Re: Questions about SELinux

Hello, Robert.

Do you have the package "app-admin/setools" installed? If so, you can run
"cat /var/log/audit/audit.log | audit2why" to get an explanation of why the
denials occur, with suggestions for fixing them.

Of course, if your system is logging AVC denials elsewhere, adjust the
command accordingly.

Care to give that a try and output a result or two from it?

HTH,
Brant

On Nov 12, 2016 11:45, "Robert Sharp" <selinux-/[email protected]> wrote:

Hi there,

is this the best place to raise questions about SELinux, or would I be
better trying chat? I am making a big effort to get to enforcing strict on
a simple server and I am struggling a little.

For example, I run Rsyslog and I have lots of AVCs concerning denied
sendto's to /dev/log. The target context is usually sysadm_t, which does
not seem right, and I also notice that Rsyslog is in the same context. I
would expect it to be in a context involving syslog somehow. I have
restarted the service from the sysadm_r role and it makes no difference.
Also, I do not get asked to authenticate when starting the service, whereas
other services require this, and, there is no entry for rsyslog in
rc-status display despite it being installed in the default runlevel.

Example AVCs:

type=AVC msg=audit(1478957011.808:1910): avc:  denied  { sendto } for
pid=6043 comm="smtp" path="/dev/log" scontext=system_u:system_r:postfix_smtp_t
tcontext=staff_u:sysadm_r:sysadm_t tclass=unix_dgram_socket permissive=1

type=AVC msg=audit(1478953126.199:1909): avc:  denied  { sendto } for
pid=5949 comm="cleanup" path="/dev/log"
scontext=system_u:system_r:postfix_cleanup_t
tcontext=staff_u:sysadm_r:sysadm_t tclass=unix_dgram_socket permissive=1

type=AVC msg=audit(1478952507.872:1907): avc:  denied  { sendto } for
pid=3099 comm="krb5kdc" path="/dev/log" scontext=system_u:system_r:krb5kdc_t
tcontext=staff_u:sysadm_r:sysadm_t tclass=unix_dgram_socket permissive=1


There does not appear to be any specific rsyslog selinux package so I
assume it should all be syslog-related and already in the core policy
(although I cannot find it there). I also note that Red Hat has a page on
setting up Rsyslog in SELinux so I feel fairly sure it should work. It only
tells you how to change the ports, however. I am using TCP on port 514 but
I don't think I need to do anything according to RH.

Have I missed something, done something fundamentally wrong, or just need
to add something to stop the AVCs? Not keen on blindly fixing things so I
want to know what I need to do and why before I do it.

Thanks in anticipation,
Robert Sharp