--=-B1QCWkZPIAdKekvsZ0M2 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hi again, while looking at servers, I also couldn't help noticing that selinux is either disabled or set as permissive on the few servers I looked, one even having auditd disabled.=20 So I did enable auditd with the goal of collecting violation in audit.log ( aka AVC ), and I plan to look at them. I already started to fix a few violations showing up in the log. Sometime, this would just be enabling a boolean to configure selinux ( ie, enable some specific access ), sometime, it was just wrongly labelled file ( on monitoring.ovirt, mostly ). I do not plan to set selinux in enforcing mode before having check that there is no problem for a longer period of time, and of course, not if people think it is not wise. I also so far only propose to do that host by host, as I guess the jenkins ones may be more complex to limit.=20 I wil report with what I foud and so we will discuss if we make the switch or not. --=20 Michael Scherer Open Source and Standards, Sysadmin --=-B1QCWkZPIAdKekvsZ0M2 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: This is a digitally signed message part Content-Transfer-Encoding: 7bit --=-B1QCWkZPIAdKekvsZ0M2--