Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I have a daemon that uses syslog(3) to log to a file that is not a descendant of /var/log. Currently, this requires that SELINUX be disabled. How can I configure an enabled SELINUX to allow this logging?

I am an SELINUX novice. Any guidance or advice would be appreciated.

share|improve this question

1 Answer 1

If you look at the context set for the directory /var/log you'll noticed the following things.

First, the directory /var/log has the following selinux context set:

$ ls -Z /var | grep "log$"
drwxr-xr-x. root root    system_u:object_r:var_log_t:s0   log

Second, the log file, /var/log/messages, has no additional context:

$ ls -Z /var/log/messages
-rw------- root root ?                                /var/log/messages

So it would seem that you only need to set a context similar to the one on /var/log on what ever directory you're planning on writing this additional log file to. Something like this should do it.

replicating selinux label

$ mkdir /opt/blah
$ ls -Z /opt | grep blah
drwxr-xr-x  root root ?                                   blah

# label directory with context
$ ls -Z /opt/ | grep blah
drwxr-xr-x. root root    system_u:object_r:var_log_t:s0   blah

confirm changes

# confirm identical to /var/log context
$ ls -Z /var/ | grep "log$"
drwxr-xr-x. root root    system_u:object_r:var_log_t:s0   log

References

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.