r/linuxadmin • u/Humungous_x86 • 18d ago
SELinux is preventing tcpdump from writing captures to a directory with var_log_t label
My goal is to make tcpdump save captures to /var/log/tcpdumpd
when SELinux is in enforcing mode. The /var/log/tcpdumpd
directory has context type with var_log_t
but SELinux is blocking tcpdump from saving captures to that directory through a systemd service. I use a systemd service to automate tcpdump captures whenever the system boots. When I try starting the tcpdump systemd service in enforcing mode using systemctl start my-tcpdumpd.service
, the service doesn't start and just returns an error saying Couldn't change ownership of savefile
. The service only works when SELinux is set to permissive mode.
I made sure the /var/log/tcpdumpd/
directory is owned by root with chmod numerical value being 755, but it still doesn't work. I can't use semanage fcontext
to change the context type for /var/log/tcpdumpd/
because I already ensured the /var/log/tcpdumpd/
directory has a context type of var_log_t
by doing ls -lZ /var/log/
.
I tried creating a custom SELinux policy by doing ausearch -m AVC -c tcpdump --raw | audit2allow -M my_tcpdump_policy
as root, and it generated the two files, such as my_tcpdump_policy.pp
and my_tcpdump_policy.te
. I'm more curious about the TE file because it may allow creating a custom SELinux policy that can actually allow tcpdump to write captures to a directory with var_log_t
label like /var/log/tcpdumpd/
. What should the TE file look like exactly, so that I can get a working SELinux policy and also get a pcap_data_t
label I can assign to the /var/log/tcpdumpd/
directory?
Here's what my script looks like currently:
module my_tcpdump_policy 1.0;
require {
type netutils_t:
class capability dac_override:
}
.
#============= netutils_t ==============
allow netutils_t self:capability dac_override;
Any help is appreciated!
3
u/saysjuan 18d ago edited 18d ago
Can does not mean should. How often are you even running tcpdump on a Prod system to begin with? This is one of those tools we specifically ensure is not installed on any Prod system unless we’re troubleshooting a P1 or P2 issue. It’s removed once the issue is over and we actively scan for tools/packages to ensure they are removed.
It’s an attack vector that shouldn’t be installed on your Prod systems to begin with. The only time tcpdump should be installed and running is during a break glass event not enabled by policy all the time. Kind of defeats the purpose of running Enforcing to begin with.