I’ve got Centos 7 based Bacula installation with storage daemon writing to file volumes located on ZFS filesystem. Chown’ing filesystem to user bacula was not enough, SElinux being SElinux didn’t particularly like bacula writing to location chosen by me (/tank/backup) as it expects Bacula to write to /bacula by default.
Lets identify available Bacula contexts and re-label /tank/backup accordingly
# semanage fcontext -l | grep bacula /bacula(/.*)? all files system_u:object_r:bacula_store_t:s0 /etc/bacula.* all files system_u:object_r:bacula_etc_t:s0 /var/bacula(/.*)? all files system_u:object_r:bacula_store_t:s0 /var/lib/bacula.* all files system_u:object_r:bacula_var_lib_t:s0 /var/log/bacula.* all files system_u:object_r:bacula_log_t:s0 /var/run/bacula.* regular file system_u:object_r:bacula_var_run_t:s0 /usr/sbin/bacula.* regular file system_u:object_r:bacula_exec_t:s0 /var/spool/bacula.* all files system_u:object_r:bacula_spool_t:s0 /var/spool/bacula/log(/.*)? all files system_u:object_r:var_log_t:s0 /etc/rc\.d/init\.d/bacula.* regular file system_u:object_r:bacula_initrc_exec_t:s0 /usr/sbin/bat regular file system_u:object_r:bacula_admin_exec_t:s0 /usr/sbin/bconsole regular file system_u:object_r:bacula_admin_exec_t:s0
Ahh OK, so it’s called “system_u:object_r:bacula_store_t:s0” – lets apply it
chcon system_u:object_r:bacula_store_t:s0 /tank/backup semanage fcontext -a -t bacula_store_t "/tank/backup(/.*)?" restorecon -R -v /tank/backup
Same will work if your Centos 7 client will refuse to restore data to /bacula-restores, with message in server log:
26-Sep 14:40 death-star JobId 24822: Error: mkpath.c:138 Cannot create directory /bacula-restores/backup: ERR=Permission denied
and message in client log:
type=AVC msg=audit(1474897201.721:307): avc: denied { write } for pid=26477 comm="bacula-fd" name="bacula-restores" dev="vda1" ino=159551617 scontext=system_u:system_r:bacula_t:s0 tcontext=unconfined_u:object_r:default_t:s0 tclass=dir
Simply run:
chcon system_u:object_r:bacula_store_t:s0 /bacula-restores semanage fcontext -a -t bacula_store_t "/bacula-restores(/.*)?" restorecon -R -v /bacula-restores ls -lZ /
and now your restore job will run just fine. Magic.