Re: Boot time avc messages

[Dale Amon <amon@vnl.com>]

On Sat, Sep 20, 2003 at 04:32:59PM +1000, Russell Coker wrote:
> > Still loads of messages from syslog-ng. I wonder if I'm the
> > first user of this policy who actually uses the full capability
> > of remote logging with syslog-ng? I'm going to see if I can
> 
> Probably.  Let me know what you are getting and I'll change my policy 
> accordingly.

The test machine is a particularly simple setup and doesn't
use as much of the capabilities of the remote logging as some
of my "real" machines. However, this is what I have at the moment:

allow syslogd_t port_t:tcp_socket { name_bind };
allow syslogd_t syslogd_t:capability { fsetid };
allow syslogd_t tty_device_t:chr_file { setattr };

avc:  denied  { name_bind } for  pid=221 
      exe=/sbin/syslog-ng 
      port=999 
      scontext=system_u:system_r:syslogd_t 
      tcontext=system_u:object_r:port_t 
      tclass=tcp_socket

avc:  denied  { fsetid } for  pid=221 
      exe=/sbin/syslog-ng 
      capability=4 
      scontext=system_u:system_r:syslogd_t 
      tcontext=system_u:system_r:syslogd_t 
      tclass=capability

avc:  denied  { setattr } for  pid=221 
      exe=/sbin/syslog-ng 
      dev=sda2 
      ino=946940 
      scontext=system_u:system_r:syslogd_t 
      tcontext=system_u:object_r:tty_device_t 
      tclass=chr_file

> Why does it use port 999?

There are 3 ports discussed in the manual
(found at http://www.balabit.com/products/syslog_ng/reference/book1.html).

The internal default is to listen on 514 tcp and/or udp or send to
that port. However it is also used by rshell, so many people
use the document's example ports instead and place this line in 
syslog-ng.conf:

	    destination d_tcp { tcp("10.1.2.3" port(1999); localport(999)); };
 

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.