Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have a daemon that uses syslog(3) to log to a file that is not a descendant of /var/log. Currently, this requires that SELINUX be disabled. How can I configure an enabled SELINUX to allow this logging?

I am an SELINUX novice. Any guidance or advice would be appreciated.

share|improve this question

migrated from stackoverflow.com Jun 13 '13 at 22:40

This question came from our site for professional and enthusiast programmers.

    
Belongs on unix.stackexchange.com –  Cory Klein Jun 13 '13 at 16:52
    
Cory, good idea. Done. Curious to see which exchange answers first. –  Steve Emmerson Jun 13 '13 at 17:00
add comment

1 Answer

You have to change the context of your logging directory. For example you want to log into /mnt/extranal/log instead of /var/log.

So you have to set SELinux type for /mnt/external/log to var_log_t as well as the /var/log already has.

Check

ls -Z /var

with result

drwxr-xr-x. root root system_u:object_r:var_log_t:s0   log

prepare your log directory

mkdir /mnt/external/log

prepare rules for labeling FS by SELinux

semanage fcontext -a -t var_log_t /mnt/external/log

invoke relabeling of your directory

restorecon -v /mnt/external/log

if you've done, check

ls -Z /mnt/external

with result

drwxr-xr-x. root root system_u:object_r:var_log_t:s0   log

That's all if you don't use MLS/MCS policy.

See more details on

https://docs.fedoraproject.org/en-US/Fedora/12/html/Security-Enhanced_Linux/sect-Security-Enhanced_Linux-Working_with_SELinux-SELinux_Contexts_Labeling_Files.html

https://docs.fedoraproject.org/en-US/Fedora/11/html/Security-Enhanced_Linux/sect-Security-Enhanced_Linux-SELinux_Contexts_Labeling_Files-Persistent_Changes_semanage_fcontext.html

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.