create, but would also require a fair degree of maintenance. Creating a cron job run by a user also appears out of the question, since my sysadm has no root access, and root runs user_crond_t cron jobs by default (which I feel would be wise to keep that way.) Either I'm overlooking something (very likely) or I'm going to have to suck it up and write that Tripwire domain. Any suggestions? If the Tripwire domain is the answer, are there any good ways to give it a large number of privileges very quickly? Thanks in advance - you guys are a huge help! I appreciate you bearing with those of us still getting used to this. -Ryan ------=_NextPart_000_0006_01C22E74.8F31BA00 Content-Type: text/html; charset="US-ASCII" Content-Transfer-Encoding: quoted-printable

I just installed Tripwire on my SELinux play box. I have no problem doing an integrity check when I’m = logged in as root and newroled into sysadm_r. However, the default system cron job for = integrity checking fails miserably because system_crond_t isn’t granted the permissions necessary to check and sign most files on my = system (and with good reason.) My first thought was to create a domain just for Tripwire, but unfortunately, the fact that Tripwire needs access to just = about every file type on the disk results in a domain that not only would take = quite some time to create, but would also require a fair degree of = maintenance. Creating a cron job run by a user also appears out of = the question, since my sysadm has no root = access, and root runs user_crond_t cron jobs by default (which I feel would be wise to keep that = way.)

Either I’m overlooking something (very likely) = or I’m going to have to suck it up and write that Tripwire domain. Any suggestions? If the Tripwire domain is the answer, are there any = good ways to give it a large number of privileges very = quickly?

Thanks in advance – you guys are a huge help! I appreciate you bearing with those of us still getting used to = this…

-Ryan

------=_NextPart_000_0006_01C22E74.8F31BA00-- -- You have received this message because you are subscribed to the selinux list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message.