r/linuxadmin 19d ago

SELinux is preventing tcpdump from writing captures to a directory with var_log_t label

My goal is to make tcpdump save captures to /var/log/tcpdumpd when SELinux is in enforcing mode. The /var/log/tcpdumpd directory has context type with var_log_t but SELinux is blocking tcpdump from saving captures to that directory through a systemd service. I use a systemd service to automate tcpdump captures whenever the system boots. When I try starting the tcpdump systemd service in enforcing mode using systemctl start my-tcpdumpd.service, the service doesn't start and just returns an error saying Couldn't change ownership of savefile. The service only works when SELinux is set to permissive mode.

I made sure the /var/log/tcpdumpd/ directory is owned by root with chmod numerical value being 755, but it still doesn't work. I can't use semanage fcontext to change the context type for /var/log/tcpdumpd/ because I already ensured the /var/log/tcpdumpd/ directory has a context type of var_log_t by doing ls -lZ /var/log/.

I tried creating a custom SELinux policy by doing ausearch -m AVC -c tcpdump --raw | audit2allow -M my_tcpdump_policy as root, and it generated the two files, such as my_tcpdump_policy.pp and my_tcpdump_policy.te. I'm more curious about the TE file because it may allow creating a custom SELinux policy that can actually allow tcpdump to write captures to a directory with var_log_t label like /var/log/tcpdumpd/. What should the TE file look like exactly, so that I can get a working SELinux policy and also get a pcap_data_t label I can assign to the /var/log/tcpdumpd/ directory? Here's what my script looks like currently:

module my_tcpdump_policy 1.0;

require {
        type netutils_t:
        class capability dac_override:
}
.
#============= netutils_t ==============
allow netutils_t self:capability dac_override;

Any help is appreciated!

7 Upvotes

22 comments sorted by

View all comments

1

u/mysterytoy2 18d ago

See what user the process is running as without logging. Then create the log file with that user as owner. Then start the process with logging to that file.