0

There is an attached device on the motherboard and the NTP service tries to read data from it (the attached device link is in /dev directory). Using SELinux enforcing, the service status errors that it has not permission to access the device. Setting SELinux to disabled, solve the problem but it's not the standrad way to do that.

I know someone should create a new SELinux policy in such situations. Assuming the NTP service tries to read /dev/gps0, can somebody give an example on how to write a SELinux rule for that?

  • Out of curiosity, what label is applied to /dev/gps0 (you can view using ls -Z /dev/gps0)? – sebasth Oct 3 '18 at 7:31
  • @sebasth lrwxrwxrwx root root ? /dev/gps0 -> ttyUSB0 – Soheil Pourbafrani Oct 3 '18 at 7:33
  • You should use SELinux in permissive mode, instead of disabling it. In permissive mode rules are not enforced, but logs are generated. Can you enable SELinux in permissive mode and check the label again? (I recommend checking the link before you proceed) – sebasth Oct 3 '18 at 7:36
2

Generally, when dealing with SELinux and standard services included in RHEL/CentOS distribution, you should first read the appropriate <servicename>_selinux man page.

In this case, on RHEL 7 at least, ntpd's SELinux policy includes SELinux file type label gpsd_tmpfs_t, which suggests that the policy might have built-in support for ntpd communicating with GPS devices via gpsd. Setting up gpsd and then communication between it and ntpd might be the way to keep the tightest possible SELinux policy while using a GPS device with ntpd.

Alternatively, you can use semanage permissive -a ntpd_t to switch SELinux to permissive mode for the ntpd process only.

When in permissive mode, you can then find the messages referring to /dev/gps0 or /dev/ttyUSB0 in the audit logs (see /var/log/audit) and feed them to the audit2allow tool. It should tell you the exact SELinux policy changes needed to allow ntpd to access the GPS device directly.

  • Thanks, I found this in audit.log file: type=AVC msg=audit(1538395083.420:527): avc: denied { read write } for pid=19160 comm="ntpd" name="ttyUSB0" dev="devtmpfs" ino=60814 scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:usbtty_device_t:s0 tclass=chr_file. How can I use it to apply on SELinux policy? – Soheil Pourbafrani Oct 3 '18 at 8:55
  • You can use audit2allow as explained in the answer. – sebasth Oct 3 '18 at 9:12
  • After the command semanage permissive -a ntpd_t, how can I revert SELinux settings for ntpd? I tried semanage enforcing -a ntpd_t but it didn't work! – Soheil Pourbafrani Oct 3 '18 at 10:53
  • To remove the type-specific permissive setting, use semanage permissive -d ntpd_t. See man semanage-permissive for details. – telcoM Oct 3 '18 at 12:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.