0

There is an attached device on the motherboard and the NTP service tries to read data from it (the attached device link is in /dev directory). Using SELinux enforcing, the service status errors that it has not permission to access the device. Setting SELinux to disabled, solve the problem but it's not the standrad way to do that.

I know someone should create a new SELinux policy in such situations. Assuming the NTP service tries to read /dev/gps0, can somebody give an example on how to write a SELinux rule for that?

3
  • Out of curiosity, what label is applied to /dev/gps0 (you can view using ls -Z /dev/gps0)?
    – sebasth
    Oct 3, 2018 at 7:31
  • @sebasth lrwxrwxrwx root root ? /dev/gps0 -> ttyUSB0 Oct 3, 2018 at 7:33
  • You should use SELinux in permissive mode, instead of disabling it. In permissive mode rules are not enforced, but logs are generated. Can you enable SELinux in permissive mode and check the label again? (I recommend checking the link before you proceed)
    – sebasth
    Oct 3, 2018 at 7:36

1 Answer 1

2

Generally, when dealing with SELinux and standard services included in RHEL/CentOS distribution, you should first read the appropriate <servicename>_selinux man page.

In this case, on RHEL 7 at least, ntpd's SELinux policy includes SELinux file type label gpsd_tmpfs_t, which suggests that the policy might have built-in support for ntpd communicating with GPS devices via gpsd. Setting up gpsd and then communication between it and ntpd might be the way to keep the tightest possible SELinux policy while using a GPS device with ntpd.

Alternatively, you can use semanage permissive -a ntpd_t to switch SELinux to permissive mode for the ntpd process only.

When in permissive mode, you can then find the messages referring to /dev/gps0 or /dev/ttyUSB0 in the audit logs (see /var/log/audit) and feed them to the audit2allow tool. It should tell you the exact SELinux policy changes needed to allow ntpd to access the GPS device directly.

4
  • Thanks, I found this in audit.log file: type=AVC msg=audit(1538395083.420:527): avc: denied { read write } for pid=19160 comm="ntpd" name="ttyUSB0" dev="devtmpfs" ino=60814 scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:usbtty_device_t:s0 tclass=chr_file. How can I use it to apply on SELinux policy? Oct 3, 2018 at 8:55
  • You can use audit2allow as explained in the answer.
    – sebasth
    Oct 3, 2018 at 9:12
  • After the command semanage permissive -a ntpd_t, how can I revert SELinux settings for ntpd? I tried semanage enforcing -a ntpd_t but it didn't work! Oct 3, 2018 at 10:53
  • To remove the type-specific permissive setting, use semanage permissive -d ntpd_t. See man semanage-permissive for details.
    – telcoM
    Oct 3, 2018 at 12:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .