I'm trying to write an audisp plugin on a Linux CentOS 7 VM. Instead of statically setting the audit rules via /etc/audit/rules.d/, I wanted to add rules dynamically in the plugin using libaudit interfaces (based on some system settings).
My code looks somewhat like the following:
int fd_audit = audit_open(); // this is successful
if (audit_is_enabled(fd_audit) <= 0)
audit_set_enabled(fd_audit, 1); // "Permission denied" error given
// set some rules
The problem I'm facing is with audit_set_enabled() function, as permission is denied, when SELinux is enforcing. When SELinux is permissive, audit_set_enabled() returns a successful status but adding audit rule still fails.
I tried looking out for avc denied messages but can't seem to find any.
Any help or advice is welcome.