I received a SELinux alert today which said:
SELinux is preventing /usr/local/bin/snort from search access on the directory logs.
One of the options was to do:
semanage fcontext -a -t FILE_TYPE 'logs'
(lots of FILE_TYPEs)
followed by
restorecon -v 'logs'
So here is what happens:
ll -Zd logs drwxr-xr-x. root root unconfined_u:object_r:file_t:s0 logs
sudo semanage fcontext -a -t var_log_t 'logs'
sudo restorecon -v 'logs' restorecon: Warning no default label for /media/NSM/NSM-SENSOR-2/logs
ll -Zd logs drwxr-xr-x. root root unconfined_u:object_r:file_t:s0 logs
Nothing has changed.
So what do I need to do to set the file context correctly?
Paolo
On 07/31/2014 09:51 AM, Michael Cronenworth wrote:
On 07/31/2014 10:54 AM, pgaltieri . wrote:
sudo semanage fcontext -a -t var_log_t 'logs'
[snip]
You need to pass the full path here.
# semanage fcontext -a -t var_log_t /media/NSM/NSM-SENSOR-2/logs
I tried that and the restorecon and the file type is still file_t instead of var_log_t.
Paolo
On 07/31/2014 01:52 PM, Paolo Galtieri wrote:
On 07/31/2014 09:51 AM, Michael Cronenworth wrote:
On 07/31/2014 10:54 AM, pgaltieri . wrote:
sudo semanage fcontext -a -t var_log_t 'logs'
[snip]
You need to pass the full path here.
# semanage fcontext -a -t var_log_t /media/NSM/NSM-SENSOR-2/logs
I tried that and the restorecon and the file type is still file_t instead of var_log_t.
Paolo
# semanage fcontext -a -t var_log_t '/media/NSM/NSM-SENSOR-2/logs(/.*)?' # restorecon -R -v /media/NSM/NSM-SENSOR-2
Should change labels.
On 07/31/2014 11:28 AM, Daniel J Walsh wrote:
On 07/31/2014 01:52 PM, Paolo Galtieri wrote:
On 07/31/2014 09:51 AM, Michael Cronenworth wrote:
On 07/31/2014 10:54 AM, pgaltieri . wrote:
sudo semanage fcontext -a -t var_log_t 'logs'
[snip]
You need to pass the full path here.
# semanage fcontext -a -t var_log_t /media/NSM/NSM-SENSOR-2/logs
I tried that and the restorecon and the file type is still file_t instead of var_log_t.
Paolo
# semanage fcontext -a -t var_log_t '/media/NSM/NSM-SENSOR-2/logs(/.*)?' # restorecon -R -v /media/NSM/NSM-SENSOR-2
Should change labels.
What's interesting is if I do
semanage fcontext -a -t snort_log_t /media/NSM/NSM-SENSOR-2/logs
restorecon -v /media/NSM/NSM-SENSOR-2/logs
restorecon reset /media/NSM/NSM-SENSOR-2/logs context unconfined_u:object_r:file_t:s0->unconfined_u:object_r:snort_log_t:s0
ll -Zd /media/NSM/NSM-SENSOR-2/logs
drwxr-xr-x. snort snort unconfined_u:object_r:snort_log_t:s0 /media/NSM/NSM-SENSOR-2/logs
so it worked in this case. Now if I do the same thing, but using var_log_t as the FILE_TYPE it works.
Is it possible that the error about no default label is what is preventing me from changing the context the first time I tried? Since I didn't get the error when I changed the context to snort_log_t restorecon changed it and now SELinux thinks there is a default label (snort_log_t). Subsequent changes work because of the presence of a default label.
Paolo
-
Daniel J Walsh -
Michael Cronenworth -
Paolo Galtieri