Greetings,

I have a 64 bit EL 5.2 system that I have built and installed all of the necessary packages for the latest audit (1.7.11-1), prelude and prewikka. (Does anyone need any binary RPM packages?).

This all seems to be working fine on the central cluster server and now I'm trying to set up clients in the cluster nodes to report their audit information to the server.  I've found the  RHEL 5.3 release notes where it says:
In addition to the listed enhancements, these updated audit packages also include a new feature to allow a server to aggregate the logs of remote systems. The following instructions can be followed to enable this feature:
  1. The audispd-plugins package should be installed on all clients (but need not be installed on the server), and the parameters for "remote_server" and "port" should be set in the /etc/audisp/audisp-remote.conf configuration file.
  2. On the server, which aggregates the logs, the "tcp_listen_port" parameter in the /etc/audit/auditd.conf file must be set to the same port number as the clients.
  3. Because the auditd daemon is protected by SELinux, semanage (the SELinux policy management tool) must also have the same port listed in its database. If the server and client machines had all been configured to use port 1000, for example, then running this command would accomplish this: 
    semanage port -a -t audit_port_t -p tcp 1000
  4. The final step in configuring remote log aggregation is to edit the /etc/hosts.allow configuration file to inform tcp_wrappers which machines or subnets the auditd daemon should allow connections from.
I'm on the step where I'm trying to run the semanage command to let selinux know that port 60 (in my case) is acceptable for audit to use but I get the following error message when I run the command:
# semanage port -a -t audit_port_t -p tcp 60
libsepol.context_from_record: type audit_port_t is not defined
libsepol.context_from_record: could not create context structure
libsepol.port_from_record: could not create port structure for range 60:60 (tcp)
libsepol.sepol_port_modify: could not load port range 60 - 60 (tcp)
libsemanage.dbase_policydb_modify: could not modify record value
libsemanage.semanage_base_merge_components: could not merge local modifications into policy
/usr/sbin/semanage: Could not add port tcp/60
I'm not much of a wiz at selinux, but I can tell that the audit_port_t type doesn't exist.  I'm stuck here because:

1) I don;t know how to create new types in selinux
2) Even if I figured that out, I don't know how auditd would know to use that.

I've looked at the auditd executable, it has types like this:
-rwxr-x---  root root system_u:object_r:auditd_exec_t  /sbin/auditd

Could someone give me some pointers and/or point me to something I could read to get me going?

Thanks

Dan
--
Dan Gruhn, Group W Inc.