/run/resolvconf/resolv.conf was dennied to access under SELinux Enforcing mode in Ubuntu 16.04
Clash Royale CLAN TAG#URR8PPP up vote
0
down vote
favorite
I'm running Ubuntu Xenial 16.04 in AWS EC2, I installed SELinux and change its mode to Enforcing. I've configured selinux type ssh_port_t to port 22. While I created port forwarding via ssh, I found the tunnel was not work properly.
In log file /var/log/syslog, it outputs
kernel: [ 311.860046] audit: type=1400 audit(1519664302.158:506): avc: denied getattr for pid=1367 comm="sshd" path="/run/resolvconf/resolv.conf" dev="tmpfs" ino=267 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:init_var_run_t:s0 tclass=file permissive=0
SELinux prohibited command sshd to access file /run/resolvconf/resolv.conf, this file is a soft link of /etc/resolv.conf
$ readlink -f /etc/resolv.conf
/run/resolvconf/resolv.conf
$ ls -Z /etc/resolv.conf
unconfined_u:object_r:etc_t:SystemLow /etc/resolv.conf
$ ls -Z /run/resolvconf/resolv.conf
system_u:object_r:init_var_run_t:SystemLow /run/resolvconf/resolv.conf
File /run/resolvconf/resolv.conf default type is init_var_run_t, I've tried changing it to type default_t, var_run_t, sshd_var_run_t via command
# sudo semanage fcontext -a -t $TYPE /var/run/resolvconf/resolv.conf
sudo semanage fcontext -m -t $TYPE /var/run/resolvconf/resolv.conf
sudo restorecon -F -R /run/resolvconf/resolv.conf
When I changed it to sshd_var_run_t, the tunnel works. But other utility also need to use file /run/resolvconf/resolv.conf, e.g. chronyd, this solution is not well.
If I change SELinux mode to permissive, the tunnel worked well, SELinux just logged dennied info into system log.
But my requirement is make the system work well in Enforcing mode. How should I deal with file /run/resolvconf/resolv.conf or what should I do to solve the problem.
server amazon-ec2 resolv.conf resolvconf selinux
asked Feb 26 at 19:12
Gorgon
1
add a comment |Â
up vote
0
down vote
favorite
I'm running Ubuntu Xenial 16.04 in AWS EC2, I installed SELinux and change its mode to Enforcing. I've configured selinux type ssh_port_t to port 22. While I created port forwarding via ssh, I found the tunnel was not work properly.
In log file /var/log/syslog, it outputs
kernel: [ 311.860046] audit: type=1400 audit(1519664302.158:506): avc: denied getattr for pid=1367 comm="sshd" path="/run/resolvconf/resolv.conf" dev="tmpfs" ino=267 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:init_var_run_t:s0 tclass=file permissive=0
SELinux prohibited command sshd to access file /run/resolvconf/resolv.conf, this file is a soft link of /etc/resolv.conf
$ readlink -f /etc/resolv.conf
/run/resolvconf/resolv.conf
$ ls -Z /etc/resolv.conf
unconfined_u:object_r:etc_t:SystemLow /etc/resolv.conf
$ ls -Z /run/resolvconf/resolv.conf
system_u:object_r:init_var_run_t:SystemLow /run/resolvconf/resolv.conf
File /run/resolvconf/resolv.conf default type is init_var_run_t, I've tried changing it to type default_t, var_run_t, sshd_var_run_t via command
# sudo semanage fcontext -a -t $TYPE /var/run/resolvconf/resolv.conf
sudo semanage fcontext -m -t $TYPE /var/run/resolvconf/resolv.conf
sudo restorecon -F -R /run/resolvconf/resolv.conf
When I changed it to sshd_var_run_t, the tunnel works. But other utility also need to use file /run/resolvconf/resolv.conf, e.g. chronyd, this solution is not well.
If I change SELinux mode to permissive, the tunnel worked well, SELinux just logged dennied info into system log.
But my requirement is make the system work well in Enforcing mode. How should I deal with file /run/resolvconf/resolv.conf or what should I do to solve the problem.
server amazon-ec2 resolv.conf resolvconf selinux
asked Feb 26 at 19:12
Gorgon
1
1
Just going to ask an obvious question, but is there a reason you need SELinux that the already-bundled AppArmor system isn't good enough for?
– Thomas Ward♦
Feb 26 at 19:15
1
Selinux is not well maintained on Ubuntu you will have to write policy yourself. I suggest you use apparmor or if you want selinux a ton system RHEL , Centos, or Fedora
– Panther
Feb 26 at 19:37
add a comment |Â
up vote
0
down vote
favorite
up vote
0
down vote
favorite
I'm running Ubuntu Xenial 16.04 in AWS EC2, I installed SELinux and change its mode to Enforcing. I've configured selinux type ssh_port_t to port 22. While I created port forwarding via ssh, I found the tunnel was not work properly.
In log file /var/log/syslog, it outputs
kernel: [ 311.860046] audit: type=1400 audit(1519664302.158:506): avc: denied getattr for pid=1367 comm="sshd" path="/run/resolvconf/resolv.conf" dev="tmpfs" ino=267 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:init_var_run_t:s0 tclass=file permissive=0
SELinux prohibited command sshd to access file /run/resolvconf/resolv.conf, this file is a soft link of /etc/resolv.conf
$ readlink -f /etc/resolv.conf
/run/resolvconf/resolv.conf
$ ls -Z /etc/resolv.conf
unconfined_u:object_r:etc_t:SystemLow /etc/resolv.conf
$ ls -Z /run/resolvconf/resolv.conf
system_u:object_r:init_var_run_t:SystemLow /run/resolvconf/resolv.conf
File /run/resolvconf/resolv.conf default type is init_var_run_t, I've tried changing it to type default_t, var_run_t, sshd_var_run_t via command
# sudo semanage fcontext -a -t $TYPE /var/run/resolvconf/resolv.conf
sudo semanage fcontext -m -t $TYPE /var/run/resolvconf/resolv.conf
sudo restorecon -F -R /run/resolvconf/resolv.conf
When I changed it to sshd_var_run_t, the tunnel works. But other utility also need to use file /run/resolvconf/resolv.conf, e.g. chronyd, this solution is not well.
If I change SELinux mode to permissive, the tunnel worked well, SELinux just logged dennied info into system log.
But my requirement is make the system work well in Enforcing mode. How should I deal with file /run/resolvconf/resolv.conf or what should I do to solve the problem.
server amazon-ec2 resolv.conf resolvconf selinux
asked Feb 26 at 19:12
Gorgon
1
I'm running Ubuntu Xenial 16.04 in AWS EC2, I installed SELinux and change its mode to Enforcing. I've configured selinux type ssh_port_t to port 22. While I created port forwarding via ssh, I found the tunnel was not work properly.
In log file /var/log/syslog, it outputs
kernel: [ 311.860046] audit: type=1400 audit(1519664302.158:506): avc: denied getattr for pid=1367 comm="sshd" path="/run/resolvconf/resolv.conf" dev="tmpfs" ino=267 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:init_var_run_t:s0 tclass=file permissive=0
SELinux prohibited command sshd to access file /run/resolvconf/resolv.conf, this file is a soft link of /etc/resolv.conf
$ readlink -f /etc/resolv.conf
/run/resolvconf/resolv.conf
$ ls -Z /etc/resolv.conf
unconfined_u:object_r:etc_t:SystemLow /etc/resolv.conf
$ ls -Z /run/resolvconf/resolv.conf
system_u:object_r:init_var_run_t:SystemLow /run/resolvconf/resolv.conf
File /run/resolvconf/resolv.conf default type is init_var_run_t, I've tried changing it to type default_t, var_run_t, sshd_var_run_t via command
# sudo semanage fcontext -a -t $TYPE /var/run/resolvconf/resolv.conf
sudo semanage fcontext -m -t $TYPE /var/run/resolvconf/resolv.conf
sudo restorecon -F -R /run/resolvconf/resolv.conf
When I changed it to sshd_var_run_t, the tunnel works. But other utility also need to use file /run/resolvconf/resolv.conf, e.g. chronyd, this solution is not well.
If I change SELinux mode to permissive, the tunnel worked well, SELinux just logged dennied info into system log.
But my requirement is make the system work well in Enforcing mode. How should I deal with file /run/resolvconf/resolv.conf or what should I do to solve the problem.
server amazon-ec2 resolv.conf resolvconf selinux
server amazon-ec2 resolv.conf resolvconf selinux
asked Feb 26 at 19:12
Gorgon
1
asked Feb 26 at 19:12
Gorgon
1
asked Feb 26 at 19:12
Gorgon
1
asked Feb 26 at 19:12
Gorgon
1
asked Feb 26 at 19:12
Gorgon
1
1
1
Just going to ask an obvious question, but is there a reason you need SELinux that the already-bundled AppArmor system isn't good enough for?
– Thomas Ward♦
Feb 26 at 19:15
1
Selinux is not well maintained on Ubuntu you will have to write policy yourself. I suggest you use apparmor or if you want selinux a ton system RHEL , Centos, or Fedora
– Panther
Feb 26 at 19:37
add a comment |Â
1
Just going to ask an obvious question, but is there a reason you need SELinux that the already-bundled AppArmor system isn't good enough for?
– Thomas Ward♦
Feb 26 at 19:15
1
Selinux is not well maintained on Ubuntu you will have to write policy yourself. I suggest you use apparmor or if you want selinux a ton system RHEL , Centos, or Fedora
– Panther
Feb 26 at 19:37
1
1
Just going to ask an obvious question, but is there a reason you need SELinux that the already-bundled AppArmor system isn't good enough for?
– Thomas Ward♦
Feb 26 at 19:15
Just going to ask an obvious question, but is there a reason you need SELinux that the already-bundled AppArmor system isn't good enough for?
– Thomas Ward♦
Feb 26 at 19:15
1
1
Selinux is not well maintained on Ubuntu you will have to write policy yourself. I suggest you use apparmor or if you want selinux a ton system RHEL , Centos, or Fedora
– Panther
Feb 26 at 19:37
Selinux is not well maintained on Ubuntu you will have to write policy yourself. I suggest you use apparmor or if you want selinux a ton system RHEL , Centos, or Fedora
– Panther
Feb 26 at 19:37
add a comment |Â
active
oldest
votes
active
oldest
votes
active
oldest
votes
active
oldest
votes
active
oldest
votes
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
var $window = $(window),
onScroll = function(e)
var $elem = $('.new-login-left'),
docViewTop = $window.scrollTop(),
docViewBottom = docViewTop + $window.height(),
elemTop = $elem.offset().top,
elemBottom = elemTop + $elem.height();
if ((docViewTop elemBottom))
StackExchange.using('gps', function() StackExchange.gps.track('embedded_signup_form.view', location: 'question_page' ); );
$window.unbind('scroll', onScroll);
;
$window.on('scroll', onScroll);
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2faskubuntu.com%2fquestions%2f1010065%2frun-resolvconf-resolv-conf-was-dennied-to-access-under-selinux-enforcing-mode-i%23new-answer', 'question_page');
);
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
var $window = $(window),
onScroll = function(e)
var $elem = $('.new-login-left'),
docViewTop = $window.scrollTop(),
docViewBottom = docViewTop + $window.height(),
elemTop = $elem.offset().top,
elemBottom = elemTop + $elem.height();
if ((docViewTop elemBottom))
StackExchange.using('gps', function() StackExchange.gps.track('embedded_signup_form.view', location: 'question_page' ); );
$window.unbind('scroll', onScroll);
;
$window.on('scroll', onScroll);
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
var $window = $(window),
onScroll = function(e)
var $elem = $('.new-login-left'),
docViewTop = $window.scrollTop(),
docViewBottom = docViewTop + $window.height(),
elemTop = $elem.offset().top,
elemBottom = elemTop + $elem.height();
if ((docViewTop elemBottom))
StackExchange.using('gps', function() StackExchange.gps.track('embedded_signup_form.view', location: 'question_page' ); );
$window.unbind('scroll', onScroll);
;
$window.on('scroll', onScroll);
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
var $window = $(window),
onScroll = function(e)
var $elem = $('.new-login-left'),
docViewTop = $window.scrollTop(),
docViewBottom = docViewTop + $window.height(),
elemTop = $elem.offset().top,
elemBottom = elemTop + $elem.height();
if ((docViewTop elemBottom))
StackExchange.using('gps', function() StackExchange.gps.track('embedded_signup_form.view', location: 'question_page' ); );
$window.unbind('scroll', onScroll);
;
$window.on('scroll', onScroll);
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
1
Just going to ask an obvious question, but is there a reason you need SELinux that the already-bundled AppArmor system isn't good enough for?
– Thomas Ward♦
Feb 26 at 19:15
1
Selinux is not well maintained on Ubuntu you will have to write policy yourself. I suggest you use apparmor or if you want selinux a ton system RHEL , Centos, or Fedora
– Panther
Feb 26 at 19:37