Description of problem:
rsyslog can drop privileges with option $PrivDropToUser and $PrivDropToGroup, but SElinux does not allow setuid/setgid.

Version-Release number of selected component (if applicable):
selinux-policy-3.7.19-195.el6_4.10.noarch

How reproducible:
100%


Steps to Reproduce:
1. Create user rsyslog with: useradd -r rsyslog 
2. Remove line "$ModLoad imklog" to rsyslog.conf
3. Add line "$PrivDropToUser rsyslog" to rsyslog.conf
3. Fix permission in /var/log/ to allow writes
4. restart

Actual results:
could not set requested userid: Operation not permitted

Expected results:
no output, and eUID 


Additional info:
I created the following te to fix this:
module rsyslog-drop-priv 1.0;

require {
        type syslogd_t;
        class capability setuid;
        class capability setgid;
}

#============= syslogd_t ==============
allow syslogd_t self:capability setuid;
allow syslogd_t self:capability setgid;