CentOS 6
Sponsored Link

SELinux : Search Logs
2016/07/26
 
Access OK or Deny decisions by SELinux are cached once and Denial Accesses are sent to Log files. Cache of SELinux is called AVC (Access Vector Cache) and Denial Accesses are called "AVC Denials", too.
AVC Denial Log is generated via Rsyslog Service or Audit Service, so it needs either of service is running.
[1] Messages via Rsyslog are generated with "kern" facility. CentOS default Rsyslog setting is written as "*.info;xxx /var/log/messages", so AVC Denial Log is recorded to /var/log/messages. (for the case Auditd is not running)
[root@dlp ~]#
grep "avc: .denied" /var/log/messages

Apr  2 13:20:06 www kernel: type=1400 audit(1459743606.523:6): avc:  denied  { read } for  pid=1298 
     comm="httpd" name="index.html" dev="dm-0" ino=67206855 scontext=system_u:system_r:httpd_t:s0 
     tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file
Apr  2 13:22:13 www kernel: type=1400 audit(1459743733.690:4): avc:  denied  { read } for  pid=891 
     comm="httpd" name="index.html" dev="dm-0" ino=67206855 scontext=system_u:system_r:httpd_t:s0 
     tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file
[2] Messages via Auditd are generated to /var/log/audit/audit.log.
[root@dlp ~]#
grep "avc: .denied" /var/log/audit/audit.log

type=AVC msg=audit(1459146274.923:133): avc:  denied  { create } for  pid=8173 comm="smbd" 
     name=E696B0E38197E38184E38395E382A9E383ABE38380E383BC scontext=system_u:system_r:smbd_t:s0 
     tcontext=system_u:object_r:user_home_dir_t:s0 tclass=dir
type=AVC msg=audit(1459146274.924:134): avc:  denied  { create } for  pid=8173 comm="smbd" 
     name=E696B0E38197E38184E38395E382A9E383ABE38380E383BC scontext=system_u:system_r:smbd_t:s0 
     tcontext=system_u:object_r:user_home_dir_t:s0 tclass=dir
type=AVC msg=audit(1459217340.695:63): avc:  denied  { name_bind } for  pid=1320 comm="httpd" 
     src=82 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:reserved_port_t:s0 tclass=tcp_socket
type=AVC msg=audit(1459217340.696:64): avc:  denied  { name_bind } for  pid=1320 comm="httpd" 
     src=82 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:reserved_port_t:s0 tclass=tcp_socket
[3] For Messages via Auditd, it's possible to search them with ausearch command.
[root@dlp ~]#
ausearch -m AVC

----
time->Mon Mar 28 14:59:30 2016
type=SYSCALL msg=audit(1459144770.995:64): arch=c000003e syscall=83 success=no exit=-13 a0=7fac66386bb0 
     a1=1ff a2=1ff a3=7fac66388888 items=0 ppid=8142 pid=8173 auid=4294967295 uid=99 gid=0 euid=99 suid=0 
     fsuid=99 egid=99 sgid=0 fsgid=99 tty=(none) ses=4294967295 comm="smbd" exe="/usr/sbin/smbd" 
     subj=system_u:system_r:smbd_t:s0 key=(null) type=AVC msg=audit(1459144770.995:64): 
     avc:  denied  { create } for  pid=8173 comm="smbd" name=E696B0E38197E38184E38395E382A9E383ABE38380E383BC 
     scontext=system_u:system_r:smbd_t:s0 tcontext=system_u:object_r:user_home_dir_t:s0 tclass=dir
----
time->Mon Apr  4 11:27:08 2016
type=SYSCALL msg=audit(1459736828.877:69): arch=c000003e syscall=49 success=no exit=-13 a0=3 a1=7efddf9b8cf8 
     a2=10 a3=7ffceb56695c items=0 ppid=1 pid=1407 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 
     gid=0 fsgid=0 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" subj=system_u:system_r:httpd_t:s0 
     key=(null) type=AVC msg=audit(1459736828.877:69): avc:  denied  { name_bind } for  pid=1407 comm="httpd" 
     src=82 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:reserved_port_t:s0 tclass=tcp_socket
----
time->Mon Apr  4 11:27:08 2016
type=SYSCALL msg=audit(1459736828.877:68): arch=c000003e syscall=49 success=no exit=-13 a0=4 a1=7efddf9b8db8 
     a2=1c a3=7ffceb566710 items=0 ppid=1 pid=1407 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 
     sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="httpd" exe="/usr/sbin/httpd" subj=system_u:system_r:httpd_t:s0 
     key=(null) type=AVC msg=audit(1459736828.877:68): avc:  denied  { name_bind } for  pid=1407 comm="httpd" 
     src=82 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:reserved_port_t:s0 tclass=tcp_socket
[4] For Messages via Auditd, it's possible to show summary reports with aureport command.
[root@dlp ~]#
aureport --avc


AVC Report
========================================================
# date time comm subj syscall class permission obj event
========================================================
1. 08/08/2015 02:13:50 ? system_u:system_r:init_t:s0 0 (null) (null) (null) unset 347
2. 03/28/2016 13:51:10 ? system_u:system_r:kernel_t:s0 0 (null) (null) (null) unset 9
3. 03/28/2016 14:59:30 smbd system_u:system_r:smbd_t:s0 83 dir create system_u:object_r:user_home_dir_t:s0 denied 64
4. 03/28/2016 14:59:30 smbd system_u:system_r:smbd_t:s0 83 dir create system_u:object_r:user_home_dir_t:s0 denied 65
5. 03/28/2016 14:59:30 smbd system_u:system_r:smbd_t:s0 83 dir create system_u:object_r:user_home_dir_t:s0 denied 66
.....
.....
64. 04/04/2016 11:27:03 httpd system_u:system_r:httpd_t:s0 42 tcp_socket name_connect system_u:object_r:reserved_...
65. 04/04/2016 11:27:08 httpd system_u:system_r:httpd_t:s0 49 tcp_socket name_bind system_u:object_r:reserved_por...
66. 04/04/2016 11:27:08 httpd system_u:system_r:httpd_t:s0 49 tcp_socket name_bind system_u:object_r:reserved_por...

[root@dlp ~]#
aureport --avc --summary

Avc Object Summary Report
=================================
total  obj
=================================
32  unconfined_u:object_r:home_root_t:s0
20  system_u:object_r:user_home_dir_t:s0
5  system_u:object_r:reserved_port_t:s0
 
Tweet