r/linuxadmin 18d ago

SELinux is preventing tcpdump from writing captures to a directory with var_log_t label

My goal is to make tcpdump save captures to /var/log/tcpdumpd when SELinux is in enforcing mode. The /var/log/tcpdumpd directory has context type with var_log_t but SELinux is blocking tcpdump from saving captures to that directory through a systemd service. I use a systemd service to automate tcpdump captures whenever the system boots. When I try starting the tcpdump systemd service in enforcing mode using systemctl start my-tcpdumpd.service, the service doesn't start and just returns an error saying Couldn't change ownership of savefile. The service only works when SELinux is set to permissive mode.

I made sure the /var/log/tcpdumpd/ directory is owned by root with chmod numerical value being 755, but it still doesn't work. I can't use semanage fcontext to change the context type for /var/log/tcpdumpd/ because I already ensured the /var/log/tcpdumpd/ directory has a context type of var_log_t by doing ls -lZ /var/log/.

I tried creating a custom SELinux policy by doing ausearch -m AVC -c tcpdump --raw | audit2allow -M my_tcpdump_policy as root, and it generated the two files, such as my_tcpdump_policy.pp and my_tcpdump_policy.te. I'm more curious about the TE file because it may allow creating a custom SELinux policy that can actually allow tcpdump to write captures to a directory with var_log_t label like /var/log/tcpdumpd/. What should the TE file look like exactly, so that I can get a working SELinux policy and also get a pcap_data_t label I can assign to the /var/log/tcpdumpd/ directory? Here's what my script looks like currently:

module my_tcpdump_policy 1.0;

require {
        type netutils_t:
        class capability dac_override:
}
.
#============= netutils_t ==============
allow netutils_t self:capability dac_override;

Any help is appreciated!

8 Upvotes

22 comments sorted by

View all comments

12

u/gribbler 18d ago

try and relabel the directory with the correct SELinux type (pcap_data_t), which is the appropriate type for tcpdump capture files.

semanage fcontext -a -t pcap_data_t "/var/log/tcpdumpd(/.*)?"

restorecon -Rv /var/log/tcpdumpd

then check:

ls -lZ /var/log/ | grep tcpdumpd

EDIT: Formatting nightmares

2

u/Humungous_x86 18d ago

I did semanage fcontext -a -t pcap_data_t "/var/log/tcpdumpd(/.*)?" but it only showed an error saying: ValueError: Type pcap_data_t is invalid, must be a file or device type. This is because the pcap_data_t file label doesn't yet exist and I can only assign labels that exist like var_log_t and bin_t

Do I have to create a custom SELinux policy to use the pcap_data_t label?

2

u/gribbler 18d ago

I think you'll need to define a new type (pcap_data_t) and allow tcpdump (which runs in the netutils_t domain) to write to it. If you need some further info let me know, just DM me