Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 441614

Summary: sec-policy/selinux-openvpn-2.20120725-r6: unable to write logs
Product: Gentoo Linux Reporter: Vincent Brillault <gentoo>
Component: SELinuxAssignee: Sven Vermeulen (RETIRED) <swift>
Status: VERIFIED FIXED    
Severity: minor CC: selinux
Priority: Normal    
Version: unspecified   
Hardware: All   
OS: Linux   
Whiteboard: sec-policy r8
Package list:
Runtime testing required: ---

Description Vincent Brillault 2012-11-03 20:35:28 UTC
The current openvpn policy allows openvpn_t to manage_dirs, append_files, create_files and setattr_files on openvpn_var_log_t but it doesn't allow it to 'write' on those files.

The status file of openvpn (option status in the configuration file) is not a log file in which logs are appended but rewritten, thus which need 'write'.

Example avc: 
avc:  denied  { write } for  pid=23436 comm="openvpn" name="openvpn-status.log" dev="sda1" ino=560037 scontext=staff_u:system_r:openvpn_t tcontext=system_u:object_r:openvpn_var_log_t tclass=file
Comment 1 Sven Vermeulen (RETIRED) gentoo-dev 2012-11-10 16:45:29 UTC
Is this only for the openvpn-status.log file?
Comment 2 Sven Vermeulen (RETIRED) gentoo-dev 2012-11-10 16:59:21 UTC
As per the IRC chat:

this is only for openvpn-status.log, which is not really a log file but a status file. So it might make sense to use a different type for this (like openvpn_status_t). As the openvpn-status.log file is, by default, in the openvpn log location, we can use a named file transition to make sure this file, if created, always has the right context.
Comment 3 Sven Vermeulen (RETIRED) gentoo-dev 2012-11-14 19:59:21 UTC
Care to try out the following?

"""
policy_module(extraopenvpn, 0.1)

gen_require(`
  type openvpn_var_log_t;
  type openvpn_t;
')

type openvpn_status_t;
files_log_file(openvpn_status_t)

manage_files_pattern(openvpn_t, openvpn_var_log_t, openvpn_status_t)
logging_log_filetrans(openvpn_t, openvpn_status_t, file, "openvpn-status.log")
"""

Load in this policy, perhaps even remove the openvpn-status.log file and try it again. It *should* automatically save the file as openvpn_status_t (cfr the filetrans) and have write privileges on it (the manage_files_pattern).

To ensure that the type isn't relabeled with a system relabel, you might need to run:

semanage fcontext -a -t openvpn_status_t "/var/log/openvpn/openvpn-status.log"

or whatever the path is to the openvpn-status.log file.

If it works, and I add it to the policy, you will get a failure when you load the new policy in (duplicate definition of openvpn_status). When that occurs, remember to remove the extraopenvpn  (semodule -r extraopenvpn) and retry.
Comment 4 Vincent Brillault 2012-11-17 15:32:57 UTC
Thanks for the module. I just replaced files_log_file with logging_log_file because I don't have such an interface in my SELinux installation. It works well: the new status file have the right type and openvpn can write in it :)


For the file context, I didn't add anything yet. In my installation, the status file appears direclty in /var/log/ (no sub-directory). Do you think you could replace, in the current policy:
'''
/var/log/openvpn.*      gen_context(system_u:object_r:openvpn_var_log_t,s0)
'''
with:
'''
/var/log/openvpn-status.log -- gen_context(system_u:object_r:openvpn_status_t,s0)
/var/log/openvpn.*      gen_context(system_u:object_r:openvpn_var_log_t,s0)
'''
or something like:
'''
/var/log/(.*/)?openvpn-status.log -- gen_context(system_u:object_r:openvpn_status_t,s0)
/var/log/openvpn.*      gen_context(system_u:object_r:openvpn_var_log_t,s0)
'''
?
Comment 5 Sven Vermeulen (RETIRED) gentoo-dev 2012-11-18 08:26:55 UTC
Fixed in repo, will be in r8
Comment 6 Sven Vermeulen (RETIRED) gentoo-dev 2012-11-23 21:42:39 UTC
r8 in hardened-dev overlay
Comment 7 Sven Vermeulen (RETIRED) gentoo-dev 2012-12-03 09:37:13 UTC
r8 is now in main tree, ~arch
Comment 8 Sven Vermeulen (RETIRED) gentoo-dev 2012-12-13 10:14:52 UTC
r8 is now stable