9

I have a daemon that uses syslog(3) to log to a file that is not a descendant of /var/log. Currently, this requires that SELINUX be disabled. How can I configure an enabled SELINUX to allow this logging?

I am an SELINUX novice. Any guidance or advice would be appreciated.

2
  • PSA - stopdisablingselinux.com
    – 0xSheepdog
    Nov 20, 2017 at 18:41
  • @0xSheepdog: whoever owns that website should update their TLS configuration. My current browsers refuse to open the website.
    – Tommiie
    Nov 25, 2020 at 13:26

1 Answer 1

11

If you look at the context set for the directory /var/log you'll noticed the following things.

First, the directory /var/log has the following selinux context set:

$ ls -Z /var | grep "log$"
drwxr-xr-x. root root    system_u:object_r:var_log_t:s0   log

Second, the log file, /var/log/messages, has no additional context:

$ ls -Z /var/log/messages
-rw------- root root ?                                /var/log/messages

So it would seem that you only need to set a context similar to the one on /var/log on whatever directory you're planning on writing this additional log file to. Something like this should do it.

Method #1: replicating selinux label

Below will copy the context that's associated with /var/log and apply it to /opt/blah as well.

$ mkdir /opt/blah
$ ls -Z /opt | grep blah
drwxr-xr-x  root root ?                                   blah

# label directory with context
$ chcon --reference /var/log /opt/blah

# see the newly added context
$ ls -Z /opt/ | grep blah
drwxr-xr-x. root root    system_u:object_r:var_log_t:s0   blah

Method #2: applying context directly

You can also apply them directly like so:

$ chcon system_u:object_r:var_log_t:s0 /opt/blah

I'm away from a system where I can confirm the need to run these commands but I believe you need to tell SELinux to pick up these newly applied contexts to the filesystem as well.

$ semanage fcontext -a -t var_log_t "/opt(/.*)?"
$ restorecon -R -v /opt

confirm changes

# confirm identical to /var/log context
$ ls -Z /var/ | grep "log$"
drwxr-xr-x. root root    system_u:object_r:var_log_t:s0   log

References

2
  • Where are the actual commands? I only see comments like # label directory with context
    – lorenzog
    May 25, 2016 at 15:02
  • @lorenzog - The command are everything that come after a $. That's demarkation for a prompt. Everything w/ a # is a comment.
    – slm
    May 21, 2021 at 6:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.