--- a/src/syslogconfig.cpp	Sun Feb 12 11:34:37 2006 -0800
+++ b/src/syslogconfig.cpp	Sun Sep 09 10:59:15 2007 -0700
@@ -351,6 +351,12 @@
 			snprintf(buf, sizeof(buf), "syslog file %s cannot stat after open", file_name);
 			tokp->token_error(buf);
 		}
+		// specify that this fd gets closed on exec, so that selinux
+		// won't complain about iptables trying to read log files.
+		int oldflags = fcntl(fd, F_GETFD, 0);
+		if (oldflags >= 0) {
+			fcntl(fd, F_SETFD, oldflags | FD_CLOEXEC);
+		}
 	}
 }