-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 03/06/2014 07:07 PM, SilverTip257 wrote:
On Wed, Mar 5, 2014 at 10:19 AM, Daniel J Walsh dwalsh@redhat.com wrote:
man zebra_selinux
Thank you for the quick reply.
~]# man zebra_selinux No manual entry for zebra_selinux
This is a rather basic (headless) install of CentOS 5.10 from the netinstall ISO. I haven't ripped out any default selinux pieces, so should I really be missing that manpage?
~]# cat /etc/*ele* cat: /etc/lsb-release.d: Is a directory CentOS release 5.10 (Final)
~]# apropos selinux | egrep 'zebra|quagga'
If I remove the pipe to egrep, I do see squid_selinux for example.
... If you want to allow zebra daemon to write it configuration files, you must turn on the zebra_write_config boolean. Disabled by default.
setsebool -P zebra_write_config 1
// before ~]# getsebool -a | grep zebra allow_zebra_write_config --> on zebra_disable_trans --> off
Apparently the command from the Bugzilla ticket I linked to earlier took and already had allow_zebra_write_config enabled. setsebool -P allow_zebra_write_config=1
// trying to set that selinux boolean comes back with ~]# setsebool -P zebra_write_config 1 libsemanage.dbase_llist_set: record not found in the database libsemanage.dbase_llist_set: could not set record value Could not change boolean zebra_write_config Could not change policy booleans
On an selinux, but different topic... I had to modify the user (role and type were right) to allow dnsmasq to write to /var/log/dnsmasq.log ~]# chcon -v --user=system_u --role=object_r --type=var_log_t /var/log/dnsmasq.log This may or may not be the best/proper way, but appears to have fixed the dnsmasq logging + selinux clash.
And now to apply that to my quagga/zebra + selinux situation... // before ~]# ls -Z /etc/quagga/ | egrep '(zebra|vtysh).conf' -rw-r----- quagga quaggavt root:object_r:zebra_conf_t vtysh.conf -rwxr-x--- quagga quaggavt system_u:object_r:zebra_conf_t vtysh.conf.sample -rw------- quagga quagga root:object_r:zebra_conf_t zebra.conf -rw-r--r-- root root system_u:object_r:zebra_conf_t zebra.conf.sample -rw-r----- quagga quaggavt root:object_r:zebra_conf_t zebra.conf.sav
~]# chcon -v --user=system_u /etc/quagga/vtysh.conf /etc/quagga/zebra.conf /etc/quagga/zebra.conf.sav
// after ~]# ls -Z /etc/quagga/ | egrep '(zebra|vtysh).conf' -rw-r----- quagga quaggavt system_u:object_r:zebra_conf_t vtysh.conf -rwxr-x--- quagga quaggavt system_u:object_r:zebra_conf_t vtysh.conf.sample -rw------- quagga quagga system_u:object_r:zebra_conf_t zebra.conf -rw-r--r-- root root system_u:object_r:zebra_conf_t zebra.conf.sample -rw-r----- quagga quaggavt system_u:object_r:zebra_conf_t zebra.conf.sav
// but no dice ... # write Building Configuration... Can't open configuration file /etc/quagga/zebra.conf.ZHwkuk. [OK]
~]# tail /var/log/audit/audit.log | grep zebra | audit2why ... type=AVC msg=audit(1394150156.203:30): avc: denied { add_name } for pid=3111 comm="zebra" name="zebra.conf.fT434c" scontext=root:system_r:zebra_t:s0 tcontext=system_u:object_r:zebra_conf_t:s0 tclass=dir Was caused by: Missing or disabled TE allow rule. Allow rules may exist but be disabled by boolean settings; check boolean settings. You can see the necessary allow rules by running audit2allow with this audit message as input.
~]# tail /var/log/audit/audit.log | grep zebra | audit2allow
#============= zebra_t ============== allow zebra_t zebra_conf_t:dir add_name;
What am I doing wrong here? ( missing manpage , still AVC denied )
I'm learning a thing or two about SELinux with each bump in the road it presents to me. Thanks for the help and for bearing with me. ;)
Introduced in RHEL6 not in Rhel5 sorry