9

I have a daemon that uses syslog(3) to log to a file that is not a descendant of /var/log. Currently, this requires that SELINUX be disabled. How can I configure an enabled SELINUX to allow this logging?

I am an SELINUX novice. Any guidance or advice would be appreciated.

2
  • PSA - stopdisablingselinux.com
    – 0xSheepdog
    Commented Nov 20, 2017 at 18:41
  • @0xSheepdog: whoever owns that website should update their TLS configuration. My current browsers refuse to open the website.
    – Tommiie
    Commented Nov 25, 2020 at 13:26

1 Answer 1

11

If you look at the context set for the directory /var/log you'll noticed the following things.

First, the directory /var/log has the following selinux context set:

$ ls -Z /var | grep "log$"
drwxr-xr-x. root root    system_u:object_r:var_log_t:s0   log

Second, the log file, /var/log/messages, has no additional context:

$ ls -Z /var/log/messages
-rw------- root root ?                                /var/log/messages

So it would seem that you only need to set a context similar to the one on /var/log on whatever directory you're planning on writing this additional log file to. Something like this should do it.

Method #1: replicating selinux label

Below will copy the context that's associated with /var/log and apply it to /opt/blah as well.

$ mkdir /opt/blah
$ ls -Z /opt | grep blah
drwxr-xr-x  root root ?                                   blah

# label directory with context
$ chcon --reference /var/log /opt/blah

# see the newly added context
$ ls -Z /opt/ | grep blah
drwxr-xr-x. root root    system_u:object_r:var_log_t:s0   blah

Method #2: applying context directly

You can also apply them directly like so:

$ chcon system_u:object_r:var_log_t:s0 /opt/blah

I'm away from a system where I can confirm the need to run these commands but I believe you need to tell SELinux to pick up these newly applied contexts to the filesystem as well.

$ semanage fcontext -a -t var_log_t "/opt(/.*)?"
$ restorecon -R -v /opt

confirm changes

# confirm identical to /var/log context
$ ls -Z /var/ | grep "log$"
drwxr-xr-x. root root    system_u:object_r:var_log_t:s0   log

References

2
  • Where are the actual commands? I only see comments like # label directory with context
    – lorenzog
    Commented May 25, 2016 at 15:02
  • @lorenzog - The command are everything that come after a $. That's demarkation for a prompt. Everything w/ a # is a comment.
    – slm
    Commented May 21, 2021 at 6:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .