Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a daemon that uses syslog(3) to log to a file that is not a descendant of /var/log. Currently, this requires that SELINUX be disabled. How can I configure an enabled SELINUX to allow this logging?

I am an SELINUX novice. Any guidance or advice would be appreciated.

share|improve this question

migrated from stackoverflow.com Jun 13 '13 at 22:40

This question came from our site for professional and enthusiast programmers.

    
Belongs on unix.stackexchange.com – Cory Klein Jun 13 '13 at 16:52
    
Cory, good idea. Done. Curious to see which exchange answers first. – Steve Emmerson Jun 13 '13 at 17:00

You have to change the context of your logging directory. For example you want to log into /mnt/extranal/log instead of /var/log.

So you have to set SELinux type for /mnt/external/log to var_log_t as well as the /var/log already has.

Check

ls -Z /var

with result

drwxr-xr-x. root root system_u:object_r:var_log_t:s0   log

prepare your log directory

mkdir /mnt/external/log

prepare rules for labeling FS by SELinux

semanage fcontext -a -t var_log_t /mnt/external/log

invoke relabeling of your directory

restorecon -v /mnt/external/log

if you've done, check

ls -Z /mnt/external

with result

drwxr-xr-x. root root system_u:object_r:var_log_t:s0   log

That's all if you don't use MLS/MCS policy.

See more details on

https://docs.fedoraproject.org/en-US/Fedora/12/html/Security-Enhanced_Linux/sect-Security-Enhanced_Linux-Working_with_SELinux-SELinux_Contexts_Labeling_Files.html

https://docs.fedoraproject.org/en-US/Fedora/11/html/Security-Enhanced_Linux/sect-Security-Enhanced_Linux-SELinux_Contexts_Labeling_Files-Persistent_Changes_semanage_fcontext.html

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .