SELinux lockdown

[Luke Macken]

Hey everyone,

So I've been doing a lot of SELinux/audit related work behind the scenes
within our infrastructure for a while now, working closely with Dan
Walsh and Steve Grubb.  It's taken a lot of patience and hard work, but
we're finally at the point where we can start switching large portions
of our infrastructure over to SELinux Enforcing mode.

The following server groups are now fully enforcing:

    o gateway
    o people
    o planet
    o fas
    o collab
    o releng
    o db
    o torrent
    o dns

These are all groups of machines that have not had any SELinux
denials in at least a month.  If you notice any issues with
regard to these groups, please speak up.

I will be keeping a close eye on these machines, and I encourage anyone
that is interested to do the same.  I threw together a little tool that
I've been using to monitor & manage SELinux on our machines.  It uses
func, and allows you to do the following:

    Get the SELinux status:

        selinux-overlord.py --status

    Display all enforced denials:

        selinux-overlord.py --enforced-denials

    Dump all raw AVCs to disk.  Each minion will have it's own file:

        selinux-overlord.py --dump-avcs

    Upgrade the SELinux policy RPMs:

        selinux-overlord.py --upgrade-policy

It defaults to querying all minions, but you can specify groups of them
if you wish:

       selinux-overlord.py --status app* db*

This script should ideally be it's own func module, but in the mean time
I added it to the fedora-infrastructure git repository:

    http://git.fedorahosted.org/git/?p=fedora-infrastructure.git;a=blob_plain;f=scripts/selinux/selinux-overlord.py;hb=HEAD

More information on our SELinux deployment can be found in our
[out of date] SOP: http://fedoraproject.org/wiki/Infrastructure/SOP/SELinux

luke
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 197 bytes
Desc: not available
Url : http://lists.fedoraproject.org/pipermail/infrastructure/attachments/20090502/619f5aac/attachment.bin