| Main Archive Page > Month Archives > selinux archives |
Re: refpolicy HEAD, patch for Debian logs of syslog rotation
From: Christopher J. PeBenito <cpebenito_at_nospam>Date: Wed Dec 12 2007 - 16:11:13 GMT
To: Václav Ovsík <vaclav.ovsik@i.cz>
On Tue, 2007-12-11 at 15:52 +0100, Václav Ovsík wrote:
> there is another change for the refpolicy, so the Debian system can run
> /etc/cron.daily/sysklogd successfully. This is rotation for logs parsed
> from syslog.conf config file. Script /usr/sbin/syslogd-listfiles lists
> logs, that needs rotation. Logs are rotated using script
> /usr/bin/savelog then.
>
> Without attached patch domain logrotate_t is not allowed to read
> syslog_conf_t and following denials are generated:
>
> audit(1197384508.149:3): avc: denied { read } for pid=1589 comm="syslogd-listfil" name="syslog.conf" dev=sda1 ino=213265 scontext=system_u:system_r:logrotate_t:s0 tcontext=system_u:object_r:syslog_conf_t:s0 tclass=file
> audit(1197384508.149:4): avc: denied { ioctl } for pid=1589 comm="syslogd-listfil" name="syslog.conf" dev=sda1 ino=213265 scontext=system_u:system_r:logrotate_t:s0 tcontext=system_u:object_r:syslog_conf_t:s0 tclass=file
> audit(1197384508.149:5): avc: denied { getattr } for pid=1589 comm="syslogd-listfil" name="syslog.conf" dev=sda1 ino=213265 scontext=system_u:system_r:logrotate_t:s0 tcontext=system_u:object_r:syslog_conf_t:s0 tclass=file
Merged. I renamed the interface and moved the te file change lower to the preexisting distro_debian block. -- Chris PeBenito Tresys Technology, LLC (410) 290-1411 x150 -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message.