Skip to contentSkip to conversation

Audisp plugin and SELinux

DISCUSSION Lev Stipakov 3 participants 3 messages Feb 24, 2016

lore
Share & tools
lore

Lev Stipakov

author
#0 lore raw

Hello,

My audisp plugin has a file-based database in /var/lib/xxx directory. I noticed that on systems with SELinux enabled plugin cannot read/write that file.

According to ps, plugin is run under audisp_t domain:

-bash-4.1$ ps axZ | grep plugin unconfined_u:system_r:audisp_t:s0 1845 ? S< 0:00 /usr/sbin/plugin 1

Obviously I don't want to disable SELinux. What would be the recommended way to allow plugin read/write file(s) under /var/run/xxx ?

-Lev

#1 lore raw
Quoted 11 lines · Lev Stipakov

My audisp plugin has a file-based database in /var/lib/xxx directory. I noticed that on systems with SELinux enabled plugin cannot read/write that file.

According to ps, plugin is run under audisp_t domain:

-bash-4.1$ ps axZ | grep plugin unconfined_u:system_r:audisp_t:s0 1845 ? S< 0:00 /usr/sbin/plugin 1

Obviously I don't want to disable SELinux. What would be the recommended way to allow plugin read/write file(s) under /var/run/xxx ?

The plugin should have its own policy. I don't think audisp_t should be broadened to allow things it shouldn't be doing. There are probably several people on this list that can give you advice on creating a policy.

-Steve

#2 lore raw

----- Original Message -----

Quoted 5 lines

From: "Steve Grubb" <[email protected]>
To: [email protected]
Sent: Wednesday, February 24, 2016 10:02:25 AM
Subject: Re: Audisp plugin and SELinux

Quoted 13 lines
Quoted 11 lines · Lev Stipakov

My audisp plugin has a file-based database in /var/lib/xxx directory. I noticed that on systems with SELinux enabled plugin cannot read/write that file.

According to ps, plugin is run under audisp_t domain:

-bash-4.1$ ps axZ | grep plugin unconfined_u:system_r:audisp_t:s0 1845 ? S< 0:00 /usr/sbin/plugin 1

Obviously I don't want to disable SELinux. What would be the recommended way to allow plugin read/write file(s) under /var/run/xxx ?

If you label the dir as audisp_var_run_t then this should work nicely with SELinux

# semanage fcontext -a -t audisp_var_run_t /var/run/xxx
# restorecon -Rv /var/run/xxx
Quoted 11 lines

The plugin should have its own policy. I don't think audisp_t should be broadened to allow things it shouldn't be doing. There are probably several people on this list that can give you advice on creating a policy.

-Steve

--
Linux-audit mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/linux-audit

Signature · 2 lines
Simon Sekidde * Red Hat, Inc. * Westford, MA
gpg: 5848 958E 73BA 04D3 7C06 F096 1BA1 2DBF 94BC 377E