Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 441614 - sec-policy/selinux-openvpn-2.20120725-r6: unable to write logs
Summary: sec-policy/selinux-openvpn-2.20120725-r6: unable to write logs
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: SELinux (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Sven Vermeulen (RETIRED)
Whiteboard: sec-policy r8
Depends on:
Reported: 2012-11-03 20:35 UTC by Vincent Brillault
Modified: 2012-12-13 10:14 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Note You need to log in before you can comment on or make changes to this bug.
Description Vincent Brillault 2012-11-03 20:35:28 UTC
The current openvpn policy allows openvpn_t to manage_dirs, append_files, create_files and setattr_files on openvpn_var_log_t but it doesn't allow it to 'write' on those files.

The status file of openvpn (option status in the configuration file) is not a log file in which logs are appended but rewritten, thus which need 'write'.

Example avc: 
avc:  denied  { write } for  pid=23436 comm="openvpn" name="openvpn-status.log" dev="sda1" ino=560037 scontext=staff_u:system_r:openvpn_t tcontext=system_u:object_r:openvpn_var_log_t tclass=file
Comment 1 Sven Vermeulen (RETIRED) gentoo-dev 2012-11-10 16:45:29 UTC
Is this only for the openvpn-status.log file?
Comment 2 Sven Vermeulen (RETIRED) gentoo-dev 2012-11-10 16:59:21 UTC
As per the IRC chat:

this is only for openvpn-status.log, which is not really a log file but a status file. So it might make sense to use a different type for this (like openvpn_status_t). As the openvpn-status.log file is, by default, in the openvpn log location, we can use a named file transition to make sure this file, if created, always has the right context.
Comment 3 Sven Vermeulen (RETIRED) gentoo-dev 2012-11-14 19:59:21 UTC
Care to try out the following?

policy_module(extraopenvpn, 0.1)

  type openvpn_var_log_t;
  type openvpn_t;

type openvpn_status_t;

manage_files_pattern(openvpn_t, openvpn_var_log_t, openvpn_status_t)
logging_log_filetrans(openvpn_t, openvpn_status_t, file, "openvpn-status.log")

Load in this policy, perhaps even remove the openvpn-status.log file and try it again. It *should* automatically save the file as openvpn_status_t (cfr the filetrans) and have write privileges on it (the manage_files_pattern).

To ensure that the type isn't relabeled with a system relabel, you might need to run:

semanage fcontext -a -t openvpn_status_t "/var/log/openvpn/openvpn-status.log"

or whatever the path is to the openvpn-status.log file.

If it works, and I add it to the policy, you will get a failure when you load the new policy in (duplicate definition of openvpn_status). When that occurs, remember to remove the extraopenvpn  (semodule -r extraopenvpn) and retry.
Comment 4 Vincent Brillault 2012-11-17 15:32:57 UTC
Thanks for the module. I just replaced files_log_file with logging_log_file because I don't have such an interface in my SELinux installation. It works well: the new status file have the right type and openvpn can write in it :)

For the file context, I didn't add anything yet. In my installation, the status file appears direclty in /var/log/ (no sub-directory). Do you think you could replace, in the current policy:
/var/log/openvpn.*      gen_context(system_u:object_r:openvpn_var_log_t,s0)
/var/log/openvpn-status.log -- gen_context(system_u:object_r:openvpn_status_t,s0)
/var/log/openvpn.*      gen_context(system_u:object_r:openvpn_var_log_t,s0)
or something like:
/var/log/(.*/)?openvpn-status.log -- gen_context(system_u:object_r:openvpn_status_t,s0)
/var/log/openvpn.*      gen_context(system_u:object_r:openvpn_var_log_t,s0)
Comment 5 Sven Vermeulen (RETIRED) gentoo-dev 2012-11-18 08:26:55 UTC
Fixed in repo, will be in r8
Comment 6 Sven Vermeulen (RETIRED) gentoo-dev 2012-11-23 21:42:39 UTC
r8 in hardened-dev overlay
Comment 7 Sven Vermeulen (RETIRED) gentoo-dev 2012-12-03 09:37:13 UTC
r8 is now in main tree, ~arch
Comment 8 Sven Vermeulen (RETIRED) gentoo-dev 2012-12-13 10:14:52 UTC
r8 is now stable