logwatch AVCs

[Paul Howarth]

FC6, on a system using LDAP auth:

type=AVC msg=audit(1174305023.309:160): avc:  denied  { create } for 
pid=5320 comm="perl" 
scontext=system_u:system_r:logwatch_t:s0-s0:c0.c1023 
tcontext=system_u:system_r:logwatch_t:s0-s0:c0.c1023 
tclass=netlink_route_socket
type=SYSCALL msg=audit(1174305023.309:160): arch=40000003 syscall=102 
success=no exit=-13 a0=1 a1=bfafaf20 a2=4933dff4 a3=bfafb19d items=0 
ppid=5318 pid=5320 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 
egid=0 sgid=0 fsgid=0 tty=(none) comm="perl" exe="/usr/bin/perl" 
subj=system_u:system_r:logwatch_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1174305023.311:161): avc:  denied  { create } for 
pid=5320 comm="perl" 
scontext=system_u:system_r:logwatch_t:s0-s0:c0.c1023 
tcontext=system_u:system_r:logwatch_t:s0-s0:c0.c1023 
tclass=unix_dgram_socket
type=SYSCALL msg=audit(1174305023.311:161): arch=40000003 syscall=102 
success=no exit=-13 a0=1 a1=bfafb2a4 a2=4933dff4 a3=14 items=0 ppid=5318 
pid=5320 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 
fsgid=0 tty=(none) comm="perl" exe="/usr/bin/perl" 
subj=system_u:system_r:logwatch_t:s0-s0:c0.c1023 key=(null)

I added rules:

# Allow logwatch to send syslog messages and read the routing table
allow logwatch_t self:netlink_route_socket { r_netlink_socket_perms };
logging_send_syslog_msg(logwatch_t)

The syslog messages being sent were along the lines of:

Mar 19 11:52:33 xy01m005 perl: nss_ldap: failed to bind to LDAP server 
ldap://10.1.0.65: Can't contact LDAP server
Mar 19 11:52:33 xy01m005 perl: nss_ldap: could not search LDAP server - 
Server is unavailable
Mar 19 11:52:34 xy01m005 perl: nss_ldap: failed to bind to LDAP server 
ldap://10.1.0.65: Can't contact LDAP server
Mar 19 11:52:34 xy01m005 perl: nss_ldap: failed to bind to LDAP server 
ldap://10.1.0.65: Can't contact LDAP server
Mar 19 11:52:34 xy01m005 perl: nss_ldap: reconnecting to LDAP server 
(sleeping 4 seconds)...

So these were valid messages that I needed to see...

Paul.