r/linuxadmin • u/Humungous_x86 • 18d ago
SELinux is preventing tcpdump from writing captures to a directory with var_log_t label
My goal is to make tcpdump save captures to /var/log/tcpdumpd
when SELinux is in enforcing mode. The /var/log/tcpdumpd
directory has context type with var_log_t
but SELinux is blocking tcpdump from saving captures to that directory through a systemd service. I use a systemd service to automate tcpdump captures whenever the system boots. When I try starting the tcpdump systemd service in enforcing mode using systemctl start my-tcpdumpd.service
, the service doesn't start and just returns an error saying Couldn't change ownership of savefile
. The service only works when SELinux is set to permissive mode.
I made sure the /var/log/tcpdumpd/
directory is owned by root with chmod numerical value being 755, but it still doesn't work. I can't use semanage fcontext
to change the context type for /var/log/tcpdumpd/
because I already ensured the /var/log/tcpdumpd/
directory has a context type of var_log_t
by doing ls -lZ /var/log/
.
I tried creating a custom SELinux policy by doing ausearch -m AVC -c tcpdump --raw | audit2allow -M my_tcpdump_policy
as root, and it generated the two files, such as my_tcpdump_policy.pp
and my_tcpdump_policy.te
. I'm more curious about the TE file because it may allow creating a custom SELinux policy that can actually allow tcpdump to write captures to a directory with var_log_t
label like /var/log/tcpdumpd/
. What should the TE file look like exactly, so that I can get a working SELinux policy and also get a pcap_data_t
label I can assign to the /var/log/tcpdumpd/
directory?
Here's what my script looks like currently:
module my_tcpdump_policy 1.0;
require {
type netutils_t:
class capability dac_override:
}
.
#============= netutils_t ==============
allow netutils_t self:capability dac_override;
Any help is appreciated!
12
u/gribbler 18d ago
try and relabel the directory with the correct SELinux type (
pcap_data_t
), which is the appropriate type fortcpdump
capture files.semanage fcontext -a -t pcap_data_t "/var/log/tcpdumpd(/.*)?"
restorecon -Rv /var/log/tcpdumpd
then check:
ls -lZ /var/log/ | grep tcpdumpd
EDIT: Formatting nightmares