I'm trying to write an audisp plugin on a Linux CentOS 7 VM. Instead of statically setting the audit rules via /etc/audit/rules.d/, I wanted to add rules dynamically in the plugin using libaudit interfaces (based on some system settings).

My code looks somewhat like the following:

int fd_audit = audit_open(); // this is successful if (audit_is_enabled(fd_audit) <= 0) audit_set_enabled(fd_audit, 1); // "Permission denied" error given } else { // set some rules }

The problem I'm facing is with audit_set_enabled() function, as permission is denied, when SELinux is enforcing. When SELinux is permissive, audit_set_enabled() returns a successful status but adding audit rule still fails.

I tried looking out for avc denied messages but can't seem to find any.

Any help or advice is welcome.


Managed to solve above problem by disabling "don't audit" rules with sudo semodule -DB.

Then I was able to get AVC logs and fix the sepolicy rules with audit2allow. Seems I was missing netlink_audit_socket { read write } access rights.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.