From: Miroslav Grepl <mgrepl@redhat.com>
To: Divya Vyas <dvyas@mvista.com>, selinux <selinux@tycho.nsa.gov>
Subject: Re: remove unconfined user
Date: Fri, 18 Sep 2015 15:33:58 +0200 [thread overview]
Message-ID: <55FC12C6.6070801@redhat.com> (raw)
In-Reply-To: <CA+=dQ-_64TQHHx5GWqByLSh=X=pWiLr4FXzEWH6w6C70c4DOxA@mail.gmail.com>
On 09/16/2015 11:00 AM, Divya Vyas wrote:
> Hi,
>
> I am running a minimum policy with unconfined policy
>
> id -Z
> unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
>
> This leads to my http process running to unconfined type
>
> ps -efZ | grep http
> unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 root 2357 1 0
> 08:38 ? 00:00:00 /usr/sbin/httpd -k start
> unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 daemon 2358 2357
> 0 08:38 ? 00:00:00 /usr/sbin/httpd -k start
> unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 daemon 2359 2357
> 0 08:38 ? 00:00:00 /usr/sbin/httpd -k start
> unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 daemon 2360 2357
> 0 08:38 ? 00:00:00 /usr/sbin/httpd -k start
> unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 daemon 2361 2357
> 0 08:38 ? 00:00:00 /usr/sbin/httpd -k start
> unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 root 2458 2138 0
> 08:43 pts/0 00:00:00 grep http
>
> I want my http process to run in confined user type so that apache.pp
> can be functional . I think it should run in httpd_exec_t type ? Am I
> correct.
>
> I want to add some rules in apache policy.
>
> Thanks,
> Divya
>
>
This is probably material for selinux@lists.fedoraproject.org. How do
you start httpd?
>
>
>
> _______________________________________________
> Selinux mailing list
> Selinux@tycho.nsa.gov
> To unsubscribe, send email to Selinux-leave@tycho.nsa.gov.
> To get help, send an email containing "help" to Selinux-request@tycho.nsa.gov.
>
--
Miroslav Grepl
Senior Software Engineer, SELinux Solutions
Red Hat, Inc.
prev parent reply other threads:[~2015-09-18 13:34 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-09-16 9:00 remove unconfined user Divya Vyas
2015-09-18 13:33 ` Miroslav Grepl [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=55FC12C6.6070801@redhat.com \
--to=mgrepl@redhat.com \
--cc=dvyas@mvista.com \
--cc=selinux@tycho.nsa.gov \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.