Trouble with syslogd and named

[Daniel J Walsh]

Harley Race wrote:
> --- Daniel J Walsh <dwalsh at redhat.com> wrote:
>
>   
>> If you execute chcon -t var_log_t named.log  does it
>> work.
>>     
>
> Unfortunately, no.  I tried that before trying to get
> your help.  I still get the same errors (listed
> below):
>
> logd_t:s0 tcontext=system_u:object_r:named_zone_t:s0
> tclass=dir
> type=SYSCALL msg=audit(1168881210.223:807):
> arch=40000003 syscall=10 success=no exit=-13
> a0=bfc96f7d a1=1b6 a2=699120 a3=bfc95e8c items=0
> ppid=20859 pid=20860 auid=500 uid=0 gid=0 euid=0
> suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none)
> comm="syslogd" exe="/sbin/syslogd"
> subj=user_u:system_r:syslogd_t:s0 key=(null)
> type=AVC msg=audit(1168881210.223:808): avc:  denied 
> { search } for  pid=20860 comm="syslogd" name="named"
> dev=dm-3 ino=10704673
> scontext=user_u:system_r:syslogd_t:s0
> tcontext=system_u:object_r:named_zone_t:s0 tclass=dir
> type=SYSCALL msg=audit(1168881210.223:808):
> arch=40000003 syscall=102 success=no exit=-13 a0=2
> a1=bfc93a30 a2=699120 a3=bfc95e8c items=0 ppid=20859
> pid=20860 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0
> egid=0 sgid=0 fsgid=0 tty=(none) comm="syslogd"
> exe="/sbin/syslogd" subj=user_u:system_r:syslogd_t:s0
> key=(null)
>
> Maybe I am missing some thing here, but shouldn't
> syslogd be able to create the device "/dev/log" in the
> chroot for named?  
>
>   
Well you can either add custom policy using audit2allow, or you could 
have syslog write to /var/log/named.log and then mount -o bind into 
/var/named/chroot like they do with the other stuff.


If I understand correctly what you are trying to do.