Description of problem: modified /etc/cron.daily/00webalizer to contain: #!/bin/bash # update access statistics for the web site if [ -s /var/log/squid/access.log ]; then (exec /usr/bin/webalizer -Q -c /var/log/squid/webalizer.conf) fi SELinux is preventing /usr/bin/webalizer from 'write' accesses on the directory /var/log/squid. ***** Plugin catchall (100. confidence) suggests *************************** If you believe that webalizer should be allowed write access on the squid directory by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # grep webalizer /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context system_u:system_r:webalizer_t:s0-s0:c0.c1023 Target Context system_u:object_r:squid_log_t:s0 Target Objects /var/log/squid [ dir ] Source webalizer Source Path /usr/bin/webalizer Port <Unknown> Host (removed) Source RPM Packages webalizer-2.23_05-7.fc19.x86_64 Target RPM Packages squid-3.2.13-1.fc19.x86_64 Policy RPM selinux-policy-3.12.1-73.fc19.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 3.10.9-200.fc19.x86_64 #1 SMP Wed Aug 21 19:27:58 UTC 2013 x86_64 x86_64 Alert Count 2 First Seen 2013-08-28 03:29:02 NZST Last Seen 2013-08-28 03:29:02 NZST Local ID 9f71c196-4020-4852-8773-b261b648b344 Raw Audit Messages type=AVC msg=audit(1377617342.306:189): avc: denied { write } for pid=3244 comm="webalizer" name="squid" dev="dm-1" ino=1056034 scontext=system_u:system_r:webalizer_t:s0-s0:c0.c1023 tcontext=system_u:object_r:squid_log_t:s0 tclass=dir type=SYSCALL msg=audit(1377617342.306:189): arch=x86_64 syscall=open success=no exit=EACCES a0=7fff9ddf8e50 a1=241 a2=1b6 a3=30 items=0 ppid=3242 pid=3244 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=7 tty=(none) comm=webalizer exe=/usr/bin/webalizer subj=system_u:system_r:webalizer_t:s0-s0:c0.c1023 key=(null) Hash: webalizer,webalizer_t,squid_log_t,dir,write Additional info: reporter: libreport-2.1.6 hashmarkername: setroubleshoot kernel: 3.10.9-200.fc19.x86_64 type: libreport
Hi Nivag, Do you know, why is "webalizer.conf" saved in "/var/log/squid/" ?
I put it there, as the man page says: o A default configuration file is scanned for. A file named webalizer.conf is searched for in the current directory, and if found, and is owned by the invoking user, then its configura‐ tion data is parsed. If the file is not present in the current directory, the file /etc/webalizer.conf is searched for and, if found, is used instead.
Yes, I see. So, I would like to suggest you to move your configuration to /etc/webalizer.conf and use just this config file. How you can see, if webalizer can't find config file in current directory, will be used file /etc/webalizer.conf. If you don't do that, you can make your own selinux policy, but it's less safe than the first solution.
Well another option would be to put a label on this file that webalizer can write to. If you change the label to webalizer_etc_t # semanage fcontext -a -t webalizer_etc_t /var/log/squid/webalizer.conf # restorecon -R -v /var/log/squid
/usr/bin/webalizer needs 'write' access to directory /var/log/squid to update the files: webalizer.current & webalizer.hist, plus the usage directory. So I should do the following: semanage fcontext -a -t webalizer_etc_t /var/log/squid/webalizer.current semanage fcontext -a -t webalizer_etc_t /var/log/squid/webalizer.hist semanage fcontext -a -t webalizer_etc_t /var/log/squid/usage restorecon -R -v /var/log/squid
webalizer_etc_t won't work. $ sesearch -A -s webalizer_t -t webalizer_etc_t Found 1 semantic av rules: allow webalizer_t webalizer_etc_t : file { ioctl read getattr lock open } ; This is really weird to have it in this directory. Could you move it to /var/lib/webalizer Or you can leave it in /var/log/squid but you will need to run # semanage permissive -a webalizer_t re-test # ausearch -m avc -ts recent |audit2allow -M mywebalizer # semodule -i mywebalizer.pp # semanage permissive -d webalizer_t