Warning
audit2allow
utility.
audit2allow
utility gathers information from logs of denied operations and then generates SELinux policy allow rules.
[29] After analyzing denial messages as per Section 10.10.3.7, “sealert Messages”, and if no label changes or Booleans allowed access, use audit2allow
to create a local policy module. When access is denied by SELinux, running audit2allow
generates Type Enforcement rules that allow the previously denied access.
audit2allow
to create a policy module:
/var/log/audit/audit.log
file:
type=AVC msg=audit(1226270358.848:238): avc: denied{ write }
for pid=13349comm="certwatch"
name="cache" dev=dm-0 ino=218171 scontext=system_u:system_r:certwatch_t:s0tcontext=system_u:object_r:var_t:s0
tclass=dir type=SYSCALL msg=audit(1226270358.848:238): arch=40000003 syscall=39 success=no exit=-13 a0=39a2bf a1=3ff a2=3a0354 a3=94703c8 items=0 ppid=13344 pid=13349 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="certwatch" exe="/usr/bin/certwatch" subj=system_u:system_r:certwatch_t:s0 key=(null)
var_t
type. Analyze the denial message as per Section 10.10.3.7, “sealert Messages”. If no label changes or Booleans allowed access, use audit2allow
to create a local policy module.
audit2allow
utility reads /var/log/audit/audit.log
, and as such, must be run as the root user:
~]#
audit2allow -w -a
type=AVC msg=audit(1226270358.848:238): avc: denied { write } for pid=13349 comm="certwatch" name="cache" dev=dm-0 ino=218171 scontext=system_u:system_r:certwatch_t:s0 tcontext=system_u:object_r:var_t:s0 tclass=dir Was caused by: Missing type enforcement (TE) allow rule. You can use audit2allow to generate a loadable module to allow this access.
-a
command-line option causes all audit logs to be read. The -w
option produces the human-readable description. As shown, access was denied due to a missing Type Enforcement rule.
~]#
audit2allow -a
#============= certwatch_t ============== allow certwatch_t var_t:dir write;
Important
Fedora
product, and select the selinux-policy
component. Include the output of the audit2allow -w -a
and audit2allow -a
commands in such bug reports.
audit2allow -a
, run the following command as root to create a custom module. The -M
option creates a Type Enforcement file (.te
) with the name specified with -M
, in your current working directory:
~]#
audit2allow -a -M mycertwatch
******************** IMPORTANT *********************** To make this policy package active, execute: semodule -i mycertwatch.pp
audit2allow
compiles the Type Enforcement rule into a policy package (.pp
):
~]#
ls
mycertwatch.pp mycertwatch.te
~]#
semodule -i mycertwatch.pp
Important
audit2allow
may allow more access than required. It is recommended that policy created with audit2allow
be posted to the upstream SELinux list for review. If you believe there is a bug in the policy, please create a bug in Red Hat Bugzilla.
grep
utility to narrow down the input for audit2allow
. The following example demonstrates using grep
to only send denial messages related to certwatch
through audit2allow
:
~]#
grep certwatch /var/log/audit/audit.log | audit2allow -R -M mycertwatch2
******************** IMPORTANT *********************** To make this policy package active, execute: semodule -i mycertwatch2.pp