Contents
How to create a SELinux policy for a custom service?
As an alternative, I tried creating a SELinux policy for my custom service but didn’t get any break-through. The service is logging below message in /var/log/audit/audit.log:
How to query audit logs in SELinux red?
To query Audit logs, use the ausearch tool. Because the SELinux decisions, such as allowing or disallowing access, are cached and this cache is known as the Access Vector Cache (AVC), use the AVC and USER_AVC values for the message type parameter, for example: If there are no matches, check if the Audit daemon is running.
Why does SELinux not allow writing to files?
Therefore, we can conclude that we need to specify the proper SELinux permissions on directories in order to serve files on a custom directory and set another SELinux permissions to allow writing to file. Therefore, we can solve the original problem then.
How to create a new SELinux file context?
To create a new SELinux file contextto apply to a parent directory that holds files your program/daemon will modify, you edit the app.te file and add : type app_var_t; files_type(app_var_t)
Is there a way to disable SELinux in Linux?
For this to work, I have to disable SELinux which is causing a problem in my environment. So, I can’t disable SELinux. As an alternative, I tried creating a SELinux policy for my custom service but didn’t get any break-through.
Where are the security contexts stored in SELinux?
SELinux assigns a label, called security context, to every object (file, process, etc) in the system: Files have security context stored in extended attributes. These can be viewed with ls -Z. SELinux maintains a database mapping paths patterns to default file contexts.
How is SELinux used to restore default file contexts?
SELinux maintains a database mapping paths patterns to default file contexts. This database is used when you need to restore default file contexts manually or when the system is relabeled. This database can be queried with semanage tool.