From e80a5063c43f7a98c80513cb2b9078fec7fd48ed Mon Sep 17 00:00:00 2001 From: Yi Zhao Date: Thu, 4 Feb 2016 02:10:15 -0500 Subject: logging: allow systemd-journal to manage syslogd_runtime_t sock_file Fixes: avc: denied { write } for pid=165 comm="systemd-journal" name="syslog" dev="tmpfs" ino=545 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:syslogd_runtime_t tclass=sock_file permissive=0 Signed-off-by: Yi Zhao Signed-off-by: Kenton Groombridge --- policy/modules/system/logging.te | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te index 0b05b433..69b7aa41 100644 --- a/policy/modules/system/logging.te +++ b/policy/modules/system/logging.te @@ -437,7 +437,7 @@ files_search_var_lib(syslogd_t) # manage runtime files allow syslogd_t syslogd_runtime_t:dir create_dir_perms; -allow syslogd_t syslogd_runtime_t:sock_file { create setattr unlink }; +allow syslogd_t syslogd_runtime_t:sock_file manage_sock_file_perms; allow syslogd_t syslogd_runtime_t:file map; manage_files_pattern(syslogd_t, syslogd_runtime_t, syslogd_runtime_t) files_runtime_filetrans(syslogd_t, syslogd_runtime_t, file) -- cgit v1.2.3-65-gdbad