whentimeslows/website
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix typos in selinux part

Browse Source 
Signed-off-by: Sascha Grunert <sgrunert@redhat.com>
This commit is contained in:
Sascha Grunert
2021-12-14 12:37:33 +01:00
parent 9d5e049afd
commit dd63a3102a
1 changed files with 12 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
content/en/blog/_posts/2021-12-17-security-profiles-operator-v0.4.0/index.md
+12 -9
View File
@@ -9,7 +9,7 @@ slug: security-profiles-operator
--- ---
The [Security Profiles Operator](https://sigs.k8s.io/security-profiles-operator) The [Security Profiles Operator (SPO)](https://sigs.k8s.io/security-profiles-operator)
is an out-of-tree Kubernetes enhancement to make the management of is an out-of-tree Kubernetes enhancement to make the management of
[seccomp](https://en.wikipedia.org/wiki/Seccomp), [seccomp](https://en.wikipedia.org/wiki/Seccomp),
[SELinux](https://en.wikipedia.org/wiki/Security-Enhanced_Linux) and [SELinux](https://en.wikipedia.org/wiki/Security-Enhanced_Linux) and
@@ -63,10 +63,12 @@ Managing SELinux policies (an equivalent to using `semodule` that
you would normally call on a single server) is not done by SPO you would normally call on a single server) is not done by SPO
itself, but by another container called selinuxd to provide better itself, but by another container called selinuxd to provide better
isolation. This release switched to using selinuxd containers from isolation. This release switched to using selinuxd containers from
a personal reposiroty to images located under [our team's quay.io repository](https://quay.io/organization/security-profiles-operator). a personal repository to images located under [our team's quay.io
The selinuxd repo has moved as well to [the containers github organization](https://github.com/containers/selinuxd). repository](https://quay.io/organization/security-profiles-operator).
The selinuxd repository has moved as well to [the containers GitHub
organization](https://github.com/containers/selinuxd).
Please note that selinuxd links dynamically to libsemanage and mounts the Please note that selinuxd links dynamically to `libsemanage` and mounts the
SELinux directories from the nodes, which means that the selinuxd container SELinux directories from the nodes, which means that the selinuxd container
must be running the same distribution as the cluster nodes. SPO defaults must be running the same distribution as the cluster nodes. SPO defaults
to using CentOS-8 based containers, but we also build Fedora based ones. to using CentOS-8 based containers, but we also build Fedora based ones.
@@ -76,14 +78,15 @@ it, please file [an issue against selinuxd](https://github.com/containers/selinu
#### Profile Recording #### Profile Recording
This release adds support for recording of SELinux profiles. This release adds support for recording of SELinux profiles.
The recording itself is managed via an instance of a `ProfileRecording` CR The recording itself is managed via an instance of a `ProfileRecording` Custom
as seen in an [example](https://github.com/kubernetes-sigs/security-profiles-operator/blob/main/examples/profilerecording-selinux-logs.yaml) Resource as seen in an
in our repo and from user's point of view works pretty much the same as [example](https://github.com/kubernetes-sigs/security-profiles-operator/blob/main/examples/profilerecording-selinux-logs.yaml)
recording of seccomp profiles. in our repository. From the user's point of view it works pretty much the same
as recording of seccomp profiles.
Under the hood, to know what the workload is doing SPO installs a special Under the hood, to know what the workload is doing SPO installs a special
permissive policy called [selinuxrecording](https://github.com/kubernetes-sigs/security-profiles-operator/blob/main/deploy/base/profiles/selinuxrecording.cil) permissive policy called [selinuxrecording](https://github.com/kubernetes-sigs/security-profiles-operator/blob/main/deploy/base/profiles/selinuxrecording.cil)
on startup which allows everything and logs all AVCs to audit.log. on startup which allows everything and logs all AVCs to `audit.log`.
These AVC messages are scraped by the log enricher component and when These AVC messages are scraped by the log enricher component and when
the recorded workload exits, the policy is created. the recorded workload exits, the policy is created.