Configuring Security Subsystems

Presence of the SELinux enhanced security subsystem in the OS as well as the use of mandatory access control systems, such as PARSEC—as opposed to the classical discretionary model used by Unix—causes issues in the operation of Dr.Web Security Space when its default settings are used. To ensure correct operation of Dr.Web Security Space in this case, it is necessary to make additional changes to the settings of the security subsystem and/or to the settings of Dr.Web Security Space.

Configuring the permissions of the PARSEC mandatory access control system for Dr.Web Security Space allows the anti-virus components to bypass the restrictions of set security policies and get access to files of different privilege levels.

Even if you have not configured the permissions of the PARSEC mandatory access control system for Dr.Web Security Space components, you still will be able to start file scanning via the graphical management interface of Dr.Web Security Space in standalone instance mode. For that, run the drweb-gui command with the --Autonomous parameter.

You can also start the scanning directly from the command line. To do this, run the drweb-ctl command with the same parameter (--Autonomous). In this case, it will be possible to scan files that require a level of privileges not higher than the level of the user who started the scanning session. This mode has the following aspects:

•To start in standalone instance mode, you will need a valid key file, operation in centralized protection mode is not supported (it is possible to install the key file exported from a centralized protection server). In this case, even if Dr.Web Security Space is connected to the centralized protection server, the standalone instance does not notify the centralized protection server of the threats detected in standalone instance mode.

•All supplementary components that support the functioning of the standalone instance will be started on behalf of the current user and will work with a specifically generated configuration file.

•All temporary files and Unix sockets used for interaction of components are created only in a directory with an unique name. This directory is created by the started standalone instance in the directory for temporary files (specified by the TMPDIR environment variable).

•The standalone instance of the graphical management interface does not start the SpIDer Guard and SpIDer Gate monitors, only file scanning and quarantine management functions supported by Scanner are available.

•All the required paths (to virus databases, scanning engine and executable files of service components) are set to default values or retrieved from custom environment variables.

•The number of the standalone instances working simultaneously is not limited.

•When the standalone instance is shut down, the set of components maintaining it is also shut down.