From: Russell Coker <russell@coker.com.au>
To: "Subba Rao" <sailorn@attglobal.net>, selinux <selinux@tycho.nsa.gov>
Subject: Re: SELinux (in) Clusters
Date: Wed, 11 Dec 2002 10:18:30 +0100 [thread overview]
Message-ID: <200212111018.30892.russell@coker.com.au> (raw)
In-Reply-To: <200212110059.AAA14517@jazzswing.ncsc.mil>
On Wed, 11 Dec 2002 02:01, Subba Rao wrote:
> I haven't decided which cluster to build yet (HPC or HA cluster). Has
> anyone deployed SELinux in a Cluster environment? My main question would be
> would the MPI libraries in a cluster work on SELinux?
For a typical HA cluster you just have two servers, one is running the service
and the other is in standby mode.
For this the SE Linux policy would be quite simple, you just need to write
policy for the HA program that allows it to do whatever network/serial
operations are necessary for the "heartbeat" and then have it transition to
initrc_t whenever it executes etc_t type files (so that /etc/init.d/ scripts
are run in the right context for daemon start and stop).
Putting SE Linux on such a cluster would only take about an hour longer than
doing it without SE Linux if you know how to use SE Linux (and that's a
conservative estimate - I'm sure I could do the SE part in much less than an
hour).
If you have an application that's cluster aware and does it's own network
communication then it's even easier, it may not be necessary to do anything
special at all.
Mosix however is a totally different issue. Mosix and similar process
migration technologies would require matching (if not identical) policies on
all machines, mechanisms for migrating security context when migrating
context, and some modifications to allow permission checking on files that
were opened before process migration.
Pete and Steve, any comments on what it would take to get SE OpenMosix going?
--
http://www.coker.com.au/selinux/ My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/ Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/ Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/ My home page
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
prev parent reply other threads:[~2002-12-11 9:18 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2002-12-11 1:01 SELinux (in) Clusters Subba Rao
2002-12-11 9:18 ` Russell Coker [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=200212111018.30892.russell@coker.com.au \
--to=russell@coker.com.au \
--cc=sailorn@attglobal.net \
--cc=selinux@tycho.nsa.gov \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.