selinux: Allow collectd to write in /var/log/

Signed-off-by: Zack Cerza <zack@redhat.com>

diff --git a/selinux/cephmetrics.te b/selinux/cephmetrics.te
index 75367b580980f29b6f699659708e152876e88625..f7d39cb3bfda42f8c00db785de7b44d9293743e7 100644 (file)
--- a/selinux/cephmetrics.te
+++ b/selinux/cephmetrics.te
@@ -17,6 +17,8 @@ require {
 allow collectd_t ceph_t:unix_stream_socket connectto;
 allow collectd_t ceph_var_run_t:dir read;
 allow collectd_t self:capability2 block_suspend;
+allow collectd_t var_log_t:dir { add_name write };
+allow collectd_t var_log_t:file create;
 corecmd_exec_shell(collectd_t)
 files_list_tmp(collectd_t)
 libs_exec_ldconfig(collectd_t)