<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="generator" content="Osso Notes">
<title></title></head>
<body>
<p>hi,
<br>
<br>I'm not an selinux expert, but var_run_t is strange as a type in a directory under /var/log. So I would agree with this change.
<br>
<br>but I guess it's the builtin policy, so you'd probably need to file a ticket against selinux-policy to have it fixed.
<br>
<br>----- Original message -----
<br>> Hi,
<br>>
<br>> I'm having some trouble with selinux blocking syslog-ng from creating
<br>> directories
<br>>
<br>> type=1400 audit(1361437595.431:297527809): avc:  denied  { create } for  
<br>> pid=2835 comm="syslog-ng" name="21"
<br>> scontext=system_u:system_r:syslogd_t:s0
<br>> tcontext=system_u:object_r:syslogd_var_run_t:s0 tclass=dir
<br>> printk: 512913 messages suppressed.
<br>>
<br>> There is a line which seems to define this context in:
<br>> /etc/selinux/targeted/contexts/files/file_contexts
<br>>
<br>> /var/log/syslog-ng(/.*)? system_u:object_r:syslogd_var_run_t:s0
<br>>
<br>>
<br>> If I manually change the context to  var_log_t  as per: /var/log/.*  
<br>> system_u:object_r:var_log_t:s0
<br>>
<br>> then it creates the directory successfully.
<br>>
<br>> I believe the policy configuration is standard and undoctored so believe
<br>> there could be a problem with it?  Does anyone have a similar
<br>> environment or some knowledge on this?
<br>>
<br>> greets
<br>> -Stu
<br>>
<br>>
<br>>
<br>>
<br>> ______________________________________________________________________________
<br>> Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a>
<br>> Documentation:
<br>> <a href="http://www.balabit.com/support/documentation/?product=syslog-ng">http://www.balabit.com/support/documentation/?product=syslog-ng</a> FAQ:
<br>> <a href="http://www.balabit.com/wiki/syslog-ng-faq">http://www.balabit.com/wiki/syslog-ng-faq</a>
<br>>
<br><br></p>
</body>
</html>