Home / server / Questions / 718309
Accepted
Soviero
Asked: 2015-09-02 05:49:45 +0800 CST

Unable to enable custom SELinux rule

  • 772

logrotate is unable to rotate a log file for our application on CentOS 7. This appears to be because of this AVC error:

type=AVC msg=audit(1441112694.305:19502): avc:  denied  { write } for  pid=9146 comm="logrotate" name="autuitive.log" dev="xvda1" ino=26262388 scontext=system_u:system_r:logrotate_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:usr_t:s0 tclass=file

I passed the error to the audit2allow utility to create a rule to allow it, but when I try to enable the rule, I get the following error:

[root@app1 ~]# semodule -i logrotate.pp
libsepol.print_missing_requirements: logrotate's global requirements were not met: type/attribute logrotate_t (No such file or directory).
libsemanage.semanage_link_sandbox: Link packages failed (No such file or directory).
semodule:  Failed!

Here is the rule itself that was generated:

[root@app1 ~]# cat logrotate.te 

module logrotate 1.0;

require {
    type logrotate_t;
    type usr_t;
    class file write;
}

#============= logrotate_t ==============
allow logrotate_t usr_t:file write;
centos7

1 Answers

  1. Best Answer

    I think this is caused because there will already be a logrotate.pp file on the system (/etc/selinux/targeted/modules/active/modules/logrotate.pp).

    You should create your local policy with a different name e.g.

    audit2allow -M MY_logrotate <somefilewithmessages

    then use 

    semodule -i MY_logrotate.pp

    to install it. Yeah it's not the best of error messages.

    • 7