0

I have a an application which is run as a systemd service on RHEL7 that makes use of the system journal for logging. To ease monitoring of this application I have configured rsyslogd to write logs from this service (only) to a dedicated log file.

I would now like to serve this log file using httpd so that users can easily monitor the application.

The problem I am facing is that no matter how I setup the file contexts it seems selinux will prevent me from doing what I want:

  • rsyslog is allowed to write to var_log_t
  • httpd is allowed to read from httpd_sys_content_t

As far as I can tell there is no context that will allow writing by rsyslogd and reading from httpd.

What can I do to get around this problem? Will I end up needing to create a custom policy module?

  • If the need is simple, write a custom rule, see syslogng/logstash/filebeat – Rui F Ribeiro Jul 17 '17 at 8:05
0

You can check if a boolean exists to allow the access using audit2why, in which case you do not need to create a custom policy module.

If no such boolean exists, to allow apache to read the logs you need to append the policy. With audit2allow you can create the policy module directly or create the required rules you can use as template for your module.

First you need to generate the logs containing access violations. To get all the access violations during the normal use, set httpd_t to permissive mode. In permissive mode SELinux policy is not enforced for the specified type (httpd_t), but logs will be generated as usual:

semanage permissive -a httpd_t

After you have verified your configuration works and you can access the logs with Apache, turn enforcing mode back on:

semanage permissive -d httpd_t

Now use audit2allow to generate the new module and insert it:

audit2allow -a -M apache_logs
semodule -i apache_logs.pp

If you want to be sure audit messages only related to httpd_t are used for creating the module, grep the relevant lines from audit log and use it as input for audit2allow. For example:

grep "httpd_t" /var/log/audit/audit.log | audit2allow -M apache_logs

If you want to manually verify or modify the rules generated by audit2allow, generate the module in source format using -m option. You can verify and edit the generated module source if you wish. After you are done, you need to build the module. Steps are demonstrated in the man page example.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.