audit2allow

Dit deel is nog niet vertaald. Je ziet de Engelse tekst.

Wat het doet

audit2why reads AVC messages and says why each one happened: missing rule, a boolean that is off, or a wrong label. audit2allow -M NAME writes a policy module that allows exactly the denied actions; semodule -i NAME.pp installs it.

Use modules only when labels, ports and booleans cannot solve the problem, and read the rules first: allowing a denial blindly may allow an attack.

Zo schrijf je het

audit2allow [OPTION]...
audit2why [OPTION]...

Opties 17

Meest gebruikt

-a, --all: Read audit.log and messages.
-b, --boot: Only messages since the last boot.
-i, --input FILE: Read from a file.
-d, --dmesg: Read from dmesg.
-l, --lastreload: Only since the last policy reload.
-M NAME: Create a module package NAME.pp (and NAME.te).
-m, --module NAME: Print a module named NAME.
-o, --output FILE: Write to a file.
-w, --why: Explain (same as audit2why).
-D, --dontaudit: Generate dontaudit rules.
-R, --reference: Use interface macros from the reference policy.
-N, --noreference: Do not use macros.
-r, --requires: Add requires lines.
-x, --xperms: Extended permission rules.
-p, --policy FILE: Use another policy file.
-v, --verbose: Verbose.
-h, --help: Show help.

Voorbeelden 10

$ als gewone gebruiker# als root (of met sudo)

1Why was it denied?

#ausearch -m AVC -ts recent | audit2why
Was caused by:
	The boolean httpd_can_network_connect was set incorrectly.

Then: setsebool -P httpd_can_network_connect on.

2Missing type enforcement rule
```
#ausearch -m AVC -c myapp -ts today | audit2why
```
"Missing type enforcement (TE) allow rule" = no label or boolean fix; maybe a module.

3Show the rules that would be needed

#ausearch -m AVC -c myapp -ts today | audit2allow
allow myapp_t var_log_t:file { append open };

Read them carefully.

4Build and install a module

#ausearch -m AVC -c myapp -ts today | audit2allow -M myapp_local
#semodule -i myapp_local.pp

Only after checking myapp_local.te.

5List and remove modules
```
#semodule -l | grep local
#semodule -r myapp_local
```
Remove modules you no longer need.
6Explain from a saved log
```
#audit2why -i /root/avc.log
```
Analyze offline.
7Since the last boot
```
#audit2allow -b -w
```
Explanations for this boot.
8Do not allow everything (security)
```
#ausearch -m AVC -ts today | audit2allow | grep -E 'shadow_t|execmem|setenforce'
```
Rules like these mean an attack or a broken app — do not allow them.
9Use reference macros
```
#ausearch -m AVC -c myapp | audit2allow -R
```
Nicer rules with policy interfaces.
10Generate dontaudit rules for noisy denials
```
#ausearch -m AVC -c myapp | audit2allow -D -M myapp_quiet
```
Hides harmless denials (they stay blocked).

Exitcodes

`0`	Done.
`1`	Error.

`audit2allow`

Wat het doet

Zo schrijf je het

Opties 17

Voorbeelden 10

1Why was it denied?

2Missing type enforcement rule

3Show the rules that would be needed

4Build and install a module

5List and remove modules

6Explain from a saved log

7Since the last boot

8Do not allow everything (security)

9Use reference macros

10Generate dontaudit rules for noisy denials

Exitcodes

Volledige handleiding

Wat het doet

Zo schrijf je het

Opties 17

Voorbeelden 10

1Why was it denied?

2Missing type enforcement rule

3Show the rules that would be needed

4Build and install a module

5List and remove modules

6Explain from a saved log

7Since the last boot

8Do not allow everything (security)

9Use reference macros

10Generate dontaudit rules for noisy denials

Exitcodes

Verwante commando's

Gebruikt in deze lessen

Volledige handleiding

`audit2allow`