This is what I see in Fedora<div><br></div><div><div>[root@nmoidu ~]# service tomcat status</div><div>Redirecting to /bin/systemctl  status tomcat.service</div><div>tomcat.service - Apache Tomcat Web Application Container</div>
<div><span class="Apple-tab-span" style="white-space:pre">	</span>  Loaded: loaded (/lib/systemd/system/tomcat.service; disabled)</div><div><span class="Apple-tab-span" style="white-space:pre">	</span>  Active: inactive (dead)</div>
<div><span class="Apple-tab-span" style="white-space:pre">	</span>  CGroup: name=systemd:/system/tomcat.service</div><div>[root@nmoidu ~]# service tomcat start</div><div>Redirecting to /bin/systemctl  start tomcat.service</div>
</div><div>[root@nmoidu ~]# ps -efZ  | grep tomcat</div><div><div>system_u:system_r:unconfined_java_t:s0 tomcat 21783 1 18 17:00 ?       00:00:01 /usr/lib/jvm/jre/bin/java -classpath :/usr/share/tomcat/bin/bootstrap.jar:/usr/share/tomcat/bin/tomcat-juli.jar:/usr/share/java/commons-daemon.jar -Dcatalina.base=/usr/share/tomcat -Dcatalina.home=/usr/share/tomcat -Djava.endorsed.dirs= -Djava.io.tmpdir=/var/cache/tomcat/temp -Djava.util.logging.config.file=/usr/share/tomcat/conf/logging.properties -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager org.apache.catalina.startup.Bootstrap start</div>
<div>unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 root 21806 21661  0 17:00 pts/0 00:00:00 grep --color=auto tomcat</div><div>[root@nmoidu ~]# ps -efZ  | grep tomcat</div><div>system_u:system_r:unconfined_java_t:s0 tomcat 21783 1 13 17:00 ?       00:00:01 /usr/lib/jvm/jre/bin/java -classpath :/usr/share/tomcat/bin/bootstrap.jar:/usr/share/tomcat/bin/tomcat-juli.jar:/usr/share/java/commons-daemon.jar -Dcatalina.base=/usr/share/tomcat -Dcatalina.home=/usr/share/tomcat -Djava.endorsed.dirs= -Djava.io.tmpdir=/var/cache/tomcat/temp -Djava.util.logging.config.file=/usr/share/tomcat/conf/logging.properties -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager org.apache.catalina.startup.Bootstrap start</div>
<div>unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 root 21809 21661  0 17:00 pts/0 00:00:00 grep --color=auto tomcat</div><div>[root@nmoidu ~]# cat /etc/redhat-release </div><div>Fedora release 16 (Verne)</div><div>
[root@nmoidu ~]# rpm -qa  |grep tomcat</div><div>tomcat-7.0.25-2.fc16.noarch</div><div>tomcat6-servlet-2.5-api-6.0.32-19.fc16.noarch</div><div>tomcat-jsp-2.2-api-7.0.25-2.fc16.noarch</div><div>tomcat6-jsp-2.1-api-6.0.32-19.fc16.noarch</div>
<div>tomcat-servlet-3.0-api-7.0.25-2.fc16.noarch</div><div>tomcat-lib-7.0.25-2.fc16.noarch</div><div>tomcat5-jasper-eclipse-5.5.31-3.fc15.noarch</div><div>tomcat-el-2.2-api-7.0.25-2.fc16.noarch</div><div>[root@nmoidu ~]# semodule -l | grep -i tomcat</div>
<div>[root@nmoidu ~]# </div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><br><div class="gmail_quote">On Thu, Feb 9, 2012 at 4:57 PM, Miroslav Grepl <span dir="ltr">&lt;<a href="mailto:mgrepl@redhat.com">mgrepl@redhat.com</a>&gt;</span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
  
    
  
  <div bgcolor="#FFFFFF" text="#000000"><div><div></div><div class="h5">
    On 02/09/2012 02:52 AM, Nabeel Moidu wrote:
    <blockquote type="cite">Hi
      <div><br>
      </div>
      <div>Is there a tomcat implementation of selinux where the process
        runs in its own domain rather than unconfined_java_t ?</div>
      <div><br>
      </div>
      <div>Are there any known issues with implementing java servers in
        a confined domain ?</div>
      <div><br>
      </div>
      <div>If not tomcat, can somebody point me to any other java server
        (jetty/websphere etc) with a selinux implementation ?<br clear="all">
        <div><br>
        </div>
        -- <br>
        <div dir="ltr">Thanks and Regards,</div>
      </div>
    </blockquote></div></div>
    What OS? <br>
    <br>
    tomcat should be running as initrc_t on RHEL6. We probably need this
    also in Fedora. Basically this new domain would end up as unconfined
    domain, but you can start with writing policy using sepolgen tools.<br>
    <br>
    $ sepolgen -t 0 /usr/bin/tomcat<br>
    $ sh tomcat.sh<br>
    <br>
    You probably will need to add<br>
    <br>
    java_domtrans(tomcat_t)<br>
    <br>
    to the tomcat.te policy file. Let me look at it also.<br>
    <br>
    <blockquote type="cite">
      <div>
        <div dir="ltr">
          <br>
          Nabeel Moidu<br>
          Hyderabad, India</div>
        <br>
      </div>
      <br>
      <fieldset></fieldset>
      <br>
      <pre>--
selinux mailing list
<a href="mailto:selinux@lists.fedoraproject.org" target="_blank">selinux@lists.fedoraproject.org</a>
<a href="https://admin.fedoraproject.org/mailman/listinfo/selinux" target="_blank">https://admin.fedoraproject.org/mailman/listinfo/selinux</a></pre>
    </blockquote>
    <br>
  </div>

</blockquote></div><br><br clear="all"><div><br></div>-- <br><div dir="ltr">Thanks and Regards,</div><div dir="ltr"><br>Nabeel Moidu<br>Hyderabad, India</div><br>
</div>