IJ35466: SELINUX SUPPORT FOR FILE AUDIT LOGGING FILESET

APAR status

• Closed as program error.

Error description

• When a subfolder or audit log is created under the
  File Audit Logging fileset, it inherits a default
  selinux security context. This default value
  does not allow applications such as rsyslog
  the ablility to read the audit log contents.
  

Local fix

Problem summary

• When a subfolder or audit log is created under the
  File Audit Logging fileset, it inherits a default
  selinux security context. This default value
  does not allow applications such as rsyslog
  the ablility to read the audit log contents.
  

Problem conclusion

• This problem is fixed in 5.1.2  PTF 1
  To see all Spectrum Scale APARs and
  their respective fix solutions refer to page
  https://public.dhe.ibm.com/storage/spectrumscale/spectrum_scale_
  apars.html
  
  Benefits of the solution:
  Selinux support on the File Audit Logging
  fileset will allow applications, such as rsyslog,
  to read the contents of the log file. These log
  contents can then be forwarded to other
  applications like IBM QRadar for additional insights.
  Work around: N/A
  Problem trigger: N/A
  Symptom:  Unexpected Results/Behavior
  Platforms affected: ALL Linux OS environments
  Functional Area affected: File audit logging
  Customer Impact: Suggested
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  SPEC SCALE STD

• Fixed component ID

  5737F33AP

Applicable component levels