We are currently developing the SELinux policy for our application, but we are encountering significant challenges in managing it effectively.

Here’s our approach so far:

• We run our app in SELinux permissive mode, identify violations, and create rules based on these violations.

• To ensure comprehensive coverage, we exercise all major code paths to create rules for all files, ports, sockets, services, etc., which are accessed. This allowed us to develop a good rule set.

• However, when we tested this policy on customers’ hardened VMs, it didn’t work as expected. We identified more violations (on their VM) and updated the rules accordingly.

• Another team tested it on a different version of RedHat and ran into some other issues.

There are multiple things that go through my head:

Extensive Testing: How can we ensure that we hit all execution paths during runtime to identify necessary rules?

Cross-Version Support: How can we manage SELinux policies across multiple versions of the distro?

Frequent Releases: How can we maintain and update SELinux policies for each new release, given that we release updates often?

Technically, these tasks seem feasible (we do know how to do each step), but practically, they appear to be extremely resource-intensive. Manually execution of this process or creating an extensive set of end-to-end tests to automate the detection of new violations for code changes or new distro versions both seem really expensive.

What are we missing? Are there best practices or tools that can make this process more manageable?