I'm no selinux expert, and I got asked to figure out why all these audit logs were showing up in /var/log/messages that looked like this:
Jul 22 21:21:46 du-proc01 kernel: type=1400 audit(1469222506.799:118232): avc: denied { read } for pid=25450 comm="httpd" name="feed_status.json" dev=xvdj ino=4325992 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=system_u:object_r:var_t:s0 tclass=file
It turns out that my auditd daemon was dead and selinux was set to permissive mode. When selinux is in permissive mode, it writes permission failures, like the one above, to /var/log/audit/audit.log, or if auditd is dead to /var/log/messages.
After some interesting back and forth on slack, I wanted to know if there was an easy way to enable selinux, without causing a bunch of headaches for my colleagues. Yes, there is.
Selinux will run in permissive mode. When in permissive mode, selinux will log all access violations. Put selinux into permissive mode with the following:
setenforce 0
Then let your system run for a while. Or, if you have integration or acceptance tests, go ahead and run them. Try to execute all of the possible operations that might be blocked by selinux. You can generate a rule to fix all of your broken permissions with following command:
cat /var/log/audit/audit.log|audit2allow -m
That command will generate the rule in human readable form, so you can verify what rules would need to be added. To generate the module, run:
cat /var/log/audit/audit.log|audit2allow -M <module_name>
Where <module_name> makes sense to you. Once that is run, you can turn it on with
semodule -i <module_name>
If you generate the module with -M, there will be a file you can copy onto other machines. The .pp should be installed here:
/etc/selinux/targeted/modules/active/modules
Once you're satisfied with your module and your system isn't generating any selinux access denied messages you can start enforcing, but don't just re-enable selinux. You will need to relabel the file system
touch /.autorelabel
shutdown -r now
Then you can start enforcing:
setenforce 1
It's just that easy to take an existing system and get it working with selinux.
