Selinux 기반에서 rsyncd Permission denied 발생시

rsync 설정은 문제가 없는 것 같은데 Permission denied가 발생한다면 selinux  가 enable 된 상태이다.

selinux 를  disabled로 변경하면 문제가 해결되지만 보안상 selinux를 enable해 둔 상태로 rsync를 가능하게 해보자.

 

아래와 같은 Permission denied 에러가 발생하고 있다.

ellord@DS1TTC ~ % rsync -azPog --delete root@218.146.255.53::home/ /Volumes/4T/backup/53home    
receiving file list ... 
rsync: opendir "/." (in home) failed: Permission denied (13)
1 file to consider
IO error encountered -- skipping file deletion
                    
sent 16 bytes  received 129 bytes  290.00 bytes/sec
total size is 0  speedup is 0.00
rsync error: some files could not be transferred (code 23) at /AppleInternal/Library/BuildRoots/66382bca-8bca-11ec-aade-6613bcf0e2ee/Library/Caches/com.apple.xbs/Sources/rsync/rsync/main.c(1404) [generator=2.6.9]

 

 

1. selinux 환경 확인

[root@localhost /]# getenforce
Enforcing
[root@localhost /]# 
[root@localhost /]# getsebool -a | grep rsync
postgresql_can_rsync --> off
rsync_anon_write --> off
rsync_client --> off
rsync_export_all_ro --> off
rsync_full_access --> off
[root@localhost /]# set

selinux가 enforcing상태이고, rsync관련은 전부 off로 되어 있다.

 

rsync_client : 클아이언트 접속 허용

rsync_export_all_ro : 읽기 모드 허용

rsync_full_access  : 읽고쓰는 모든 기능 허용

 

이 부분을 on으로 변경해 보자.

 

[root@localhost /]# setsebool -P rsync_client 1
[root@localhost /]# getsebool -a | grep rsync
postgresql_can_rsync --> off
rsync_anon_write --> off
rsync_client --> on
rsync_export_all_ro --> off
rsync_full_access --> off

 

 

[root@localhost /]# setsebool -P rsync_export_all_ro 1
[root@localhost /]# getsebool -a | grep rsync
postgresql_can_rsync --> off
rsync_anon_write --> off
rsync_client --> on
rsync_export_all_ro --> on
rsync_full_access --> off
[root@localhost /]#

 

 

[root@localhost /]# setsebool -P rsync_full_access 1
[root@localhost /]# getsebool -a | grep rsync
postgresql_can_rsync --> off
rsync_anon_write --> off
rsync_client --> on
rsync_export_all_ro --> on
rsync_full_access --> on
[root@localhost /]#

 

 

2. rsync를 다시 시도해 본다.

 

ellord@DS1TTC ~ % rsync -azPog --delete root@서버아이피::home/ /Volumes/4T/backup
receiving file list ... 
526 files to consider
ds1ttc/             
ds1ttc/.bash_logout
          18 100%   17.58kB/s    0:00:00 (xfer#1, to-check=523/526)
ds1ttc/.bash_profile
         193 100%  188.48kB/s    0:00:00 (xfer#2, to-check=522/526)
ds1ttc/.bashrc
         231 100%  112.79kB/s    0:00:00 (xfer#3, to-check=521/526)

 

정상적으로 된다.