Hi Eero and Elias,

So seeting it to cert_t worked, as did:
semanage fcontext -a -t etc_t "/etc/grid-security(/.*)?"
I chose etc_t as when I did an ls -Z the certificates folder had this to 
begin with and was happy, where as the hostkeys and certs had admin_home.

The output of audit2why is here, I do not understand it at all.

# tail /var/log/audit/audit.log | audit2why
type=AVC msg=audit(1406108140.477:6317): avc:  denied  { search } for  
pid=9753 comm=72733A6D61696E20513A526567 name="grid-security" dev=dm-0 
ino=131479 scontext=unconfined_u:system_r:syslogd_t:s0 
tcontext=unconfined_u:object_r:syslog_conf_t:s0 tclass=dir

     Was caused by:
         Missing type enforcement (TE) allow rule.

         You can use audit2allow to generate a loadable module to allow 
this access.

type=AVC msg=audit(1406108140.479:6318): avc:  denied  { search } for  
pid=9753 comm=72733A6D61696E20513A526567 name="grid-security" dev=dm-0 
ino=131479 scontext=unconfined_u:system_r:syslogd_t:s0 
tcontext=unconfined_u:object_r:syslog_conf_t:s0 tclass=dir

     Was caused by:
         Missing type enforcement (TE) allow rule.

         You can use audit2allow to generate a loadable module to allow 
this access.


I would like to understand SELinux and how to audit the problems, but I 
have not found a good entry level guide.  Usually the problems I have 
are simple such as ssh-key permissions or httpd problems - google has 
always had a solution, I just do not know how to get to these solutions 
myself.

Regards,
Robin.


On 23/07/14 10:18, Elias Persson wrote:
> On 2014-07-23 10:43, Robin Long wrote:
>> Hi Eero,
>>
>> Thanks for the advice.  That command does not seem to work, it changes
>> the context from:
>>
>> drwxr-x---. root root unconfined_u:object_r:etc_t:s0 certificates
>> -rw-r-----. root root unconfined_u:object_r:admin_home_t:s0 hostcert.pem
>> -rw-r-----. root root unconfined_u:object_r:admin_home_t:s0 hostkey.pem
>>
>> to
>>
>> drwxr-x---. root root unconfined_u:object_r:syslog_conf_t:s0 
>> certificates
>> -rw-r-----. root root unconfined_u:object_r:syslog_conf_t:s0 
>> hostcert.pem
>> -rw-r-----. root root unconfined_u:object_r:syslog_conf_t:s0 hostkey.pem
>>
>> but then results in the error:
>> could not load module '/lib64/rsyslog/lmnsd_gtls.so', rsyslog error 
>> -2078
>>
>> which usually translates as "cannot read your CA file".
>>
>
> What do you get from:
>
>   tail /var/log/audit/audit.log | audit2why
>
> (shortly after getting that error).