Let's take a minute to talk about permissive domains.
In the past if we wanted to test the impact of FC Linux on a new application a common approach was to
put the entire system into permissive mode run the application for a period and then take a look at
all the ATC deny messages and use them to make the required policy or labeling changes.
This wasn't about approach but place in the entire system into anti permissive mode isn't exactly the
best idea.
This is a permissive domain shine permissive demands allow us to place specific domains into permissive
mode while leaving the rest of the system in unforeseen mode.
Let's take a look at a simple example.
So here in my server if I go through an AC manage permissive shell I can see a list of premiership demands
on my system.
Let's go ahead and create one.
But before we do that I'm going to say change con dash t default on 30 on FA dub dub dub halt team Al
index.
Let's confirm with a list 10
no wi fi.
Go for the one w get height TGP local host indexed ad hoc t demo.
As expected the download fills.
Let's go to make sure of it by height to be daemon is run n so system city l state US height TTP D E
for a following that birth P.S. dash e za and grep for height TBD we can see the application domain
now we can go out and say SC manage permissive dish A4 add height GDP D on the score T.
This is going to place the web server domain into permissive mode.
Let's check again with ESA info and SC man age permissive dish out easy peasy lemons queasy.
We can now test our work with web get again and voila there it is.
So without having to place the entire system into permissive mode we were able to release the single
domain from the shackles of SC Linux.
Let's go back the other way and undo what we just did.
So I'm going to cycle through my human history and when to change a to D
and before for retry w get well it fails.
That's all for now.
Thank you for your time and I hope to see you in the next lesson.