On Saturday 21 July 2007, Mogens Kjaer wrote:
> Mogens Kjaer wrote:
> ...
>
> > # ls -lZ /etc/rsyncd.conf
> > -rw-r--r-- root root root:object_r:etc_t /etc/rsyncd.conf
> > # ls -lZ /var/log/rsyncd.log
> > -rw-r--r-- root root root:object_r:var_log_t
> > /var/log/rsyncd.log
>
> If I reboot with selinux=disabled logging works to
> the /var/log/rsyncd.log file. If I enable selinux
> again, touch /.autorelabel and reboot, logging
> goes back to /var/log/messages.
I'm sorry for misleading you, my config wasn't as vanilla as I thought. A
colleague had done some selinux magic to enable rsync to work the way it
does.
We have a custom selinux module which looks like this (header + rsync part):
---- begin custom.te ----
policy_module(custom,1.0.4)
require {
class dir { add_name getattr lock read search write };
class file { append create getattr lock read write };
class lnk_file { getattr read };
type ftpd_t;
type httpd_sys_content_t;
type httpd_t;
type rsync_t;
type var_log_t;
role system_r;
};
allow rsync_t var_log_t:file { append getattr };
allow rsync_t httpd_sys_content_t:dir { getattr read search };
allow rsync_t httpd_sys_content_t:file { getattr read };
allow rsync_t httpd_sys_content_t:lnk_file { getattr read };
---- end custom.te ----
The key line is the "allow rsync_t var_log_t"-one. This allows rsync to write
to files /var (files there inherit var_log_t). The above is not a complete
instruction on how to get it to work but should be enough to get you started
in the right direction (unless you haven't already left selinux behind you,
hehe). You might also want to read the manpage for semodule.
/Peter
> I don't see any SELinux errors.
>
> Mogens
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part.
URL: <http://lists.centos.org/pipermail/centos/attachments/20070722/9639f239/attachment-0005.sig>