SELinux (in) Clusters

SELinux (in) Clusters

[Subba Rao]

I haven't decided which cluster to build yet (HPC or HA cluster). Has anyone deployed SELinux in a Cluster environment?
My main question would be would the MPI libraries in a cluster work on SELinux?

Subba Rao
sailorn@attglobal.net
2002-12-10



--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: SELinux (in) Clusters

[Russell Coker]

On Wed, 11 Dec 2002 02:01, Subba Rao wrote:
> I haven't decided which cluster to build yet (HPC or HA cluster). Has
> anyone deployed SELinux in a Cluster environment? My main question would be
> would the MPI libraries in a cluster work on SELinux?

For a typical HA cluster you just have two servers, one is running the service 
and the other is in standby mode.

For this the SE Linux policy would be quite simple, you just need to write 
policy for the HA program that allows it to do whatever network/serial 
operations are necessary for the "heartbeat" and then have it transition to 
initrc_t whenever it executes etc_t type files (so that /etc/init.d/ scripts 
are run in the right context for daemon start and stop).

Putting SE Linux on such a cluster would only take about an hour longer than 
doing it without SE Linux if you know how to use SE Linux (and that's a 
conservative estimate - I'm sure I could do the SE part in much less than an 
hour).

If you have an application that's cluster aware and does it's own network 
communication then it's even easier, it may not be necessary to do anything 
special at all.


Mosix however is a totally different issue.  Mosix and similar process 
migration technologies would require matching (if not identical) policies on 
all machines, mechanisms for migrating security context when migrating 
context, and some modifications to allow permission checking on files that 
were opened before process migration.

Pete and Steve, any comments on what it would take to get SE OpenMosix going?

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.