So I've set up selinux to log all file access operations in a certain directory. Here's some sample log output when doing an ls from sftp:
type=AVC msg=audit(1338465611.221:356): avc: granted { getattr } for pid=5973 comm="sftp-server" path="/polog" dev=dm-0 ino=1966081 scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:polog_t:s0 tclass=dir
sftp in this case is running as user1, is there a way to have selinux log this username as well or should I be taking a different approach?
Here's my policy files:
---polog.te---
policy_module(polog, 1.0.14)
require {
type fs_t;
type unconfined_t;
type sshd_t;
type setfiles_t;
class filesystem associate;
class dir relabelto;
}
type polog_t;
#============= polog_t ==============
allow polog_t fs_t:filesystem associate;
allow unconfined_t polog_t:dir relabelto;
allow setfiles_t polog_t:dir relabelto;
#====================================
auditallow unconfined_t polog_t : file *;
auditallow unconfined_t polog_t : dir *;
allow unconfined_t polog_t : file *;
allow unconfined_t polog_t : dir *;
---polog.fc---
/polog(/.*)? gen_context(system_u:object_r:polog_t)