Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

So I've set up selinux to log all file access operations in a certain directory. Here's some sample log output when doing an ls from sftp:

type=AVC msg=audit(1338465611.221:356): avc:  granted  { getattr } for  pid=5973 comm="sftp-server" path="/polog" dev=dm-0 ino=1966081 scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:polog_t:s0 tclass=dir

sftp in this case is running as user1, is there a way to have selinux log this username as well or should I be taking a different approach?

Here's my policy files:

---polog.te---

policy_module(polog, 1.0.14)

require {
    type fs_t;
        type unconfined_t;
        type sshd_t;
        type setfiles_t;
        class filesystem associate;
        class dir relabelto;
}

type polog_t;

#============= polog_t ==============

allow polog_t fs_t:filesystem associate;
allow unconfined_t polog_t:dir relabelto;
allow setfiles_t polog_t:dir relabelto;

#====================================

auditallow unconfined_t polog_t : file *;
auditallow unconfined_t polog_t : dir *;

allow unconfined_t polog_t : file *;
allow unconfined_t polog_t : dir *;

---polog.fc---

/polog(/.*)?            gen_context(system_u:object_r:polog_t)
share|improve this question
    
AFAIK your answer is fedorahosted.org/setroubleshoot –  Pavel Šimerda May 10 at 22:35

1 Answer 1

SELinux does not work with classic DAC usernames, and thus you won't be able to display that kind of information this way. You should have a look at the audit subsystem and the auditd daemon. You will have to write a specific set of rules (not SELinux related) to log access to those files.

Some links to help you get started:

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.