Problems with selinux and logwatch

Hi, 

I have some question about selinux and logwatch.

I get these audit messages in the logs in all computers:

Aug 29 09:11:12 w3host kernel: audit(1188371472.891:397): avc:  denied
{ read write } for  pid=9889 comm="sendmail" name="[eventpoll]"
dev=anon_inodefs ino=392 scontext=user_u:
system_r:system_mail_t:s0 tcontext=system_u:object_r:unlabeled_t:s0
tclass=file
Aug 29 09:11:13 w3host kernel: audit(1188371472.948:398): avc:  denied
{ append } for  pid=9890 comm="postdrop" name="error_log" dev=dm-0
ino=2327396 scontext=user_u:system_r:p
ostfix_postdrop_t:s0 tcontext=root:object_r:httpd_log_t:s0 tclass=file
Aug 29 09:11:13 w3host kernel: audit(1188371472.989:399): avc:  denied
{ getattr } for  pid=9890 comm="postdrop" name="error_log" dev=dm-0
ino=2327396 scontext=user_u:system_r:
postfix_postdrop_t:s0 tcontext=root:object_r:httpd_log_t:s0 tclass=file
Aug 29 09:21:45 w3host kernel: audit(1188372105.080:400): avc:  denied
{ append } for  pid=10013 comm="sendmail" name="access.log" dev=dm-0
ino=32276482 scontext=user_u:system_
r:system_mail_t:s0 tcontext=user_u:object_r:httpd_sys_content_t:s0
tclass=file
Aug 29 09:21:45 w3host kernel: audit(1188372105.127:401): avc:  denied
{ append } for  pid=10014 comm="postdrop" name="error_log" dev=dm-0
ino=2327396 scontext=user_u:system_r:
postfix_postdrop_t:s0 tcontext=root:object_r:httpd_log_t:s0 tclass=file


I asked in selinux mailing list, and they told me that:

> 1. Why postdrop try to read, append, get atribute the apache logs. Is
> can be because we have installed Logwatch program. We get these in all
> servers.
This probably means the logwatch program is leaking file descriptors
when executing postfix.  Logwatch has an open file descriptor to the
error.log file with append access.  When it executes postfix, it does
not automatically close the file descriptor,  so SELinux checks the
access to the open file descriptor when starting postfix,  denies it,
closes it, reports the avc and continues executing the program.
> 
> 2. I have to allow postdrop to make what is needed with the logs, this
> is secure and it will not be problem for something?
> 
No you probably want to dontaudit this, and get logwatch developers to
fix their code.

So my questios are:

1. Are they really related (these audit messages) with logwatch?
2. If there is some solution, can you share with me?

If this is a bug in logwatch, i just want to inform  about it.

Thanks in advanced.

Regards, Ali Nebi!