22.4. Configuration Examples

Procedure 22.1. Getting rsync to launch as rsync_t

1. Run the getenforce command to confirm SELinux is running in enforcing mode:

   ~]$ getenforce
   Enforcing
   

   Copy to Clipboard Toggle word wrap
   The command returns Enforcing when SELinux is running in enforcing mode.
2. Run the which command to confirm that the rsync binary is in the system path:

   ~]$ which rsync
   /usr/bin/rsync
   

   Copy to Clipboard Toggle word wrap
3. When running rsync as a daemon, a configuration file should be used and saved as /etc/rsyncd.conf. Note that the following configuration file used in this example is very simple and is not indicative of all the possible options that are available, rather it is just enough to demonstrate the rsync daemon:

   log file = /var/log/rsync.log
   pid file = /var/run/rsyncd.pid
   lock file = /var/run/rsync.lock
   [files]
   	path = /srv/rsync
           comment = file area
           read only = false
           timeout = 300
   

   Copy to Clipboard Toggle word wrap
4. Now that a simple configuration file exists for rsync to operate in daemon mode, you can start it by running the following command:

   ~]# systemctl start rsyncd.service

   Copy to Clipboard Toggle word wrap
   Ensure that rsyncd was successfully started (the output is supposed to look similar to the one below, only the time stamp will differ):

   ~]# systemctl status rsyncd.service
   rsyncd.service - fast remote file copy program daemon
      Loaded: loaded (/usr/lib/systemd/system/rsyncd.service; disabled)
      Active: active (running) since Thu 2014-02-27 09:46:24 CET; 2s ago
    Main PID: 3220 (rsync)
      CGroup: /system.slice/rsyncd.service
              └─3220 /usr/bin/rsync --daemon --no-detach
   

   Copy to Clipboard Toggle word wrap
   SELinux can now enforce its protection mechanisms over the rsync daemon as it is now running in the rsync_t domain:

   ~]$ ps -eZ | grep rsync
   system_u:system_r:rsync_t:s0     3220 ?        00:00:00 rsync
   

   Copy to Clipboard Toggle word wrap

Procedure 22.2. Running the rsync daemon on a non-default port

1. Modify the /etc/rsyncd.conf file and add the port = 10000 line at the top of the file in the global configuration area (that is, before any file areas are defined). The new configuration file will look like:

   log file = /var/log/rsyncd.log
   pid file = /var/run/rsyncd.pid
   lock file = /var/run/rsync.lock
   port = 10000
   [files]
           path = /srv/rsync
           comment = file area
           read only = false
   	timeout = 300
   

   Copy to Clipboard Toggle word wrap
2. After launching the rsync daemon with this new setting, a denial message similar to the following is logged by SELinux:

   Jul 22 10:46:59 localhost setroubleshoot: SELinux is preventing the rsync (rsync_t) from binding to port 10000. For complete SELinux messages, run sealert -l c371ab34-639e-45ae-9e42-18855b5c2de8
   

   Copy to Clipboard Toggle word wrap
3. Use the semanage utility to add TCP port 10000 to the SELinux policy in rsync_port_t:

   ~]# semanage port -a -t rsync_port_t -p tcp 10000

   Copy to Clipboard Toggle word wrap
4. Now that TCP port 10000 has been added to the SELinux policy for rsync_port_t, rsyncd will start and operate normally on this port:

   ~]# systemctl start rsyncd.service

   Copy to Clipboard Toggle word wrap

   ~]# netstat -lnp | grep 10000
   tcp        0      0 0.0.0.0:10000   0.0.0.0:*      LISTEN      9910/rsync
   

   Copy to Clipboard Toggle word wrap