4

I have tried systemctl status setroubleshootd.service, but I get

● setroubleshootd.service
Loaded: not-found (Reason: No such file or directory)
Active: inactive (dead)

Neither does setroubleshootd appear in the output of ps ax.

However, yum info setroubleshoot, tells that the package is installed.

Installed Packages
Name        : setroubleshoot
Arch        : x86_64
Version     : 3.2.24
Release     : 1.1.el7
Size        : 235 k
Repo        : installed
From repo   : anaconda

In the same way, yum info setroubleshoot-server tells that such package is also installed.

So, it seems to be installed, but not recognized by systemd. How can I see whether it is running or not? And, if it is not running, how to enable it?

ARX
  • 221
  • 2
  • 6

1 Answers1

8

Found it. The problem is that setroubleshootd does not run permanently in CentOS 7. It is started only when an AVC denial message reaches auditd. This is confusing, since you normally expect a daemon to constantly run in the background.

See: SELinux User's and Administrator's Guide: Which Log File is Used

David Tonhofer
  • 821
  • 7
  • 13
ARX
  • 221
  • 2
  • 6
  • 1
    The sequence seems to be: kernel signals auditd, which invokes audispd, which invokes sedispatch (as configured in /etc/audisp/plugins.d/sedispatch.conf), which formats the SELinux AVC record and sends a DBUS message to DBUS, which starts setroubleshootd under user "setroubleshoot" if it is not running. setroubleshootd receives the DBUS message, formats/preprocesses according to plugins, emits a syslog message which by default ends up in /var/log/messages and signals (via DBUS) interested client programs like sealert that something is up. – David Tonhofer Mar 22 '18 at 15:28