# Confining Beats (aka SELinux policy for beats on EL)

**URL:** <https://discuss.elastic.co/t/confining-beats-aka-selinux-policy-for-beats-on-el/116043>\
**Category:** Beats\
**Created:** [January 18, 2018, 12:12pm UTC](https://discuss.elastic.co/t/confining-beats-aka-selinux-policy-for-beats-on-el/116043 "2018-01-18T12:12:53Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![fuero0](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fuero0/32/26702_2.png) [@fuero0](https://discuss.elastic.co/u/fuero0)\
**Post date:** [January 18, 2018, 12:12pm UTC](https://discuss.elastic.co/t/confining-beats-aka-selinux-policy-for-beats-on-el/116043/1 "2018-01-18T12:12:54Z")

</div>

Hi,

I'm evaluating filebeat and auditbeat (plus the contributed journalbeat) as log shippers for our environment. I had a look at the EL packages supplied by Elasticsearch and noticed that a suitable SELinux policy was missing.

I've rolled my own for now, is there interest in supplying a policy in the RPMs? I'd be willing to share what I came up with so far.

Kind regards,  
Robert

---

<div class="post-metadata">

**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\
**Post date:** [January 18, 2018, 12:20pm UTC](https://discuss.elastic.co/t/confining-beats-aka-selinux-policy-for-beats-on-el/116043/2 "2018-01-18T12:20:51Z")

</div>

Great news! Could you please open a PR with the policies for Filebeat and Auditbeat?

> **[elastic/beats](https://github.com/elastic/beats/compare)**
>
> beats - :tropical\_fish: Beats - Lightweight shippers for Elasticsearch & Logstash

This let's us evaluate the policy.

---

<div class="post-metadata">

**Author:** ![fuero0](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fuero0/32/26702_2.png) [@fuero0](https://discuss.elastic.co/u/fuero0)\
**Post date:** [January 18, 2018, 2:24pm UTC](https://discuss.elastic.co/t/confining-beats-aka-selinux-policy-for-beats-on-el/116043/3 "2018-01-18T14:24:52Z")

</div>

[Done](https://github.com/elastic/beats/pull/6103)

---

<div class="post-metadata">

**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\
**Post date:** [January 18, 2018, 4:15pm UTC](https://discuss.elastic.co/t/confining-beats-aka-selinux-policy-for-beats-on-el/116043/4 "2018-01-18T16:15:36Z")

</div>

Thanks!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 8, 2018, 12:12pm UTC](https://discuss.elastic.co/t/confining-beats-aka-selinux-policy-for-beats-on-el/116043/5 "2018-02-08T12:12:59Z")

</div>

This topic was automatically closed after 21 days. New replies are no longer allowed.