Configuring Security Subsystems

Presence of the SELinux enhanced security subsystem in the OS as well as the use of mandatory access control systems, such as PARSEC—as opposed to the classical discretionary model used by Unix—causes issues in the operation of Dr.Web Server Security Suite when its default settings are used. To ensure correct operation of Dr.Web Server Security Suite in this case, it is necessary to make additional changes to the settings of the security subsystem and/or to the settings of Dr.Web Server Security Suite.

Configuring the permissions of the PARSEC mandatory access control system for Dr.Web Server Security Suite allows its components to bypass the restrictions of the set security policies and to get access to the files that belong to different privilege levels.

Even if you have not configured the permissions of the PARSEC mandatory access control system for Dr.Web Server Security Suite, you still will be able to start file scanning directly from the command line. To do this, run the drweb-ctl command in standalone mode by indicating the --Autonomous parameter at startup.

In standalone mode, it will be possible to scan files that require a level of privileges not higher than the level of the user who started the scanning session. This mode has the following aspects:

•To start in standalone instance mode, you will need a valid key file, operation in centralized protection mode is not supported (it is possible to install the key file exported from a centralized protection server). In this case, even if Dr.Web Server Security Suite is connected to the centralized protection server, the standalone instance does not notify the centralized protection server of the threats detected in standalone instance mode.

•All supplementary components that support the functioning of the standalone instance will be started on behalf of the current user and will work with a specifically generated configuration file.

•All temporary files and Unix sockets used for interaction of components are created only in a directory with an unique name. This directory is created by the started standalone instance in the directory for temporary files (specified by the TMPDIR environment variable).

•All the required paths (to virus databases, scanning engine and executable files of service components) are set to default values or retrieved from custom environment variables.

•The number of the standalone instances working simultaneously is not limited.

•When the standalone instance is shut down, the set of components maintaining it is also shut down.