On Friday 31 December 2004 03:03, Steve Friedman <steve@xxxxxxxxxxx> wrote:
> I recently installed FC3 on a machine (we had previously been using FC1),
> so this is my first exposure to selinux. Consequently, we are running
> the targeted policy in permissive mode. We use syslog-ng (rather than
> sysklogd) and have updated the syslog-ng.conf to monitor/log/distribute
> log events on a number of other ports beyond the standard syslog
> distribution.
>
> Among other things that we do in syslog-ng include:
> - open non-standard UDP/TCP ports
> - open non-standard files
> - call non-standard routines
>
> As a complete newbie to selinux, I don't know whether it is
> easier/simpler/better/(or even how) to modify the syslog policy or the
> attributes of the executables/files/directories that it touches. I would
> appreciate some advice and guidance.
>
> AVC log events:
>
> Dec 27 04:02:17 gsi10 kernel: audit(1104138137.142:0): avc: denied {
> write } for pid=16201 exe=/sbin/syslog-ng name=kmsg dev=proc
> ino=-268435446 scontext=system_u:system_r:syslogd_t
> tcontext=system_u:object_r:proc_kmsg_t tclass=file Dec 27 04:02:17 gsi10
If you remove klogd.te from the policy source then that access will be
allowed. I guess we could just assume that syslog-ng is being used if there
is no klogd.te and put the necessary rules for TCP access in the same
section.
--
http://www.coker.com.au/selinux/ My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/ Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/ Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/ My home page
