5

I'm using Fedora Workstation 27 Live OS in which I want to run a custom service EnableBIOS.service along with OS boot. For this to work, I have to disable SELinux which is causing a problem in my environment. So, I can't disable SELinux.

As an alternative, I tried creating a SELinux policy for my custom service but didn't get any break-through.

The service is logging below message in /var/log/audit/audit.log:

type=SERVICE_START msg=audit(1527782475.777:239): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=EnableHBA comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
type=AVC msg=audit(1527782475.779:240): avc:  denied  { execute } for  pid=4223 comm="(leHBA.sh)" name="enableHBA.sh" dev="dm-0" ino=38164 scontext=system_u:system_r:init_t:s0 tcontext=unconfined_u:object_r:admin_home_t:s0 tclass=file permissive=0
type=SERVICE_STOP msg=audit(1527782475.782:241): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=EnableHBA comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed'

and, 

[root@localserver]# audit2allow -w -a
type=AVC msg=audit(1527782475.779:240): avc:  denied  { execute } for  pid=4223 comm="(leHBA.sh)" name="enableHBA.sh" dev="dm-0" ino=38164 scontext=system_u:system_r:init_t:s0 tcontext=unconfined_u:object_r:admin_home_t:s0 tclass=file permissive=0
        Was caused by:
                Unknown - would be allowed by active policy
                Possible mismatch between this policy and the one under which the audit message was generated.

                Possible mismatch between current in-memory boolean settings vs. permanent ones.

For creating SELinux policy, I executed below commands:

[root@localserver]# grep enableHBA /var/log/audit/audit.log | audit2allow -M enablehba
[root@localserver]# semodule -i enablehba.pp

After doing this, I tried to run my service again and the message logged was:

[root@localserver]# audit2allow -w -a
type=AVC msg=audit(1527782959.912:250): avc:  denied  { read open } for  pid=4612 comm="(leHBA.sh)" path="/root/enableHBA/enableHBA.sh" dev="dm-0" ino=38164 scontext=system_u:system_r:init_t:s0 tcontext=unconfined_u:object_r:admin_home_t:s0 tclass=file permissive=0
        Was caused by:
                Missing type enforcement (TE) allow rule.

                You can use audit2allow to generate a loadable module to allow this access.

I want to know where I'm doing wrong or is there any other way to achieve my requirement.

Improve this question

1 Answer 1

Reset to default
5

Move your script into /usr/local/sbin and check that the script is properly labeled as bin_t

The script should run unconfined and have all the privileges it needs

Improve this answer
3
  • After the OS was up and running, I moved the script to /usr/local/sbin/ and checked the label unconfined_u:object_r:bin_t:s0 enableHBA.sh and the service is running fine. However, if I'm doing the same changes in ISO image and booting with that, the label changes to system_u:object_r:unlabeled_t:s0 enableHBA.sh. Any idea, how to change this label within ISO itself as I can boot my OS only once.
    – Amit24x7
    Jun 1, 2018 at 9:28
  • 1
    I'm not sure that an ISO file system supports the xattrs needed to do the labeling of the files. You could look at the different "context" options that can be passed to mount when mounting the root filesystem (see mount(8) manpage)
    – Bigon
    Jun 1, 2018 at 9:57
  • Thanks for the heads-up, it really helped. I'm making changes only after mounting the ISO, I agree with your suggestions to use the 'context' options but I'm not sure whether it will help me or not. Any other idea would also be appreciated.
    – Amit24x7
    Jun 1, 2018 at 12:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .