如何将/var/log/audit/audit.log移动到另一个分区

新鲜的centos 6.5与更新安装。 由于我们用splunk或logstash捕获了所有的东西，所以我们希望将auditdlogging到一个非永久性的卷中。

目标目录是/ mnt / ephemeral / audit /

# ls -l /var/log lrwxrwxrwx. 1 root root 21 Dec 9 12:11 audit -> /mnt/ephemeral/audit 

有了这个，auditd无法启动，据推测selinux拒绝了。 我假设/ var / log / messages中的日志包含创build新策略所需的avc拒绝。

所以我

• selinux设置由Apache运行脚本拉git回购
• 什么是soundd守护进程，为什么nginx需要SELinux下的types？
• 用clamd为套接字错误创build一个SELINUX允许规则
• Dovecot SELinux MailDir权限被拒绝
• SELinux上下文为apache ldap ssl

 semanage permissive -a auditd_t 

然后再试一次

 Dec 9 12:50:56 myhost kernel: type=1400 audit(1418129456.307:93): avc: denied { write } for pid=13174 comm="auditd" name="audit" dev=xvdb ino=147457 scontext=unconfined_u:system_r:auditd_t:s0 tcontext=unconfined_u:object_r:var_t:s0 tclass=dir Dec 9 12:50:56 myhost kernel: type=1400 audit(1418129456.307:94): avc: denied { add_name } for pid=13174 comm="auditd" name="audit.log" scontext=unconfined_u:system_r:auditd_t:s0 tcontext=unconfined_u:object_r:var_t:s0 tclass=dir Dec 9 12:50:56 myhost kernel: type=1400 audit(1418129456.307:95): avc: denied { create } for pid=13174 comm="auditd" name="audit.log" scontext=unconfined_u:system_r:auditd_t:s0 tcontext=unconfined_u:object_r:var_t:s0 tclass=file Dec 9 12:50:56 myhost kernel: type=1400 audit(1418129456.307:96): avc: denied { read open } for pid=13174 comm="auditd" name="audit.log" dev=xvdb ino=147458 scontext=unconfined_u:system_r:auditd_t:s0 tcontext=unconfined_u:object_r:var_t:s0 tclass=file Dec 9 12:50:56 myhost kernel: type=1400 audit(1418129456.307:97): avc: denied { getattr } for pid=13174 comm="auditd" path="/mnt/ephemeral0/audit/audit.log" dev=xvdb ino=147458 scontext=unconfined_u:system_r:auditd_t:s0 tcontext=unconfined_u:object_r:var_t:s0 tclass=file Dec 9 12:50:56 myhost kernel: type=1400 audit(1418129456.310:98): avc: denied { append } for pid=13175 comm="auditd" name="audit.log" dev=xvdb ino=147458 scontext=unconfined_u:system_r:auditd_t:s0 tcontext=unconfined_u:object_r:var_t:s0 tclass=file Dec 9 12:50:56 myhost kernel: type=1400 audit(1418129456.310:99): avc: denied { setattr } for pid=13175 comm="auditd" name="audit.log" dev=xvdb ino=147458 scontext=unconfined_u:system_r:auditd_t:s0 tcontext=unconfined_u:object_r:var_t:s0 tclass=file 

那么我呢

 grep avc /var/log/messages > /tmp/avc audit2allow -M mypol < /tmp/avc semodule -i mypol.pp restorecon -R -v / 

te文件的内容：

 # cat mypol.te module mypol 1.0; require { type var_t; type auditd_t; class dir { write add_name }; class file { getattr setattr read create open append }; } #============= auditd_t ============== #!!!! The source type 'auditd_t' can write to a 'dir' of the following types: # var_run_t, auditd_var_run_t, file_t, auditd_log_t, cluster_var_lib_t, cluster_var_run_t, root_t, cluster_conf_t allow auditd_t var_t:dir { write add_name }; allow auditd_t var_t:file { getattr setattr read create open append }; 

但审计拒绝启动。 诚然，我对selinux软弱，请不要火！

试过Michaels的build议，我看到/ var / log / messages

 Dec 10 11:42:52 myhost kernel: type=1400 audit(1418211771.996:29): avc: denied { read } for pid=1494 comm="auditd" name="audit" dev=xvdf ino=49153 scontext=unconfined_u:system_r:auditd_t:s0 tcontext=unconfined_u:object_r:var_log_t:s0 tclass=dir Dec 10 11:42:52 myhost auditd: Could not open dir /mnt/ephemeral/audit (Permission denied) 

回到audit2allow，我试了一下

 # grep avc /var/log/messages |tail -n1 | audit2allow -w Dec 10 12:03:09 euw1-infradev01-sonar-01 kernel: type=1400 audit(1418212989.424:48): avc: denied { read } for pid=1928 comm="auditd" name="audit" dev=xvdf ino=49153 scontext=unconfined_u:system_r:auditd_t:s0 tcontext=unconfined_u:object_r:var_log_t:s0 tclass=dir Was caused by: Missing type enforcement (TE) allow rule. # grep avc /var/log/messages |tail -n1 | audit2allow -M mypol ******************** IMPORTANT *********************** To make this policy package active, execute: semodule -i mypol.pp # cat mypol.te module mypol 1.0; require { type var_log_t; type auditd_t; class dir read; } #============= auditd_t ============== allow auditd_t var_log_t:dir read; 

宾果希望：

 # setenforce 1 # service auditd start Starting auditd: [ OK ] 

最后一点，这是持续在重新启动？ 我会发现的。

 /var/log/audit(/.*)? system_u:object_r:auditd_log_t:s0 

 semanage fcontext --add --type auditd_log_t "/mnt/ephemeral/audit(/.*)?" 

 restorecon -r -v /mnt/ephemeral/audit