I have a cron job that is backing up a SELinux system running in strict mode. The problem is that SELinux wants to deny access to to the backup script since it wants access to every single file on the filesystem (and all the contexts on those files). I'm running in permissive mode right now so the script works, but I would like to turn permissive mode off.

kernel: [1491196.754521] type=1400 audit(1325232096.275:12572): avc:  denied  { read open } for  pid=24642 comm="xfsdump" name="init.d" dev=dm-1 ino=268794309 scontext=root:sysadm_r:cronjob_t tcontext=system_u:object_r:initrc_state_t tclass=dir

Running the script as unconfined_t doesn't work as it seems unconfined_t is not allowed when running the strict policy.

The backup is being performed by taking an LVM snapshot of root, mounting that snapshot, and then doing an xfsdump. It also backs up the /boot partition (ext2) into a tarball.

What is the proper way to perform such a backup?
Is there a way to mount the filesystem where the file contexts can be backed up, but will not be enforced? But also for academic purposes, if I want to back up a system where such a mount isn't possible (already mounted and not possible to remount), how would that be accomplished?


You need to be more specific and tell us what distro/policy you are running, some allow for "unconfined" processes which would satisfy your needs (man runcon), others do not - in which case you would have to either label your backup script with an SELinux type that allows read access to all files OR create a new application policy for it (hard).

Edit: I assume you've already read SELinux FAQ entry on backup: use star

  • unconfined_t is not allowed. Creating a policy would be unfeasable since any time a new file context is introduced, the policy would have to be modified. – Patrick Dec 31 '11 at 23:30
  • 1
    still don't know your distro and policy (type and version). there may well be a backup_t type of some sort already.. – totaam Jan 1 '12 at 6:44
  • Policy is the one most distros use; oss.tresys.com/projects/refpolicy version 2.20110726 (gentoo, though shouldnt matter since the policy isnt gentoo specific). Also, in regards to the edit on the FAQ, yes though I still prefer xfsdump as its faster than star. – Patrick Jan 1 '12 at 7:25
  • 1
    The reference policy is the base used by most (all?) distros, but there is a lot more to it than that. Gentoo also does do a fair amount of tweaking. You should probably read at the very least this section: policy types. This is the sort of information people need in order to be able to help you. Depending on your needs, a targeted policy may offer a better balance of security vs maintenance cost. – totaam Jan 1 '12 at 15:08
  • The answer ended up having nothing to do with gentoo at all. This is why I wasnt providing that bit of information. – Patrick Jan 2 '12 at 5:14

There is a backup policy module that can be used which provides a backup_t and allows system backups. Its part of tresys refpolicy, http://oss.tresys.com/projects/clip/browser/trunk/refpolicy/src/selinux-policy-clip/policy/modules/admin/backup.te

After installing, just set the file context of the backup script to backup_exec_t and it'll be able to access the whole system.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.