# Unconfined services with Elasticsearch

**URL:** <https://discuss.elastic.co/t/unconfined-services-with-elasticsearch/260151>\
**Category:** Elasticsearch\
**Created:** [January 5, 2021, 2:49am UTC](https://discuss.elastic.co/t/unconfined-services-with-elasticsearch/260151 "2021-01-05T02:49:42Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![redplastic](https://avatars.discourse-cdn.com/v4/letter/r/f08c70/32.png) [@redplastic](https://discuss.elastic.co/u/redplastic)\
**Post date:** [January 5, 2021, 2:49am UTC](https://discuss.elastic.co/t/unconfined-services-with-elasticsearch/260151/1 "2021-01-05T02:49:42Z")

</div>

I'm attempting to use Elasticsearch on Centos but have some concerns over the unconfined java and controller services that Elasticsearch uses. With the system's initial blocking of unconfined services due to security concerns, Elasticsearch will not be able to work as java and controller will not be able to start up.

Does Elasticsearch requires that the java and controller be run on unconfined services or are there ways to run the services in a confined type and still allowing Elasticsearch to work?  
Thanks

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [January 5, 2021, 2:50am UTC](https://discuss.elastic.co/t/unconfined-services-with-elasticsearch/260151/2 "2021-01-05T02:50:47Z")

</div>

Welcome to our community! 😃

Can you clarify what you mean by "unconfined services"?

---

<div class="post-metadata">

**Author:** ![redplastic](https://avatars.discourse-cdn.com/v4/letter/r/f08c70/32.png) [@redplastic](https://discuss.elastic.co/u/redplastic)\
**Post date:** [January 5, 2021, 3:08am UTC](https://discuss.elastic.co/t/unconfined-services-with-elasticsearch/260151/3 "2021-01-05T03:08:00Z")

</div>

I meant that they run as unconfined processes. For example when running `ps -eZ | grep unconfined_service_t` it will flag out the 2 processes, java and controller that is used by elasticsearch.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [January 5, 2021, 3:09am UTC](https://discuss.elastic.co/t/unconfined-services-with-elasticsearch/260151/4 "2021-01-05T03:09:27Z")

</div>

Are you referring to something in SELinux here? That's the only reference I can see to what you are asking, which is why I was looking for clarification 🙂

---

<div class="post-metadata">

**Author:** ![redplastic](https://avatars.discourse-cdn.com/v4/letter/r/f08c70/32.png) [@redplastic](https://discuss.elastic.co/u/redplastic)\
**Post date:** [January 5, 2021, 3:11am UTC](https://discuss.elastic.co/t/unconfined-services-with-elasticsearch/260151/5 "2021-01-05T03:11:10Z")

</div>

Yes, sorry. I forgot to mention that. I'm running Centos with SELinux enabled.

---

<div class="post-metadata">

**Author:** ![redplastic](https://avatars.discourse-cdn.com/v4/letter/r/f08c70/32.png) [@redplastic](https://discuss.elastic.co/u/redplastic)\
**Post date:** [January 14, 2021, 4:01pm UTC](https://discuss.elastic.co/t/unconfined-services-with-elasticsearch/260151/6 "2021-01-14T16:01:17Z")

</div>

Since unconfined services in SELinux is supposed to be able to do nearly anything, is there a security concern regarding having elasticsearch run java and controller as unconfined services?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 11, 2021, 4:01pm UTC](https://discuss.elastic.co/t/unconfined-services-with-elasticsearch/260151/7 "2021-02-11T16:01:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.