From mboxrd@z Thu Jan  1 00:00:00 1970
From: Steve Grubb <sgrubb@redhat.com>
Subject: Re: Audisp plugin and SELinux
Date: Wed, 24 Feb 2016 10:02:25 -0500
Message-ID: <21109581.qic73jJAcb@x2>
References: <nakfcd$3ca$1@ger.gmane.org>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Return-path: <linux-audit-bounces@redhat.com>
In-Reply-To: <nakfcd$3ca$1@ger.gmane.org>
List-Unsubscribe: <https://www.redhat.com/mailman/options/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: linux-audit@redhat.com
List-Id: linux-audit@redhat.com

On Wednesday, February 24, 2016 04:40:13 PM Lev Stipakov wrote:
> My audisp plugin has a file-based database in /var/lib/xxx directory. I
> noticed that on systems with SELinux enabled plugin cannot read/write
> that file.
> 
> According to ps, plugin is run under audisp_t domain:
> 
> -bash-4.1$ ps axZ | grep plugin
> unconfined_u:system_r:audisp_t:s0 1845 ? S< 0:00 /usr/sbin/plugin 1
> 
> Obviously I don't want to disable SELinux. What would be the recommended
> way to allow plugin read/write file(s) under /var/run/xxx ?

The plugin should have its own policy. I don't think audisp_t should be 
broadened to allow things it shouldn't be doing. There are probably several 
people on this list that can give you advice on creating a policy.

-Steve