On 10/29/2015 06:56 AM, Paolo Galtieri wrote:
On the system that fails
/bin/ls -ldZ /var/log/snort
lrwxrwxrwx. 1 root root unconfined_u:object_r:snort_log_t:s0 44 Oct 24
17:29 /var/log/snort -> /run/media/pgaltieri/NEWDATA2/NSM/logs/snort
/bin/ls -ldZ /run/media/pgaltieri/NEWDATA2/NSM/logs/snort
drwxr-xr-x. 2 snort snort unconfined_u:object_r:unlabeled_t:s0 4096
Oct 28 15:31 /run/media/pgaltieri/NEWDATA2/NSM/logs/snort
Note that on the failing system the selinux context shows the
directory has unlabeled_t context while on the working system it's
colord_var_lib_t. I set this at some point (I think), but I forget
how I did it :-(
I have also set up user snort so that I can login to the account and I
get
su - snort
Password:
su: warning: cannot change directory to /var/log/snort: Permission denied
-bash: /var/log/snort/.bash_profile: Permission denied
I can write to the directory if I do
sudo touch /var/log/snort/testfile
So what do I need to do to fix this so I can get snort to write to
it's log directory?
Any assistance is appreciated.
Are you getting AVC records in /var/log/audit/audit.log?
Have you run "sealert -b"?
--
In reality, some people should stick to running Windows and others
should stay away from computers altogether.