[gentoo-hardened] Questions about SELinux

[Robert Sharp]

Hi there,

is this the best place to raise questions about SELinux, or would I be 
better trying chat? I am making a big effort to get to enforcing strict 
on a simple server and I am struggling a little.

For example, I run Rsyslog and I have lots of AVCs concerning denied 
sendto's to /dev/log. The target context is usually sysadm_t, which does 
not seem right, and I also notice that Rsyslog is in the same context. I 
would expect it to be in a context involving syslog somehow. I have 
restarted the service from the sysadm_r role and it makes no difference. 
Also, I do not get asked to authenticate when starting the service, 
whereas other services require this, and, there is no entry for rsyslog 
in rc-status display despite it being installed in the default runlevel.

Example AVCs:

type=AVC msg=audit(1478957011.808:1910): avc:  denied  { sendto } for  
pid=6043 comm="smtp" path="/dev/log" 
scontext=system_u:system_r:postfix_smtp_t 
tcontext=staff_u:sysadm_r:sysadm_t tclass=unix_dgram_socket permissive=1

type=AVC msg=audit(1478953126.199:1909): avc:  denied  { sendto } for  
pid=5949 comm="cleanup" path="/dev/log" 
scontext=system_u:system_r:postfix_cleanup_t 
tcontext=staff_u:sysadm_r:sysadm_t tclass=unix_dgram_socket permissive=1

type=AVC msg=audit(1478952507.872:1907): avc:  denied  { sendto } for  
pid=3099 comm="krb5kdc" path="/dev/log" 
scontext=system_u:system_r:krb5kdc_t tcontext=staff_u:sysadm_r:sysadm_t 
tclass=unix_dgram_socket permissive=1


There does not appear to be any specific rsyslog selinux package so I 
assume it should all be syslog-related and already in the core policy 
(although I cannot find it there). I also note that Red Hat has a page 
on setting up Rsyslog in SELinux so I feel fairly sure it should work. 
It only tells you how to change the ports, however. I am using TCP on 
port 514 but I don't think I need to do anything according to RH.

Have I missed something, done something fundamentally wrong, or just 
need to add something to stop the AVCs? Not keen on blindly fixing 
things so I want to know what I need to do and why before I do it.

Thanks in anticipation,
Robert Sharp