Description of problem:

Currently if SELinux enabled on Fedora 16+ or RHEL6 and awstats installed (via EPEL for RHEL) - enabling "PurgeLogFile=1" option creates SELinux denials.

Version-Release number of selected component (if applicable):

RHEL:
awstats-7.0-2.el6.noarch
selinux-policy-3.7.19-155.el6_3.4.noarch
selinux-policy-targeted-3.7.19-155.el6_3.4.noarch

F16:
awstats-7.0-6.fc16.noarch
selinux-policy-3.10.0-91.fc16.noarch
selinux-policy-targeted-3.10.0-91.fc16.noarch

How reproducible:

always

Steps to Reproduce:
1. install Fedora/RHEL+EPEL
2. enable SELinux
3. install awstats
4. configure awstats to purge httpd log files:
PurgeLogFile=1
  
Actual results:

type=AVC msg=audit(1349467262.084:790): avc:  denied  { write } for  pid=7413 comm="awstats.pl" name="moodle22-access_log" dev=dm-6 ino=39 scontext=system_u:system_r:awstats_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:httpd_log_t:s0 tclass=file

and un-purged files.

Expected results:

files processed by awstats and logfiles purged after processing.

Additional info:

I have "fixed" it locally by building additional SELinux policy module:

module awstats-httpd-logs 1.1;

require {
        type httpd_log_t;
        type awstats_t;
        class file write;
}

#============= awstats_t ==============
allow awstats_t httpd_log_t:file write;

however I believe it should be part of base awstats module with a tunable boolean switching on/off behavior with default to "off".