SELinux - Allow multiple services access to same /home/dir

Posted by Mike Purcell on Server Fault See other posts from Server Fault or by Mike Purcell
Published on 2012-10-01T17:46:05Z Indexed on 2012/10/01 21:40 UTC
Read the original article Hit count: 220

Filed under:
|
|

I currently have SELinux enabled and have been able to configure apache to allow access to /home/src/web with a chcon command granting the 'httpd_sys_content_t' type. But now I am trying to serve the rsyslogd.conf file from the same directory, but every time I start rsyslogd I see an entry in my audit log saying that rsyslogd was denied access. My question is, is it possible to grant two applications the ability to access the same directory, while still keeping SELinux enabled?

Current perms on /home/src:

drwxr-xr-x. src      src      unconfined_u:object_r:httpd_sys_content_t:s0 src

Audit log message:

type=AVC msg=audit(1349113476.272:1154): avc:  denied  { search } for  pid=9975 comm="rsyslogd" name="/" dev=dm-2 ino=2 scontext=unconfined_u:system_r:syslogd_t:s0 tcontext=system_u:object_r:home_root_t:s0 tclass=dir
type=SYSCALL msg=audit(1349113476.272:1154): arch=c000003e syscall=2 success=no exit=-13 a0=7f9ef0c027f5 a1=0 a2=1b6 a3=0 items=0 ppid=9974 pid=9975 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=30 comm="rsyslogd" exe="/sbin/rsyslogd" subj=unconfined_u:system_r:syslogd_t:s0 key=(null)

-- Edit --

Came across this post, which is sort of what I am trying to accomplish. However when I viewed the list of allowed sebool params, the only relating to syslog was: syslogd_disable_trans (SELinux Service Protection), seems like I can maintain the current SELinux 'type' on the /home/src/ dir, but set the bool on syslogd_disable_trans to false. I wonder if there is a better approach?

© Server Fault or respective owner

Related posts about linux

Related posts about selinux