Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a daemon that uses syslog(3) to log to a file that is not a descendant of /var/log. Currently, this requires that SELINUX be disabled. How can I configure an enabled SELINUX to allow this logging?

I am an SELINUX novice. Any guidance or advice would be appreciated.

share|improve this question
up vote 1 down vote accepted

If you look at the context set for the directory /var/log you'll noticed the following things.

First, the directory /var/log has the following selinux context set:

$ ls -Z /var | grep "log$"
drwxr-xr-x. root root    system_u:object_r:var_log_t:s0   log

Second, the log file, /var/log/messages, has no additional context:

$ ls -Z /var/log/messages
-rw------- root root ?                                /var/log/messages

So it would seem that you only need to set a context similar to the one on /var/log on whatever directory you're planning on writing this additional log file to. Something like this should do it.

Method #1: replicating selinux label

Below will copy the context that's associated with /var/log and apply it to /opt/blah as well.

$ mkdir /opt/blah
$ ls -Z /opt | grep blah
drwxr-xr-x  root root ?                                   blah

# label directory with context
$ chcon --reference /var/log /opt/blah

# see the newly added context
$ ls -Z /opt/ | grep blah
drwxr-xr-x. root root    system_u:object_r:var_log_t:s0   blah

Method #2: applying context directly

You can also apply them directly like so:

$ chcon system_u:object_r:var_log_t:s0 /opt/blah

I'm away from a system where I can confirm the need to run these commands but I believe you need to tell SELinux to pick up these newly applied contexts to the filesystem as well.

$ semanage fcontext -a -t var_log_t "/opt(/.*)?"
$ restorecon -R -v /opt

confirm changes

# confirm identical to /var/log context
$ ls -Z /var/ | grep "log$"
drwxr-xr-x. root root    system_u:object_r:var_log_t:s0   log

References

share|improve this answer
    
Where are the actual commands? I only see comments like # label directory with context – lorenzog May 25 at 15:02
    
@lorenzog - thanks fixed. – slm May 25 at 15:25

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.