I have these two parameters in /etc/rsyslog.conf

$ModLoad imjournal # provides access to the systemd journal
# Turn off message reception via local log socket;
# local messages are retrieved through imjournal now.
$OmitLocalLogging on

I got problems with SELinux, Rsyslog logged this:

Jun  6 10:53:14 vpod1-logm-front-3 rsyslogd: fopen() failed: 'Permission denied', path: '/var/spool/imjournal.state.tmp'  [v8.24.0 try http://www.rsyslog.com/e/2013 ]

I had to add a new policy (generated by audit2alow)

cat  >syslog-imjournal.te << EOF
module syslog-imjournal 1.0;

require {
        type syslogd_t;
        type var_spool_t;
        class dir { add_name remove_name write };
        class file { create rename unlink write };

#============= syslogd_t ==============

allow syslogd_t var_spool_t:dir write;
allow syslogd_t var_spool_t:dir { add_name remove_name };
allow syslogd_t var_spool_t:file { create rename unlink write };

checkmodule  -m -o syslog-imjournal.m syslog-imjournal.te
semodule_package --module syslog-imjournal.m --outfile syslog-imjournal.pp
semodule --install=syslog-imjournal.pp --priority=400 

I don't know if it is secure to do this, is there a better way?

  • If you downvote this question could you please tell me why so I can ask a better question? – Emmanuel Jun 7 at 12:42

I think the problem is that you are storing the “imjournal.state” file in the wrong location, so SELinux is blocking writes. Rather than creating a custom policy module that grants too much permissions, you should use the default location, which is /var/lib/rsyslog. The default config says:

$WorkDirectory /var/lib/rsyslog
$IMJournalStateFile imjournal.state
  • The rsyslog.conf had that lines. I found that someone put a conf in /etc/rsyslog.d/ with $WorkDirectory /var/spool. I suppose that it was some deployment with a wrong target. Although I dont understand where they took to use that directory. Thank you to remember me the basics and taking the time to answer that question (which I realize was a really malformed question). – Emmanuel Jun 11 at 9:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.