3

When I run audit2why to see why there is a failure when trying to upload files via SCP to folder /foo/bar on a remote server which results in access denied to folder /foo/bar, I get the following text:

 

Was caused by:
                Unknown - would be allowed by active policy
                Possible mismatch between this policy and the one 
under which the audit message was generated.

                Possible mismatch between current in-memory 
boolean settings vs. permanent ones.

 

I know that this is definitely being caused by SELinux as when I run the command:

setenforce 0

I can upload the files via SCP to /foo/bar. Also of note, if I SSH in and cd to folder /foo/bar with SELinux enabled I can create a file in this folder.

 

How would I debug to see what is causing the exact issue within SELinux?

EDIT

Here is the output of ls -lZ of /foo/bar

drwxrwx--T. root foo-users user_u:object_r:default_t:s0     bar

and the output of an AVC denial from audit2allow

type=AVC msg=audit(1519304988.434:6984): avc:  denied  { write } for  pid=26506 comm="scp" name="event-20180203.log.gz" dev="dm-4" ino=7260 scontext=user_u:user_r:user_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=file
    Was caused by:
        Unknown - would be allowed by active policy
        Possible mismatch between this policy and the one under which the audit message was generated.
|improve this question
  • 1
    This is most probably caused by incompatible label on destination directory. May you post the denial AVC ( sudo grep denied /var/log/audit/audit.log ) or the result of audit2allow result ? – tonioc Feb 22 '18 at 17:04
  • due to the nature of the work, I can not post a word for word one, but I can post a full line with names changed if that would work? @tonioc – jgr208 Feb 22 '18 at 17:14
  • The important bits in the log are the security contexts for files/process. The file context for /foo/bar would also be useful. – sebasth Feb 22 '18 at 17:19
  • @tonioc added the output from an AVC denial – jgr208 Feb 22 '18 at 17:53
  • @sebasth added the context for the /foo/bar folder gotten from ls -lZ – jgr208 Feb 22 '18 at 17:53
2

what AVC says:

$ echo "type=AVC msg=audit(1519304988.434:6984): avc:  denied  { write } for  pid=26506 comm="scp" name="event-20180203.log.gz" dev="dm-4" ino=7260 scontext=user_u:user_r:user_t:s0 tcontext=user_u:object_r:default_t:s0 tclass=file" |audit2allow     
#============= user_t ==============
#!!!! WARNING: 'default_t' is a base type.
allow user_t default_t:file write;

==> A process running in user_t SElinux context type is trying to write to a directory having default_t type.

Alternatives to fix this are either:

  • relabel destination directory to permit user_t writing to it:

    $ sesearch -s user_t --allow |grep " file.*write"

    will show allowed target context for file write operation. For example, foo/bar might be relabelled to ssh_home_t which is in permitted list:

    $ sudo chcon -R -t ssh_home_t /foo/bar

  • or if you can, change the destination directory to a permitted one.

  • or create a new rule using audit2allow to bypass the control, but this opens permissions, breaking the SELinux aim, so should be the last choice. 'see http://selinuxproject.org/page/Audit2allowRecipe )

|improve this answer
0
Unknown - would be allowed by active policy
Possible mismatch between this policy and the one 
under which the audit message was generated.

I got the same message after having applied a corrective policy. All the previous audited avc could not be explained since the new policy would have permit them.
Check if newer events still occurs.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.