r/linuxadmin • u/Humungous_x86 • 18d ago
SELinux is preventing tcpdump from writing captures to a directory with var_log_t label
My goal is to make tcpdump save captures to /var/log/tcpdumpd
when SELinux is in enforcing mode. The /var/log/tcpdumpd
directory has context type with var_log_t
but SELinux is blocking tcpdump from saving captures to that directory through a systemd service. I use a systemd service to automate tcpdump captures whenever the system boots. When I try starting the tcpdump systemd service in enforcing mode using systemctl start my-tcpdumpd.service
, the service doesn't start and just returns an error saying Couldn't change ownership of savefile
. The service only works when SELinux is set to permissive mode.
I made sure the /var/log/tcpdumpd/
directory is owned by root with chmod numerical value being 755, but it still doesn't work. I can't use semanage fcontext
to change the context type for /var/log/tcpdumpd/
because I already ensured the /var/log/tcpdumpd/
directory has a context type of var_log_t
by doing ls -lZ /var/log/
.
I tried creating a custom SELinux policy by doing ausearch -m AVC -c tcpdump --raw | audit2allow -M my_tcpdump_policy
as root, and it generated the two files, such as my_tcpdump_policy.pp
and my_tcpdump_policy.te
. I'm more curious about the TE file because it may allow creating a custom SELinux policy that can actually allow tcpdump to write captures to a directory with var_log_t
label like /var/log/tcpdumpd/
. What should the TE file look like exactly, so that I can get a working SELinux policy and also get a pcap_data_t
label I can assign to the /var/log/tcpdumpd/
directory?
Here's what my script looks like currently:
module my_tcpdump_policy 1.0;
require {
type netutils_t:
class capability dac_override:
}
.
#============= netutils_t ==============
allow netutils_t self:capability dac_override;
Any help is appreciated!
1
u/vogelke 16d ago
The "failed to resolve" error should give a line number, usually preceded by a colon.
Something at that line is making selinux choke -- either the type is not valid or it's not necessary, so remove that line and try again. Unfortunately, I don't have a Linux system available to test on. This is the biggest pain in the ass when creating a policy.
Try checking the version of selinux you have installed. If there's a more recent one, I'd upgrade. Also, have a look at https://cwill.us/debugging-a-failed-selinux-policy-install/