Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

So I've set up selinux to log all file access operations in a certain directory. Here's some sample log output when doing an ls from sftp:

type=AVC msg=audit(1338465611.221:356): avc:  granted  { getattr } for  pid=5973 comm="sftp-server" path="/polog" dev=dm-0 ino=1966081 scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:polog_t:s0 tclass=dir

sftp in this case is running as user1, is there a way to have selinux log this username as well or should I be taking a different approach?

Here's my policy files:


policy_module(polog, 1.0.14)

require {
    type fs_t;
        type unconfined_t;
        type sshd_t;
        type setfiles_t;
        class filesystem associate;
        class dir relabelto;

type polog_t;

#============= polog_t ==============

allow polog_t fs_t:filesystem associate;
allow unconfined_t polog_t:dir relabelto;
allow setfiles_t polog_t:dir relabelto;


auditallow unconfined_t polog_t : file *;
auditallow unconfined_t polog_t : dir *;

allow unconfined_t polog_t : file *;
allow unconfined_t polog_t : dir *;


/polog(/.*)?            gen_context(system_u:object_r:polog_t)
share|improve this question
AFAIK your answer is fedorahosted.org/setroubleshoot – Pavel Šimerda May 10 '14 at 22:35

SELinux does not work with classic DAC usernames, and thus you won't be able to display that kind of information this way. You should have a look at the audit subsystem and the auditd daemon. You will have to write a specific set of rules (not SELinux related) to log access to those files.

Some links to help you get started:

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.