Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I have a cron job that is backing up a SELinux system running in strict mode. The problem is that SELinux wants to deny access to to the backup script since it wants access to every single file on the filesystem (and all the contexts on those files). I'm running in permissive mode right now so the script works, but I would like to turn permissive mode off.

kernel: [1491196.754521] type=1400 audit(1325232096.275:12572): avc:  denied  { read open } for  pid=24642 comm="xfsdump" name="init.d" dev=dm-1 ino=268794309 scontext=root:sysadm_r:cronjob_t tcontext=system_u:object_r:initrc_state_t tclass=dir

Running the script as unconfined_t doesnt work as it seems unconfined_t is not allowed when running the strict policy.

The backup is being performed by taking an LVM snapshot of root, mounting that snapshot, and then doing an xfsdump. It also backs up the /boot partition (ext2) into a tarball.

What is the proper way to perform such a backup?
Is there a way to mount the filesystem where the file contexts can be backed up, but will not be enforced? But also for academic purposes, if I want to back up a system where such a mount isnt possible (already mounted and not possible to remount), how would that be accomplished?

share|improve this question
add comment

2 Answers

You need to be more specific and tell us what distro/policy you are running, some allow for "unconfined" processes which would satisfy your needs (man runcon), others do not - in which case you would have to either label your backup script with an SELinux type that allows read access to all files OR create a new application policy for it (hard).

Edit: I assume you've already read SELinux FAQ entry on backup: use star

share|improve this answer
    
unconfined_t is not allowed. Creating a policy would be unfeasable since any time a new file context is introduced, the policy would have to be modified. –  Patrick Dec 31 '11 at 23:30
1  
still don't know your distro and policy (type and version). there may well be a backup_t type of some sort already.. –  totaam Jan 1 '12 at 6:44
    
Policy is the one most distros use; oss.tresys.com/projects/refpolicy version 2.20110726 (gentoo, though shouldnt matter since the policy isnt gentoo specific). Also, in regards to the edit on the FAQ, yes though I still prefer xfsdump as its faster than star. –  Patrick Jan 1 '12 at 7:25
1  
The reference policy is the base used by most (all?) distros, but there is a lot more to it than that. Gentoo also does do a fair amount of tweaking. You should probably read at the very least this section: policy types. This is the sort of information people need in order to be able to help you. Depending on your needs, a targeted policy may offer a better balance of security vs maintenance cost. –  totaam Jan 1 '12 at 15:08
    
The answer ended up having nothing to do with gentoo at all. This is why I wasnt providing that bit of information. –  Patrick Jan 2 '12 at 5:14
add comment
up vote 0 down vote accepted

There is a backup policy module that can be used which provides a backup_t and allows system backups. Its part of tresys refpolicy, http://oss.tresys.com/projects/clip/browser/trunk/refpolicy/src/selinux-policy-clip/policy/modules/admin/backup.te

After installing, just set the file context of the backup script to backup_exec_t and it'll be able to access the whole system.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.