2

I'm using a RHEL machine with SELinux enabled.

I'd like to change the logfile position of auditd to /mydir/log/audit.log. I can apply the security context system_u:object_r:auditd_log_t:s0 to this file. However, what should be the security context of the directory /mydir/log and parent directory /mydir since they're going to be read/written by other daemons?

Or should I just go the least complicated way and do

semanage permissive -a auditd_t  

instead?

3

You're mostly there, you're using the semanage command. Since you already know that there's a correct context on /var/log/audit, the easiest thing is to set up a local selinux filecontext equivalence. So you'd run something like this:

semanage fcontext -a -e /var/log/audit /mydir/log

This tells SELinux to add (-a) a file context rule that says that /mydir/log will have all the equivalent (-e) file context as /var/log/audit. Once you've set the rule, you want to run restorecon -r -v /mydir/log to set the selinux attributes on /mydir/log to what the new policy wants.

4

You don't specify that you have disabled log rotation, so we still need to allow auditd to create multiple files.

More generally, you should keep the current structure of putting the audit logs in a dedicated audit directory, unless you are very confident about why you don't need to do so. Unless your version does not use that structure, because it is old? But at least RHEL 6 uses /var/log/audit/ by default.

Provided you don't allow anything to rename or change permissions of any of the ancestor directories, it is sufficiently restrictive to have auditd_log_t on audit.log and the audit log directory.

The above seems straightforward to fulfil. Then "sufficiently restrictive" would mean you can consider the security part of the decision solved. Just test whatever and see if it works, and then you'll know it is not too restrictive. I didn't notice any difficulty here, from the information you gave.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.