View custom selinux policies

selinux

Is there a way to view all custom policies applied to SELinux, preferably rolling them all up into one policy "package"?

I've just spent the last week or so working through a series of SELinux errors when a certain process (awstats update from logrotate scripts, FWIW) tried to run. With SELinux in permissive mode I'd wait for logrotate to run, view the SELinux blocks in the audit log, run audit2allow to create an allow policy, and then repeat the process the next day with a whole new list of related errors. Finally, this morning the audit log came up clean, so I think I have all the required rules in place to allow the scripts to run properly.

Of course I wasn't thinking as I ran thorough this process, so I don't have all the .pp/.te files created along the way. So what I would like to do is pull all the currently active custom policies back out of SELinux, so I can have a backup copy for use on other machines or restores. Is this possible?

Edit: This is on a machine running CentOS 6.7, if that makes a difference

Best Answer

This answer is borrowed from this question. While it doesn't exactly answer the question of seeing all custom SELinux policies applied to the machine, it does provide the set of tools you would want to use to see any custom policies or narrow it down a fair bit.

Some of the commands to obtain this info are (examples use httpd_log_t):

  1. seinfo

    # seinfo -x --type=httpd_log_t /etc/selinux/default/policy/policy.26
   httpd_log_t
      file_type
      non_security_file_type
      logfile

  2. sesearch

    # sesearch --dontaudit -t httpd_log_t /etc/selinux/default/policy/policy.26 | head
Found 35 semantic av rules:
    dontaudit run_init_t file_type : dir { getattr search open } ;
    dontaudit staff_t non_security_file_type : file getattr ;
    dontaudit staff_t non_security_file_type : dir { ioctl read getattr lock search open } ;
    dontaudit staff_t non_security_file_type : lnk_file getattr ;
    dontaudit staff_t non_security_file_type : sock_file getattr ;
    dontaudit staff_t non_security_file_type : fifo_file getattr ;
    dontaudit unconfined_t non_security_file_type : file getattr ;
    dontaudit unconfined_t non_security_file_type : dir { ioctl read getattr lock search open } ;
    dontaudit unconfined_t non_security_file_type : lnk_file getattr ;

  3. semanage

    # semanage fcontext -l | grep httpd_log_t
/etc/httpd/logs                                    all files          system_u:object_r:httpd_log_t:s0
/var/log/apache(2)?(/.*)?                          all files          system_u:object_r:httpd_log_t:s0
/var/log/apache-ssl(2)?(/.*)?                      all files          system_u:object_r:httpd_log_t:s0
/var/log/cacti(/.*)?                               all files          system_u:object_r:httpd_log_t:s0
/var/log/cgiwrap\.log.*                            regular file       system_u:object_r:httpd_log_t:s0
/var/log/horde2(/.*)?                              all files          system_u:object_r:httpd_log_t:s0
/var/log/httpd(/.*)?                               all files          system_u:object_r:httpd_log_t:s0
/var/log/lighttpd(/.*)?                            all files          system_u:object_r:httpd_log_t:s0
/var/log/piranha(/.*)?                             all files          system_u:object_r:httpd_log_t:s0
/var/www(/.*)?/logs(/.*)?                          all files          system_u:object_r:httpd_log_t:s0

References: RHEL6 SELinux manual

Related Topic