Write policy for starting/stopping/restarting auditd

[ghost]

type=USER_AVC msg=audit(1438545469.052:1539): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='avc: denied { start } for auid=1000 uid=0 gid=0 path="/usr/lib/systemd/system/auditd.service" cmdline="systemctl restart auditd.service" scontext=toor_u:toor_r:toor_t:s0 tcontext=system_u:object_r:auditd_unit_file_t:s0 tclass=service exe="/usr/lib/systemd/systemd" sauid=0 hostname=? addr=? terminal=?'

[mpalmi]

[toor@localhost ~]$ getenforce && systemctl restart auditd.service
Permissive
Failed to issue method call: Access denied

@ykhodorkovskiy The toor user doesn't even have the DAC perms to do this in permissive. Should this user be able to start auditd or should this perm be reserved for a privileged role?

[ghost]

This should only be done as root or a privileged role.

From: Mike Palmiotto [mailto:[email protected]]
Sent: Monday, August 03, 2015 12:34 PM
To: TresysTechnology/clip
Cc: Yuli Khodorkovskiy
Subject: Re: [clip] Write policy for starting/stopping/restarting auditd (#194)

[toor@localhost ~]$ getenforce && systemctl restart auditd.service
Permissive
Failed to issue method call: Access denied

@ykhodorkovskiyhttps://github.com/ykhodorkovskiy The toor user doesn't even have the DAC perms to do this in permissive. Should this user be able to start auditd or should this perm be reserved for a privileged role?

—
Reply to this email directly or view it on GitHubhttps://github.com//issues/194#issuecomment-127315458.

[mpalmi]

Ah, right. My bad. I was thinking toor_t was an unpriv user label.

[mpalmi]

When I attempt to stop auditd with systemctl stop auditd.service (in both Enforcing/Permissive), I get:
Failed to issue method call: Operation refused, unit auditd.service may be requested by dependency only.

It appears that the proper usage is service auditd stop/start/restart, all of which work in Enforcing on mpalmi@64322f0

[ghost]

Verified that this was resolved with #134. Leaving this open until #134 is merged.

[minapoli]

sudo service auditd stop
fails in enforcing