Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

So I've set up selinux to log all file access operations in a certain directory. Here's some sample log output when doing an ls from sftp:

type=AVC msg=audit(1338465611.221:356): avc:  granted  { getattr } for  pid=5973 comm="sftp-server" path="/polog" dev=dm-0 ino=1966081 scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:polog_t:s0 tclass=dir

sftp in this case is running as user1, is there a way to have selinux log this username as well or should I be taking a different approach?

Here's my policy files:

---polog.te---

policy_module(polog, 1.0.14)

require {
    type fs_t;
        type unconfined_t;
        type sshd_t;
        type setfiles_t;
        class filesystem associate;
        class dir relabelto;
}

type polog_t;

#============= polog_t ==============

allow polog_t fs_t:filesystem associate;
allow unconfined_t polog_t:dir relabelto;
allow setfiles_t polog_t:dir relabelto;

#====================================

auditallow unconfined_t polog_t : file *;
auditallow unconfined_t polog_t : dir *;

allow unconfined_t polog_t : file *;
allow unconfined_t polog_t : dir *;

---polog.fc---

/polog(/.*)?            gen_context(system_u:object_r:polog_t)
share|improve this question
add comment

Know someone who can answer? Share a link to this question via email, Google+, Twitter, or Facebook.

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.