1

I need to upload to aws from logrotate. When the logrotate is triggered the SELinux blocking it.

The error line is

 type=AVC msg=audit(1562162502.670:101127): avc:  denied  { 
 name_connect } for  pid=21146 comm="aws" dest=3129 
 scontext=system_u:system_r:logrotate_t:s0-s0:c0.c1023 
 tcontext=system_u:object_r:netport_port_t:s0 tclass=tcp_socket

With the audit2allow I got the following lines

 allow logrotate_t http_port_t:tcp_socket name_connect;
 allow logrotate_t netport_port_t:tcp_socket name_connect;

But I cant make a selinux command from there. To generate a binary policy is not an option.

System : centos

Improve this question

1 Answer 1

Reset to default
0

Create a module using audit2allow -a -M module_name. Once created you can install it using semodule -i module_name.

Improve this answer
1
  • thanks. I would do it version controlled. Store binary is not the case
    – GergA
    Jul 25, 2019 at 8:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .