Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add selinux policy module that works for otelcol-sumo as installed using install script. #807

Open
jspaleta opened this issue Nov 1, 2022 · 0 comments

Comments

@jspaleta
Copy link
Contributor

jspaleta commented Nov 1, 2022

Users with selinux enforcing system will want to confine otelcol using selinux policy

I've put together an example selinux policy that works on my Fedora 36 developer environment laptop.

https://github.com/jspaleta/opentelemetry-collector-selinux-policies/tree/main/otelcol-sumo

You can compile and install the selinux policy using the otelcol-sumo.sh script provided in that directory assuming you have the selinux policy development tools installed.

From there its a matter of adding additional policy allow/deny statements to the otelcol_sumo.te file as additional otelcol workloads are added. For example the reference policy needs to be extended to read mysql logs.

Important note, the otelcol_sumo.te provided in that repository makes reference to existing selinux policy functions that might be specific to Fedora 36. This policy may need to be refactored to better support selinux for specific releases of selinux targets. Example RHEL 7 might not define all the policy functions in use in the reference policy I created.

here's a SumoLogic slack conversation reference concerning a customer ask for reference selinux policy:
https://sumologic.slack.com/archives/C01KD5GHQ5C/p1661885266713369

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant