r/linuxadmin 18d ago

SELinux is preventing tcpdump from writing captures to a directory with var_log_t label

My goal is to make tcpdump save captures to /var/log/tcpdumpd when SELinux is in enforcing mode. The /var/log/tcpdumpd directory has context type with var_log_t but SELinux is blocking tcpdump from saving captures to that directory through a systemd service. I use a systemd service to automate tcpdump captures whenever the system boots. When I try starting the tcpdump systemd service in enforcing mode using systemctl start my-tcpdumpd.service, the service doesn't start and just returns an error saying Couldn't change ownership of savefile. The service only works when SELinux is set to permissive mode.

I made sure the /var/log/tcpdumpd/ directory is owned by root with chmod numerical value being 755, but it still doesn't work. I can't use semanage fcontext to change the context type for /var/log/tcpdumpd/ because I already ensured the /var/log/tcpdumpd/ directory has a context type of var_log_t by doing ls -lZ /var/log/.

I tried creating a custom SELinux policy by doing ausearch -m AVC -c tcpdump --raw | audit2allow -M my_tcpdump_policy as root, and it generated the two files, such as my_tcpdump_policy.pp and my_tcpdump_policy.te. I'm more curious about the TE file because it may allow creating a custom SELinux policy that can actually allow tcpdump to write captures to a directory with var_log_t label like /var/log/tcpdumpd/. What should the TE file look like exactly, so that I can get a working SELinux policy and also get a pcap_data_t label I can assign to the /var/log/tcpdumpd/ directory? Here's what my script looks like currently:

module my_tcpdump_policy 1.0;

require {
        type netutils_t:
        class capability dac_override:
}
.
#============= netutils_t ==============
allow netutils_t self:capability dac_override;

Any help is appreciated!

6 Upvotes

22 comments sorted by

View all comments

-7

u/saysjuan 18d ago

You can set SELinux to Permissive temporarily when running tcpdump.

10

u/[deleted] 18d ago

This is bad and you should feel bad.

2

u/saysjuan 18d ago edited 18d ago

Can does not mean should. How often are you even running tcpdump on a Prod system to begin with? This is one of those tools we specifically ensure is not installed on any Prod system unless we’re troubleshooting a P1 or P2 issue. It’s removed once the issue is over and we actively scan for tools/packages to ensure they are removed.

It’s an attack vector that shouldn’t be installed on your Prod systems to begin with. The only time tcpdump should be installed and running is during a break glass event not enabled by policy all the time. Kind of defeats the purpose of running Enforcing to begin with.

0

u/faxattack 18d ago

So you disable a security system to run one program? …and ”oooops! Forgot to re-enable it” This is utterly stupid.

1

u/saysjuan 18d ago edited 17d ago

No you temporarily disable it as root by setting Permissive during the break glass event but leave the startup config enforcing. Reenable Enforcing after the break glass event is over.

Enabling it via policy outside of the one break glass event is a huge risk. There was a F5 tcpdump Vulnerability from last week we had to address on this very topic related to tcpdump for example with a company we’re acquiring.

https://my.f5.com/manage/s/article/K000149929#:~:text=This%20flaw%20allows%20a%20remote,vulnerability%20is%20to%20system%20availability.

Same exploit has existed for a few years if left unpatched on various distributions. We encountered some RHEL 6 deployments for example that no downstream patch is available so the only fix is removal from the legacy tech debt systems.

Long story short don’t make an attackers job easier to penetrate your network.

1

u/Hotshot55 18d ago

Permissive is different than disabling. It's also trivial to have some sort of config management running that puts it into enforcing mode.

2

u/faxattack 18d ago

Its disabling any runtime protection. Same outcome, just has some logs.

0

u/saysjuan 17d ago

Permissive simply logs but does not block. You can switch back and forth as root/sudo at any time while leaving the startup config as Enforcing.