0

When I start dnsmasq service in CentOS 7, I get such status:

enter image description here

This is because I add a wblist.conf in /etc/dnsmasq.d/wblist.conf

cat wblist.conf

# for router itself
server=/google.com.tw/192.168.8.20#53
ipset=/google.com.tw/gfwlist

ipset -L gfwlist

Name: gfwlist
Type: hash:net
Revision: 3
Header: family inet hashsize 1024 maxelem 65536
Size in memory: 16784
References: 0
Members:

But if I COMMENT the ipset line, the service can be restarted successfully.

I don't know why. I have used dnsmasq/ipset for a long time, but suddenly got this problem.

Have anyone met this situation?

1

3 Answers 3

2

Disable SElinux is not recommend.

You can solve this problem by create and install a SELinux Policy Modules.

First you need create a type enforcement rules file called my-dnsmasq.te, content like below:

module my-dnsmasq 1.0;

require {
        type dnsmasq_t;
        class netlink_socket { bind create write };
}

#============= dnsmasq_t ==============
allow dnsmasq_t self:netlink_socket { bind create write };

Now you can compile it into a policy module package file:

checkmodule -M -m -o my-dnsmasq.mod my-dnsmasq.te
semodule_package -o my-dnsmasq.pp -m my-dnsmasq.mod

Once you get the policy module package file my-dnsmasq.pp, install it:

sudo semodule -i my-dnsmasq.pp

Finally, restart the dnsmasq.service:

sudo systemctl restart dnsmasq

And make a test like below:

nslookup google.com.tw
ipset list gfwlist

If everything is fine, you will see a ip is added to ipset.

1

You don't need to create a custom SELinux module, there is an SELinux boolean to enable ipset:

sudo setsebool -P dnsmasq_use_ipset 1

Using -P will make the change persistent.

-3

I found this article SELinux prevents ipset from creating a netlink socket, and I disabled SELinux, then it worked. I don't know why.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.