From mboxrd@z Thu Jan 1 00:00:00 1970 From: Simon Sekidde Subject: Re: Audisp plugin and SELinux Date: Wed, 24 Feb 2016 10:53:24 -0500 (EST) Message-ID: <942741006.29652022.1456329204563.JavaMail.zimbra@redhat.com> References: <21109581.qic73jJAcb@x2> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <21109581.qic73jJAcb@x2> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Steve Grubb Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com ----- Original Message ----- > From: "Steve Grubb" > To: linux-audit@redhat.com > Sent: Wednesday, February 24, 2016 10:02:25 AM > Subject: Re: Audisp plugin and SELinux > > On Wednesday, February 24, 2016 04:40:13 PM Lev Stipakov wrote: > > My audisp plugin has a file-based database in /var/lib/xxx directory. I > > noticed that on systems with SELinux enabled plugin cannot read/write > > that file. > > > > According to ps, plugin is run under audisp_t domain: > > > > -bash-4.1$ ps axZ | grep plugin > > unconfined_u:system_r:audisp_t:s0 1845 ? S< 0:00 /usr/sbin/plugin 1 > > > > Obviously I don't want to disable SELinux. What would be the recommended > > way to allow plugin read/write file(s) under /var/run/xxx ? > If you label the dir as audisp_var_run_t then this should work nicely with SELinux # semanage fcontext -a -t audisp_var_run_t /var/run/xxx # restorecon -Rv /var/run/xxx > The plugin should have its own policy. I don't think audisp_t should be > broadened to allow things it shouldn't be doing. There are probably several > people on this list that can give you advice on creating a policy. > > -Steve > > -- > Linux-audit mailing list > Linux-audit@redhat.com > https://www.redhat.com/mailman/listinfo/linux-audit > -- Simon Sekidde * Red Hat, Inc. * Westford, MA gpg: 5848 958E 73BA 04D3 7C06 F096 1BA1 2DBF 94BC 377E