Configure SELinux

If you have SELinux active on your system, you must add Splunk to the list of authenticated applications that can run in your SELinux environment.

To configure SELinux to allow Splunk to run, you need to run the chcon command on the Splunk lib directory, where $SPLUNK_HOME is the path to your Splunk installation:

chcon -c -v -R -u system_u -r object_r -t lib_t $SPLUNK_HOME/lib 2>&1 > /dev/null

After you configure SELinux to allow Splunk to run, you can disable the check from occurring each time you start Splunk. To disable the SELinux check, add this line to $SPLUNK_HOME/etc/splunk-launch.conf:

SPLUNK_IGNORE_SELINUX=1

Important: Depending on the SELinux distribution, if you turn off the check before configuring SELinux, Splunk may not function properly.

Previous: Run Splunk as non-root user | Next: Uninstall Splunk manually

Comments

[root@serverc]# chcon -c -v -R -u system_u -r object_r -t lib_t $SPLUNK_HOME/lib 2>&1 > /dev/null
chcon: can't apply partial context to unlabeled file /opt/splunk/lib
Posted by eflynn on Sep 15 2008, 3:31pm
thank you, meeas. i've updated the topic.
Posted by rachel on Mar 10 2008, 2:22pm
Don't put "export" in front of "SPLUNK_IGNORE_SELINUX=1" in splunk-launch.conf. Just set the variable to "1".

This was an artifact from the previous 3.1.5 documentation that they missed.
Posted by meeas on Mar 08 2008, 4:01pm