Re: Per Domain Permissive Mode

[Joshua Brindle <method@manicmethod.com>]

Daniel J Walsh wrote:
> Steven mentioned in another conversion the idea of a Per Domain 
> Permissive Mode.  This is something our customers are looking for.
> A few customers want to write policy to confine an application but 
> they are afraid of releasing it in enforcingmode to hundreds/thousands 
> of machines, and then finding out they missed a crucial code path.  
> The would like to be able to write the policy distribute it and gather 
> AVC messages in for a couple of months, until they fail confident that 
> the policy will work.  Currently they would have to turn all the 
> machines to permissive mode or take there chances. 
> Having a simple domain that would run in permissive mode while the 
> rest of the machine ran enforcing would satisfy this need.
>
> Thoughts...

I don't think this should be done at the mechanism level. One can create 
a policy that allows everything and also audits it, and turns that into 
policy. This sounds like something SLIDE would be pretty good at (it 
already has a remote agent that monitors logs and pushes policy to 
remote machines).


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.