David and Katherine Goodwin

Having heard much about SELinux over the last few years, I thought I'd finally make an effort to use it on two servers I've been setting up for a customer. My main desire to use it is because the customer has a fairly large code base, which is programmed in a number of different styles over a number of years by different developers. I'm sure there are vulnerabilities in the code.

On one server, once I got over general teething problems (e.g. if I mount a disk to /var/spool, I'll need to get it relabelled) it seemed to work fine - so I've left it to do it's thing.

On the other server, unfortunately, I need to install Zend Optimizer (despite it's name, it's not an optimizer for performance, more of a code obfuscation/encryption thing to stop someone stealing your "valuable" PHP source code).

Zend Optimizer doesn't play with SELinux, and annoyingly, despite doing, what I assume is the SELinux dance many times, it refused to initially work. On retrospect this seems to be because if you apply two SELinux custom modules, the second replaces the first. Thankfully there's this which does work.

Next I had to fix Munin/ethtool, but this was straight forward enough. Thankfully.

So, so far - it's taken me a number of hours to get around SELinux, so it had better be worth the effort!

Technorati Tags: