On Mon, 2009-02-09 at 09:22 -0500, Steve wrote:
> I am attempting to figure out why my dhclient process sometimes gets the correct hostname from the server and sometimes it doesn't. I want to do this by turning on logging and sending the output to a temp file. I am running F9 and so I changed the line in /etc/sysconfig/network-scripts/ifup-eth from:
>
> if /sbin/dhclient ${DHCLIENTARGS} ${DEVICE}; then
> if /sbin/dhclient ${DHCLIENTARGS} ${DEVICE} > /var/log/dhclient.log 2>&1; then
>
> after changing the DHCLIENTARGS switch -q to -v. When this runs at boot time I get an empty /var/log/dhclient.log file. When I try to run dhclient manually I get a SELinux denial:
>
> SELinux is preventing dhclient (dhcpc_t) "write" to /var/log/dhclient.log (var_log_t).
>
> OK, that makes sense so what do I have to modify to allow the log file to be written? This is just temporary so I'm hoping that I don't have to modify policies, rule files etc, etc. The simplest thing I can think of is to change to permissive mode but is there a better way?
>
> Here is the raw data:
>
> Source Context: unconfined_u:system_r:dhcpc_t:SystemLow-SystemHigh
> Target Context: system_u:object_r:var_log_t
> Target Objects: /var/log/dhclient.log [ file ]
> Source: dhclient
> Source Path: /sbin/dhclient
> Port: <Unknown>
> Host: localhost.localdomain
> Source RPM Packages: dhclient-4.0.0-22.fc9
> Target RPM Packages:
> Policy RPM: selinux-policy-3.3.1-119.fc9
> Selinux Enabled: True
> Policy Type: targeted
> MLS Enabled: True
> Enforcing Mode: Enforcing
> Plugin Name: mislabeled_file
> Host Name: localhost.localdomain
> Platform: Linux localhost.localdomain 2.6.27.12-78.2.8.fc9.x86_64 #1 SMP Mon Jan 19 19:25:03 EST 2009 x86_64 x86_64
> Alert Count: 1
> First Seen: Fri 06 Feb 2009 10:15:51 AM EST
> Last Seen: Fri 06 Feb 2009 10:15:51 AM EST
> Local ID: f7b088b4-ffa8-4a8a-bd23-e075bf806d23
> Line Numbers:
>
> Raw Audit Messages :node=localhost.localdomain type=AVC msg=audit(1233933351.918:23): avc: denied { write } for pid=3311 comm="dhclient" path="/var/log/dhclient.log" dev=dm-0 ino=49873259 scontext=unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_log_t:s0 tclass=file
>
> node=localhost.localdomain type=AVC msg=audit(1233933351.918:23): avc: denied { write } for pid=3311 comm="dhclient" path="/var/log/dhclient.log" dev=dm-0 ino=49873259 scontext=unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_log_t:s0 tclass=file
>
> node=localhost.localdomain type=SYSCALL msg=audit(1233933351.918:23): arch=c000003e syscall=59 success=yes exit=0 a0=1ba6ba0 a1=1ba70e0 a2=1b8eba0 a3=3ff9d67a70 items=0 ppid=3175 pid=3311 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=1 comm="dhclient" exe="/sbin/dhclient" subj=unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023 key=(null)
Label the log file with a type to which dhcpc_t can already write, e.g.
chcon -t dhcpc_tmp_t /var/log/dhclient.log
--
Stephen Smalley
National Security Agency
--
fedora-selinux-list mailing list
fedora-selinux-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/fedora-selinux-list
