Bug 716973

Description of problem:

This is related to Bug 701782 - rsyslog TLS does not encrypt traffic on s390x and ppc64 systems

I have followed the scenarion with the updated rsyslog package and rsyslogd crashes because of selinux.

----
time->Mon Jun 27 11:34:27 2011
type=SYSCALL msg=audit(1309188867.471:300692): arch=80000015 syscall=33 success=no exit=-13 a0=fff972d07e8 a1=4 a2=8 a3=fff8801a188 items=0 ppid=1 pid=31973 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=16 comm=72733A6D61696E20513A526567 exe="/sbin/rsyslogd" subj=unconfined_u:system_r:syslogd_t:s0 key=(null)
type=AVC msg=audit(1309188867.471:300692): avc:  denied  { read } for  pid=31973 comm=72733A6D61696E20513A526567 name="random" dev=devtmpfs ino=873 scontext=unconfined_u:system_r:syslogd_t:s0 tcontext=system_u:object_r:random_device_t:s0 tclass=chr_file

Enabling allow_ypbind boolean and following module fixed the problem.

# cat mypol.te

module mypol 1.0;

require {
	type syslogd_t;
	type random_device_t;
	class chr_file read;
}

#============= syslogd_t ==============
allow syslogd_t random_device_t:chr_file read;


But even after that I was getting this AVC, should be probalby allowed too.

----
time->Mon Jun 27 11:32:09 2011
type=SYSCALL msg=audit(1309188729.835:261218): arch=80000016 syscall=150 per=400000 success=yes exit=0 a0=20002bda000 a1=8000 a2=3 a3=22 items=0 ppid=1 pid=57364 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=3 comm="rsyslogd" exe="/sbin/rsyslogd" subj=unconfined_u:system_r:syslogd_t:s0 key=(null)
type=AVC msg=audit(1309188729.835:261218): avc:  denied  { ipc_lock } for  pid=57364 comm="rsyslogd" capability=14  scontext=unconfined_u:system_r:syslogd_t:s0 tcontext=unconfined_u:system_r:syslogd_t:s0 tclass=capability

That was fixed with

# cat mypolB.te

module mypolB 1.0;

require {
	type syslogd_t;
	class capability ipc_lock;
}

#============= syslogd_t ==============
allow syslogd_t self:capability ipc_lock;


Version-Release number of selected component (if applicable):
selinux-policy-3.7.19-93.el6_1.1.noarch

How reproducible:
always

Steps to Reproduce:
follow https://bugzilla.redhat.com/show_bug.cgi?id=701782#c1
  
Actual results:
rsyslogd crashes

Expected results:
test scenarion working

Additional info: