temp files & debugging

[Dominick Grift]

On Mon, 2009-02-09 at 09:22 -0500, Steve wrote:
> type=AVC msg=audit(1233933351.918:23): avc: denied { write } for
> pid=3311 comm="dhclient" path="/var/log/dhclient.log" dev=dm-0
> ino=49873259 scontext=unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023
> tcontext=system_u:object_r:var_log_t:s0 tclass=file 

There are some ways to do this, one of which you already mentioned:
setenforce 0/1

Another way is "permissive domains": semanage permissive -a/-d dhcpc_t

Yet another way to allow *this explicit* access is to let audit2allow
create a quick policy and install that: echo "type=AVC
msg=audit(1233933351.918:23): avc: denied { write } for pid=3311
comm="dhclient" path="/var/log/dhclient.log" dev=dm-0 ino=49873259
scontext=unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023
tcontext=system_u:object_r:var_log_t:s0 tclass=file" | audit2allow -M
mydhcpc; sudo semodule -i/-r mydhcpc.pp

And the *proper* way to allow this is to create a custom module for this
access:

mkdir ~/mydhcpc; cd ~/mydhcpc;
echo "policy_module(mydhcpc, 0.0.1)" > mydhcpc.te;
echo "require { type dhcpc_t; }" >> mydhcpc.te;
echo "type dhcpc_var_log_t;" >> mydhcpc.te;
echo "logging_log_file(dhcpc_var_log_t)" >> mydhcpc.te;
echo "allow dhcpc_t dhcpc_var_log_t:file manage_files_pattern;" >>
mydhcpc.te;
echo "logging_log_filetrans(dhcpc_t, dhcpc_var_log_t, file)" >>
mydhcpc.te;
echo "/var/log/dhclient.log --
gen_context(system_u:object_r:dhcpc_var_log_t, s0)" > mydhcpc.fc;

make -f /usr/share/selinux/devel/Makefile
sudo semodule -i mydhcpc.pp
sudo restorecon -v /var/log/dhclient.log

(sudo semodule -r mydhcpc.pp to uninstall)

caution: mind the line breaks.
disclaimer: examples may have syntax errors or typo's.

hth, Dominick