Description of problem:
If you configure rsyslogd to open more than the default number of file descriptors, the SELinux policy blocks it from calling setrlimit.

Version-Release number of selected component (if applicable):
selinux-policy-2.4.6-300.el5
rsyslog-3.22.1-3.el5_5.1

How reproducible:
every time

Steps to Reproduce:
1. Edit /etc/rsyslog.conf and add the directive near the top
       $MaxOpenFiles 2100
2. service rsyslog start
3. tail /var/log/messages
  
Actual results:
Feb  1 16:55:29 scorpion setroubleshoot: SELinux is preventing rsyslogd (syslogd_t) "setrlimit" to <Unknown> (syslogd_t). For complete SELinux messages. run sealert -l 77fe5060-0357-470b-ace6-4c30f7c589ca

Expected results:
SELinux doesn't block rsyslogd from increasing the open file limit

Additional info:
Summary:

SELinux is preventing rsyslogd (syslogd_t) "setrlimit" to <Unknown> (syslogd_t).

Detailed Description:

SELinux denied access requested by rsyslogd. It is not expected that this access
is required by rsyslogd and this access may signal an intrusion attempt. It is
also possible that the specific version or configuration of the application is
causing it to require additional access.

Allowing Access:

You can generate a local policy module to allow this access - see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable
SELinux protection altogether. Disabling SELinux protection is not recommended.
Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
against this package.

Additional Information:

Source Context                user_u:system_r:syslogd_t
Target Context                user_u:system_r:syslogd_t
Target Objects                None [ process ]
Source                        rsyslogd
Source Path                   /sbin/rsyslogd
Port                          <Unknown>
Host                          scorpion.localdomain
Source RPM Packages           rsyslog-3.22.1-3.el5_5.1
Target RPM Packages           
Policy RPM                    selinux-policy-2.4.6-300.el5
Selinux Enabled               True
Policy Type                   targeted
MLS Enabled                   True
Enforcing Mode                Enforcing
Plugin Name                   catchall
Host Name                     scorpion.localdomain
Platform                      Linux scorpion.localdomain 2.6.18-238.1.1.el5 #1
                              SMP Tue Jan 4 13:32:19 EST 2011 x86_64 x86_64
Alert Count                   5
First Seen                    Tue Feb  1 16:07:52 2011
Last Seen                     Tue Feb  1 16:55:29 2011
Local ID                      77fe5060-0357-470b-ace6-4c30f7c589ca
Line Numbers                  

Raw Audit Messages            

host=scorpion.localdomain type=AVC msg=audit(1296600929.907:363): avc:  denied  { setrlimit } for  pid=8643 comm="rsyslogd" scontext=user_u:system_r:syslogd_t:s0 tcontext=user_u:system_r:syslogd_t:s0 tclass=process

host=scorpion.localdomain type=SYSCALL msg=audit(1296600929.907:363): arch=c000003e syscall=160 success=no exit=-13 a0=7 a1=7ffffe700590 a2=30 a3=0 items=0 ppid=8642 pid=8643 auid=12257 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=9 comm="rsyslogd" exe="/sbin/rsyslogd" subj=user_u:system_r:syslogd_t:s0 key=(null)