diff mbox series

[meta-selinux,dunfell,2/4] audit: set correct security context for /var/log/audit

Message ID 20230727180748.107196-3-akuster808@gmail.com
State New
Headers show
Series Selinux failed to enable do to errors. | expand

Commit Message

akuster808 July 27, 2023, 6:07 p.m. UTC 
From: Yi Zhao <yi.zhao@windriver.com>

By default /var/log is a symbolic link of /var/volatile/log. But
restorecon does not follow symbolic links then we will encounter the
following error when set /var/log/audit directory:

$ /sbin/restorecon -F /var/log/audit
/sbin/restorecon: SELinux: Could not get canonical path for /var/log/audit restorecon: Permission denied.

Use readlink to find the real path before set security context.

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Joe MacDonald <joe@deserted.net>
(cherry picked from commit 8b79480663bc9de2343e0146ed8d3d0e59ab48be)
Signed-off-by: Armin Kuster <akuster@mvista.com>
---
 recipes-security/audit/audit/auditd | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 mode change 100755 => 100644 recipes-security/audit/audit/auditd
diff mbox series

Patch

diff --git a/recipes-security/audit/audit/auditd b/recipes-security/audit/audit/auditd
old mode 100755
new mode 100644
index cda2e43..6aa7f94
--- a/recipes-security/audit/audit/auditd
+++ b/recipes-security/audit/audit/auditd
@@ -86,7 +86,7 @@  do_reload() {
 
 if [ ! -e /var/log/audit ]; then
 	mkdir -p /var/log/audit
-	[ -x /sbin/restorecon ] && /sbin/restorecon -F /var/log/audit
+	[ -x /sbin/restorecon ] && /sbin/restorecon -F $(readlink -f /var/log/audit)
 fi
 
 case "$1" in