All geek questions in one place

SELinux and Java

Are there any recommendations for handling Java applications using SELinux? Can it configure SELinux for each Java application, or can it only be processed by VM because it makes the final system calls?

+3
source share
3 answers

If you ask whether Java and SELinux will work, it depends on how the policy is defined. You will be mostly concerned about the area in which the Java process works, how it got into this domain, and that this domain is allowed.

A domain is just a SELinux context to see which context / domain starts the process, how to try the -Z option for ps (i.e. ps -Z). Similarly, to view the file context, try the -Z option for ls (i.e. ls -Z)

You would be interested to look at the source of SELinux policy or use an analysis tool such as sesearch or apol (from setools) to find out which policy allows and how java falls into a specific domain.

From there, you will need to fix / write down the policy, which may be the process involved, but tools like SLIDE (eclipse plugin), seedit (although I have no experience with this) were written, for example.

+4
source

You can have any number of JVMs and any number of JVM versions. You can configure them independently of each other if you wish.

JVM , . JVM, .

+3

, , , . SElinux. . , Redhat Dan Walsh, , unconfined_u . , , , .eclipse, . staff_u, sudo, fcontext /HOME _DIR/.eclipse(/.*)+ staff_java_t

+2

Source: https://habr.com/ru/post/1710655/

More articles:


All Articles