syslog-ng non-standard install generating AVC
Daniel J Walsh
dwalsh at redhat.com
Fri Dec 31 03:43:54 UTC 2004
You could add these lines to syslog.te
can_exec(syslog_t, { bin_t shell_exec_t } )
allow syslogd_t etc_runtime_t:file { getattr read };
allow syslogd_t proc_kmsg_t:file write;
allow syslogd_t proc_t:file { getattr read };
allow syslogd_t sbin_t:dir search;
allow syslogd_t self:capability { chown fowner fsetid sys_admin };
There is some directory in /usr that needs to be relabeled
syslogd_var_run_t to eliminate the following
allow syslogd_t usr_t:dir { add_name remove_name write };
allow syslogd_t usr_t:file { append create getattr read setattr unlink
write };
More information about the fedora-selinux-list
mailing list