This is what I see in Fedora<div><br></div><div><div>[root@nmoidu ~]# service tomcat status</div><div>Redirecting to /bin/systemctl status tomcat.service</div><div>tomcat.service - Apache Tomcat Web Application Container</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span> Loaded: loaded (/lib/systemd/system/tomcat.service; disabled)</div><div><span class="Apple-tab-span" style="white-space:pre"> </span> Active: inactive (dead)</div>
<div><span class="Apple-tab-span" style="white-space:pre"> </span> CGroup: name=systemd:/system/tomcat.service</div><div>[root@nmoidu ~]# service tomcat start</div><div>Redirecting to /bin/systemctl start tomcat.service</div>
</div><div>[root@nmoidu ~]# ps -efZ | grep tomcat</div><div><div>system_u:system_r:unconfined_java_t:s0 tomcat 21783 1 18 17:00 ? 00:00:01 /usr/lib/jvm/jre/bin/java -classpath :/usr/share/tomcat/bin/bootstrap.jar:/usr/share/tomcat/bin/tomcat-juli.jar:/usr/share/java/commons-daemon.jar -Dcatalina.base=/usr/share/tomcat -Dcatalina.home=/usr/share/tomcat -Djava.endorsed.dirs= -Djava.io.tmpdir=/var/cache/tomcat/temp -Djava.util.logging.config.file=/usr/share/tomcat/conf/logging.properties -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager org.apache.catalina.startup.Bootstrap start</div>
<div>unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 root 21806 21661 0 17:00 pts/0 00:00:00 grep --color=auto tomcat</div><div>[root@nmoidu ~]# ps -efZ | grep tomcat</div><div>system_u:system_r:unconfined_java_t:s0 tomcat 21783 1 13 17:00 ? 00:00:01 /usr/lib/jvm/jre/bin/java -classpath :/usr/share/tomcat/bin/bootstrap.jar:/usr/share/tomcat/bin/tomcat-juli.jar:/usr/share/java/commons-daemon.jar -Dcatalina.base=/usr/share/tomcat -Dcatalina.home=/usr/share/tomcat -Djava.endorsed.dirs= -Djava.io.tmpdir=/var/cache/tomcat/temp -Djava.util.logging.config.file=/usr/share/tomcat/conf/logging.properties -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager org.apache.catalina.startup.Bootstrap start</div>
<div>unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 root 21809 21661 0 17:00 pts/0 00:00:00 grep --color=auto tomcat</div><div>[root@nmoidu ~]# cat /etc/redhat-release </div><div>Fedora release 16 (Verne)</div><div>
[root@nmoidu ~]# rpm -qa |grep tomcat</div><div>tomcat-7.0.25-2.fc16.noarch</div><div>tomcat6-servlet-2.5-api-6.0.32-19.fc16.noarch</div><div>tomcat-jsp-2.2-api-7.0.25-2.fc16.noarch</div><div>tomcat6-jsp-2.1-api-6.0.32-19.fc16.noarch</div>
<div>tomcat-servlet-3.0-api-7.0.25-2.fc16.noarch</div><div>tomcat-lib-7.0.25-2.fc16.noarch</div><div>tomcat5-jasper-eclipse-5.5.31-3.fc15.noarch</div><div>tomcat-el-2.2-api-7.0.25-2.fc16.noarch</div><div>[root@nmoidu ~]# semodule -l | grep -i tomcat</div>
<div>[root@nmoidu ~]# </div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><br><div class="gmail_quote">On Thu, Feb 9, 2012 at 4:57 PM, Miroslav Grepl <span dir="ltr"><<a href="mailto:mgrepl@redhat.com">mgrepl@redhat.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div bgcolor="#FFFFFF" text="#000000"><div><div></div><div class="h5">
On 02/09/2012 02:52 AM, Nabeel Moidu wrote:
<blockquote type="cite">Hi
<div><br>
</div>
<div>Is there a tomcat implementation of selinux where the process
runs in its own domain rather than unconfined_java_t ?</div>
<div><br>
</div>
<div>Are there any known issues with implementing java servers in
a confined domain ?</div>
<div><br>
</div>
<div>If not tomcat, can somebody point me to any other java server
(jetty/websphere etc) with a selinux implementation ?<br clear="all">
<div><br>
</div>
-- <br>
<div dir="ltr">Thanks and Regards,</div>
</div>
</blockquote></div></div>
What OS? <br>
<br>
tomcat should be running as initrc_t on RHEL6. We probably need this
also in Fedora. Basically this new domain would end up as unconfined
domain, but you can start with writing policy using sepolgen tools.<br>
<br>
$ sepolgen -t 0 /usr/bin/tomcat<br>
$ sh tomcat.sh<br>
<br>
You probably will need to add<br>
<br>
java_domtrans(tomcat_t)<br>
<br>
to the tomcat.te policy file. Let me look at it also.<br>
<br>
<blockquote type="cite">
<div>
<div dir="ltr">
<br>
Nabeel Moidu<br>
Hyderabad, India</div>
<br>
</div>
<br>
<fieldset></fieldset>
<br>
<pre>--
selinux mailing list
<a href="mailto:selinux@lists.fedoraproject.org" target="_blank">selinux@lists.fedoraproject.org</a>
<a href="https://admin.fedoraproject.org/mailman/listinfo/selinux" target="_blank">https://admin.fedoraproject.org/mailman/listinfo/selinux</a></pre>
</blockquote>
<br>
</div>
</blockquote></div><br><br clear="all"><div><br></div>-- <br><div dir="ltr">Thanks and Regards,</div><div dir="ltr"><br>Nabeel Moidu<br>Hyderabad, India</div><br>
</div>