[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: Trouble with syslogd and named



Harley Race wrote:
--- Daniel J Walsh <dwalsh redhat com> wrote:

If you execute chcon -t var_log_t named.log  does it
work.

Unfortunately, no.  I tried that before trying to get
your help.  I still get the same errors (listed
below):

logd_t:s0 tcontext=system_u:object_r:named_zone_t:s0
tclass=dir
type=SYSCALL msg=audit(1168881210.223:807):
arch=40000003 syscall=10 success=no exit=-13
a0=bfc96f7d a1=1b6 a2=699120 a3=bfc95e8c items=0
ppid=20859 pid=20860 auid=500 uid=0 gid=0 euid=0
suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none)
comm="syslogd" exe="/sbin/syslogd"
subj=user_u:system_r:syslogd_t:s0 key=(null)
type=AVC msg=audit(1168881210.223:808): avc: denied { search } for pid=20860 comm="syslogd" name="named"
dev=dm-3 ino=10704673
scontext=user_u:system_r:syslogd_t:s0
tcontext=system_u:object_r:named_zone_t:s0 tclass=dir
type=SYSCALL msg=audit(1168881210.223:808):
arch=40000003 syscall=102 success=no exit=-13 a0=2
a1=bfc93a30 a2=699120 a3=bfc95e8c items=0 ppid=20859
pid=20860 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0
egid=0 sgid=0 fsgid=0 tty=(none) comm="syslogd"
exe="/sbin/syslogd" subj=user_u:system_r:syslogd_t:s0
key=(null)

Maybe I am missing some thing here, but shouldn't
syslogd be able to create the device "/dev/log" in the
chroot for named?
Well you can either add custom policy using audit2allow, or you could have syslog write to /var/log/named.log and then mount -o bind into /var/named/chroot like they do with the other stuff.


If I understand correctly what you are trying to do.


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]