remove unconfined user

remove unconfined user

[Divya Vyas]

[-- Attachment #1: Type: text/plain, Size: 1086 bytes --]

Hi,

I am running a minimum policy  with unconfined policy

id -Z
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

This leads to my http process running to unconfined type

ps -efZ | grep http
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 root 2357 1  0 08:38
? 00:00:00 /usr/sbin/httpd -k start
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 daemon 2358 2357  0
08:38 ? 00:00:00 /usr/sbin/httpd -k start
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 daemon 2359 2357  0
08:38 ? 00:00:00 /usr/sbin/httpd -k start
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 daemon 2360 2357  0
08:38 ? 00:00:00 /usr/sbin/httpd -k start
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 daemon 2361 2357  0
08:38 ? 00:00:00 /usr/sbin/httpd -k start
unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 root 2458 2138  0
08:43 pts/0 00:00:00 grep http

I want my http process to run in confined user type so that apache.pp can
be functional . I think it should run in httpd_exec_t type ? Am I correct.

I want to add some rules in apache policy.

Thanks,
Divya

[-- Attachment #2: Type: text/html, Size: 1286 bytes --]

Re: remove unconfined user

[Miroslav Grepl]

On 09/16/2015 11:00 AM, Divya Vyas wrote:
> Hi,
> 
> I am running a minimum policy  with unconfined policy
> 
> id -Z
> unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
> 
> This leads to my http process running to unconfined type
> 
> ps -efZ | grep http
> unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 root 2357 1  0
> 08:38 ? 00:00:00 /usr/sbin/httpd -k start
> unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 daemon 2358 2357 
> 0 08:38 ? 00:00:00 /usr/sbin/httpd -k start
> unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 daemon 2359 2357 
> 0 08:38 ? 00:00:00 /usr/sbin/httpd -k start
> unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 daemon 2360 2357 
> 0 08:38 ? 00:00:00 /usr/sbin/httpd -k start
> unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 daemon 2361 2357 
> 0 08:38 ? 00:00:00 /usr/sbin/httpd -k start
> unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 root 2458 2138  0
> 08:43 pts/0 00:00:00 grep http
> 
> I want my http process to run in confined user type so that apache.pp
> can be functional . I think it should run in httpd_exec_t type ? Am I
> correct.
> 
> I want to add some rules in apache policy.
> 
> Thanks,
> Divya
> 
> 

This is probably material for selinux@lists.fedoraproject.org. How do
you start httpd?

> 
> 
> 
> _______________________________________________
> Selinux mailing list
> Selinux@tycho.nsa.gov
> To unsubscribe, send email to Selinux-leave@tycho.nsa.gov.
> To get help, send an email containing "help" to Selinux-request@tycho.nsa.gov.
> 


-- 
Miroslav Grepl
Senior Software Engineer, SELinux Solutions
Red Hat, Inc.