# Backup\_agent fails to write logs if selinux is enabled

**URL:** <https://forums.foundationdb.org/t/backup-agent-fails-to-write-logs-if-selinux-is-enabled/5044>\
**Category:** Development\
**Created:** [August 22, 2025, 11:59am UTC](https://forums.foundationdb.org/t/backup-agent-fails-to-write-logs-if-selinux-is-enabled/5044 "2025-08-22T11:59:45Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![MarkSh1](https://sea1.discourse-cdn.com/foundationdb/user_avatar/forums.foundationdb.org/marksh1/32/1789_2.png) [@MarkSh1](https://forums.foundationdb.org/u/MarkSh1)\
**Post date:** [August 22, 2025, 11:59am UTC](https://forums.foundationdb.org/t/backup-agent-fails-to-write-logs-if-selinux-is-enabled/5044/1 "2025-08-22T11:59:45Z")

</div>

To solve the problem with SELinux, I suggest moving backup\_agent to the “/usr/bin” folder. What do you think?

> <https://github.com/apple/foundationdb/issues/2579>
>
> After installing Foundation Db server on a system with SELinux enabled, backup a…gents can not create trace files. The errors in the system journals are:
> 
> \`\`\`
> Jan 22 14:44:27 fdbs fdbmonitor\[1736\]: LogGroup="default" Process="backup\_agent.1": ERROR: could not create trace log file \`/var/log/foundationdb/trace.127.0.0.1.1737.1579693462.7sC\>
> \`\`\`
> 
> Setting selinux policy to Permissive eliminates tese errors but there are still a lot messages of illegal access attempts:
> 
> \`\`\`
> Jan 22 14:57:23 fdbs audit\[1737\]: AVC avc: denied { create } for pid=1737 comm="backup\_agent" name="trace.127.0.0.1.1737.1579693462.7sCRr8.0.1.xml" scontext=system\_u:system\_r:init\_t:s0 tcontext=system\_u:object\_r:var\_log\_t:s0 tclass=file permissive=0
> Jan 22 14:57:23 fdbs audit\[1737\]: AVC avc: denied { name\_connect } for pid=1737 comm="backup\_agent" dest=4500 scontext=system\_u:system\_r:init\_t:s0 tcontext=system\_u:object\_r:ipsecnat\_port\_t:s0 tclass=tcp\_socket permissive=0
> Jan 22 14:57:24 fdbs audit\[1737\]: AVC avc: denied { create } for pid=1737 comm="backup\_agent" name="trace.127.0.0.1.1737.1579693462.7sCRr8.0.1.xml" scontext=system\_u:system\_r:init\_t:s0 tcontext=system\_u:object\_r:var\_log\_t:s0 tclass=file permissive=0
> Jan 22 14:57:24 fdbs audit\[1737\]: AVC avc: denied { name\_connect } for pid=1737 comm="backup\_agent" dest=4500 scontext=system\_u:system\_r:init\_t:s0 tcontext=system\_u:object\_r:ipsecnat\_port\_t:s0 tclass=tcp\_socket permissive=0
> Jan 22 14:57:25 fdbs audit\[1737\]: AVC avc: denied { create } for pid=1737 comm="backup\_agent" name="trace.127.0.0.1.1737.1579693462.7sCRr8.0.1.xml" scontext=system\_u:system\_r:init\_t:s0 tcontext=system\_u:object\_r:var\_log\_t:s0 tclass=file permissive=0
> Jan 22 14:57:25 fdbs audit\[1737\]: AVC avc: denied { name\_connect } for pid=1737 comm="backup\_agent" dest=4500 scontext=system\_u:system\_r:init\_t:s0 tcontext=system\_u:object\_r:ipsecnat\_port\_t:s0 tclass=tcp\_socket permissive=0
> Jan 22 14:57:26 fdbs audit\[1737\]: AVC avc: denied { create } for pid=1737 comm="backup\_agent" name="trace.127.0.0.1.1737.1579693462.7sCRr8.0.1.xml" scontext=system\_u:system\_r:init\_t:s0 tcontext=system\_u:object\_r:var\_log\_t:s0 tclass=file permissive=0
> Jan 22 14:57:26 fdbs audit\[1737\]: AVC avc: denied { name\_connect } for pid=1737 comm="backup\_agent" dest=4500 scontext=system\_u:system\_r:init\_t:s0 tcontext=system\_u:object\_r:ipsecnat\_port\_t:s0 tclass=tcp\_socket permissive=0
> Jan 22 14:58:01 fdbs audit\[43435\]: AVC avc: denied { name\_connect } for pid=43435 comm="backup\_agent" dest=4500 scontext=system\_u:system\_r:init\_t:s0 tcontext=system\_u:object\_r:ipsecnat\_port\_t:s0 tclass=tcp\_socket permissive=1
> Jan 22 14:58:01 fdbs audit\[43435\]: AVC avc: denied { create } for pid=43435 comm="backup\_agent" name="trace.127.0.0.1.43435.1579694281.ZKAKOV.0.1.xml" scontext=system\_u:system\_r:init\_t:s0 tcontext=system\_u:object\_r:var\_log\_t:s0 tclass=file permissive=1
> \`\`\`
> 
> The reason is that /usr/lib/foundationdb/backup\_agent/backup\_agent resides under /usr/lib and has a wrong security type lib\_t instead of bin\_t:
> 
> \`\`\`
> \[root@fdbs ~\]# ls -Z /usr/lib/foundationdb/backup\_agent/backup\_agent
> system\_u:object\_r:lib\_t:s0 /usr/lib/foundationdb/backup\_agent/backup\_agent
> \`\`\`
> 
> The solution may be placing backup\_agent into a dirs with executables (ex /usr/sbin like fdbserver) or implicit changing its security context after installation:
> 
> \`\`\`
> chcon system\_u:object\_r:bin\_t:s0 /usr/lib/foundationdb/backup\_agent/backup\_agent
> systemctl restart foundationdb
> \`\`\`
> 
> Then backup\_agent can create trace files.

---

<div class="post-metadata">

**Author:** ![saintstack](https://sea1.discourse-cdn.com/foundationdb/user_avatar/forums.foundationdb.org/saintstack/32/1844_2.png) [@saintstack](https://forums.foundationdb.org/u/saintstack)\
**Post date:** [August 22, 2025, 3:23pm UTC](https://forums.foundationdb.org/t/backup-agent-fails-to-write-logs-if-selinux-is-enabled/5044/2 "2025-08-22T15:23:32Z")

</div>

Sounds good to me (currently it’s in /usr/lib/foundationdb/backup\_agent/backup\_agent). Would be interested if this will cause anyone grief.

S

---

<div class="post-metadata">

**Author:** ![MarkSh1](https://sea1.discourse-cdn.com/foundationdb/user_avatar/forums.foundationdb.org/marksh1/32/1789_2.png) [@MarkSh1](https://forums.foundationdb.org/u/MarkSh1)\
**Post date:** [September 10, 2025, 10:08am UTC](https://forums.foundationdb.org/t/backup-agent-fails-to-write-logs-if-selinux-is-enabled/5044/3 "2025-09-10T10:08:01Z")

</div>

It should be noted that if CI foundationdb automatic update is configured, then after installing a new version of foundationdb, the path to backup\_agent in foundationdb.conf will not be replaced and the log with the startup error will grow indefinitely.