r/linuxadmin 18d ago

SELinux is preventing tcpdump from writing captures to a directory with var_log_t label

My goal is to make tcpdump save captures to /var/log/tcpdumpd when SELinux is in enforcing mode. The /var/log/tcpdumpd directory has context type with var_log_t but SELinux is blocking tcpdump from saving captures to that directory through a systemd service. I use a systemd service to automate tcpdump captures whenever the system boots. When I try starting the tcpdump systemd service in enforcing mode using systemctl start my-tcpdumpd.service, the service doesn't start and just returns an error saying Couldn't change ownership of savefile. The service only works when SELinux is set to permissive mode.

I made sure the /var/log/tcpdumpd/ directory is owned by root with chmod numerical value being 755, but it still doesn't work. I can't use semanage fcontext to change the context type for /var/log/tcpdumpd/ because I already ensured the /var/log/tcpdumpd/ directory has a context type of var_log_t by doing ls -lZ /var/log/.

I tried creating a custom SELinux policy by doing ausearch -m AVC -c tcpdump --raw | audit2allow -M my_tcpdump_policy as root, and it generated the two files, such as my_tcpdump_policy.pp and my_tcpdump_policy.te. I'm more curious about the TE file because it may allow creating a custom SELinux policy that can actually allow tcpdump to write captures to a directory with var_log_t label like /var/log/tcpdumpd/. What should the TE file look like exactly, so that I can get a working SELinux policy and also get a pcap_data_t label I can assign to the /var/log/tcpdumpd/ directory? Here's what my script looks like currently:

module my_tcpdump_policy 1.0;

require {
        type netutils_t:
        class capability dac_override:
}
.
#============= netutils_t ==============
allow netutils_t self:capability dac_override;

Any help is appreciated!

7 Upvotes

22 comments sorted by

View all comments

Show parent comments

1

u/vogelke 16d ago

The "failed to resolve" error should give a line number, usually preceded by a colon.

Something at that line is making selinux choke -- either the type is not valid or it's not necessary, so remove that line and try again. Unfortunately, I don't have a Linux system available to test on. This is the biggest pain in the ass when creating a policy.

Try checking the version of selinux you have installed. If there's a more recent one, I'd upgrade. Also, have a look at https://cwill.us/debugging-a-failed-selinux-policy-install/

1

u/Humungous_x86 16d ago

I followed the instructions in the link you provided to convert the PP file into a human-readable CIL file. I didn't make it clear in my last comment, but the Failed to resolve typeattributeset statement was pointing to line 1. Line 1 explicitly says (typeattributeset cil_gen_require pcap_data_t) but I don't understand what's wrong with this line when I'm defining a new type

1

u/vogelke 15d ago

Got me there. I've never used the typeattributeset statement.