RepoMirrors
/
selinux-refpolicy
mirror of https://github.com/SELinuxProject/refpolicy
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
selinux-refpolicy/policy/modules/system/logging.fc

99 lines
6.0 KiB
Plaintext
Raw Normal View History

Change /dev/log fc to MLS system high. When the syslog recreates this sock_file on startup, it gets this sensitivity anyway. This will prevent incorrect relabeling if /dev is relabeled.
2010-11-05 17:13:21 +00:00
/dev/log -s gen_context(system_u:object_r:devlog_t,mls_systemhigh)
initial commit
2005-04-19 21:08:13 +00:00
trunk: 3 patches from dan.
2007-11-05 19:35:08 +00:00
/etc/rsyslog.conf gen_context(system_u:object_r:syslog_conf_t,s0)
/etc/syslog.conf gen_context(system_u:object_r:syslog_conf_t,s0)
Label /etc/rsyslog.d as syslog_conf_t This is a minor update of the last attempt at this patch. Changes in .fc to label /etc/rsyslog.d(/.*)? as syslog_conf_t so all rsyslog config files are labeled syslog_conf_t (not just /etc/r?syslog.conf). Update .te file to allow rsyslog to read the directory now labeled syslog_conf_t (files of this type were already readable). Final (and new) change is in logging_admin_syslog interface so files_etc_filetrans now includes the optional filename so /etc/r?syslog.conf would be labeled correctly when created in etc_t. The overall goal of this patch is that a domain using the logging_admin_syslog is able to create/edit files in /etc/rsyslog.d and they get created as syslog_conf_t AND other files created in /etc (or other etc_t labeled directory) don't get created with the syslog_conf_t type as they are not necessarily syslog configuration files. Dave Sugar dsugar@tresys.com Signed-off-by: Dave Sugar <dsugar@tresys.com>
2017-09-09 02:30:37 +00:00
/etc/rsyslog.d(/.*)? gen_context(system_u:object_r:syslog_conf_t,s0)
- Move range transitions to modules. - Make number of MLS sensitivities, and number of MLS and MCS categories configurable as build options.
2006-10-04 17:25:34 +00:00
/etc/audit(/.*)? gen_context(system_u:object_r:auditd_etc_t,mls_systemhigh)
trunk: logging update from dan.
2008-09-18 13:20:57 +00:00
/etc/rc\.d/init\.d/auditd -- gen_context(system_u:object_r:auditd_initrc_exec_t,s0)
/etc/rc\.d/init\.d/rsyslog -- gen_context(system_u:object_r:syslogd_initrc_exec_t,s0)
more merging from nsa cvs
2005-09-16 13:36:26 +00:00
Support systems with a single /usr/bin directory On systems such as Arch Linux, all programs which are usually located in /bin, /sbin, /usr/bin and /usr/sbin are present in /usr/bin and the other locations are symbolic links to this directory. With such a configuration, the file contexts which define types for files in /bin, /sbin and /usr/sbin need to be duplicated to provide definitions for /usr/bin/... As the "/bin vs. /usr/bin" part of the needed definitions has already been done with the "usr merge" patches, the next step consists in duplicating file contexts for /usr/sbin. This is what this patch does for all modules which are not in contrib. This is the second iteration of an idea I have previously posted on http://oss.tresys.com/pipermail/refpolicy/2017-March/009176.html
2017-04-15 18:49:07 +00:00
/usr/bin/audispd -- gen_context(system_u:object_r:audisp_exec_t,s0)
/usr/bin/audisp-remote -- gen_context(system_u:object_r:audisp_remote_exec_t,s0)
/usr/bin/auditctl -- gen_context(system_u:object_r:auditctl_exec_t,s0)
/usr/bin/auditd -- gen_context(system_u:object_r:auditd_exec_t,s0)
/usr/bin/klogd -- gen_context(system_u:object_r:klogd_exec_t,s0)
/usr/bin/metalog -- gen_context(system_u:object_r:syslogd_exec_t,s0)
/usr/bin/minilogd -- gen_context(system_u:object_r:syslogd_exec_t,s0)
/usr/bin/rklogd -- gen_context(system_u:object_r:klogd_exec_t,s0)
/usr/bin/rsyslogd -- gen_context(system_u:object_r:syslogd_exec_t,s0)
/usr/bin/syslog-ng -- gen_context(system_u:object_r:syslogd_exec_t,s0)
/usr/bin/syslogd -- gen_context(system_u:object_r:syslogd_exec_t,s0)
Add systemd units for core refpolicy services. Only for services that already have a named init script. Add rules to init_startstop_service(), with conditional arg until all of refpolicy-contrib callers are updated.
2015-10-20 18:33:56 +00:00
/usr/lib/systemd/system/auditd.* -- gen_context(system_u:object_r:auditd_unit_t,s0)
/usr/lib/systemd/system/[^/]*systemd-journal.* -- gen_context(system_u:object_r:syslogd_unit_t,s0)
Systemd units from Russell Coker.
2016-08-06 23:14:18 +00:00
/usr/lib/systemd/system/rsyslog.*\.service -- gen_context(system_u:object_r:syslogd_unit_t,s0)
Systemd fixes from Russell Coker.
2017-02-24 01:03:23 +00:00
/usr/lib/systemd/systemd-journald -- gen_context(system_u:object_r:syslogd_exec_t,s0)
/usr/lib/systemd/systemd-kmsg-syslogd -- gen_context(system_u:object_r:syslogd_exec_t,s0)
Label systemd-journald files and directories
2014-09-07 21:28:12 +00:00
Add file contexts in /usr for /bin, /usr/sbin and /usr/lib Some policy modules define file contexts in /bin, /sbin and /lib without defining similar file contexts in the same directory under /usr. Add these missing file contexts when there are outside ifdef blocks.
2016-12-27 16:06:54 +00:00
/usr/sbin/audispd -- gen_context(system_u:object_r:audisp_exec_t,s0)
/usr/sbin/audisp-remote -- gen_context(system_u:object_r:audisp_remote_exec_t,s0)
/usr/sbin/auditctl -- gen_context(system_u:object_r:auditctl_exec_t,s0)
/usr/sbin/auditd -- gen_context(system_u:object_r:auditd_exec_t,s0)
rename context_template() to gen_context()
2005-10-06 19:33:06 +00:00
/usr/sbin/klogd -- gen_context(system_u:object_r:klogd_exec_t,s0)
/usr/sbin/metalog -- gen_context(system_u:object_r:syslogd_exec_t,s0)
Add file contexts in /usr for /bin, /usr/sbin and /usr/lib Some policy modules define file contexts in /bin, /sbin and /lib without defining similar file contexts in the same directory under /usr. Add these missing file contexts when there are outside ifdef blocks.
2016-12-27 16:06:54 +00:00
/usr/sbin/minilogd -- gen_context(system_u:object_r:syslogd_exec_t,s0)
trunk: fc fix and if addtion from Stefan Schulze Frielinghaus.
2008-02-25 14:20:56 +00:00
/usr/sbin/rklogd -- gen_context(system_u:object_r:klogd_exec_t,s0)
/usr/sbin/rsyslogd -- gen_context(system_u:object_r:syslogd_exec_t,s0)
fixes from serge
2006-01-19 22:47:40 +00:00
/usr/sbin/syslog-ng -- gen_context(system_u:object_r:syslogd_exec_t,s0)
trunk: fc fix and if addtion from Stefan Schulze Frielinghaus.
2008-02-25 14:20:56 +00:00
/usr/sbin/syslogd -- gen_context(system_u:object_r:syslogd_exec_t,s0)
reorder to fit file context style rules
2005-05-10 19:47:37 +00:00
Allow syslogd to create /var/lib/syslog and /var/lib/misc/syslog-ng.persist If the /var/lib/syslog directory does not exist, then syslog-ng (running in syslogd_t) will attempt to create the directory. Allow the syslogd_t domain to create the directory, and use an automatic file transition towards syslogd_var_lib_t. Also, the syslog-ng daemon uses a persistence file in /var/lib/misc/syslog-ng.persist (and .persist- if it suspects a collision). As /var/lib/misc is still a generic var_lib_t, we have the syslogd_t daemon write its files as syslogd_var_lib_t therein. Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
2012-09-08 15:45:51 +00:00
/var/lib/misc/syslog-ng.persist-? -- gen_context(system_u:object_r:syslogd_var_lib_t,s0)
trunk: fedora update cherry picked by david hardeman.
2008-08-22 15:17:01 +00:00
/var/lib/syslog-ng(/.*)? gen_context(system_u:object_r:syslogd_var_lib_t,s0)
Pull in some changes from Fedora policy system layer.
2011-04-14 15:36:56 +00:00
/var/lib/r?syslog(/.*)? gen_context(system_u:object_r:syslogd_var_lib_t,s0)
trunk: small fixes for gentoo system.
2008-03-20 14:55:17 +00:00
/var/lib/syslog-ng.persist -- gen_context(system_u:object_r:syslogd_var_lib_t,s0)
initial commit
2005-04-19 21:08:13 +00:00
ifdef(`distro_suse', `
rename context_template() to gen_context()
2005-10-06 19:33:06 +00:00
/var/lib/stunnel/dev/log -s gen_context(system_u:object_r:devlog_t,s0)
initial commit
2005-04-19 21:08:13 +00:00
')
reorder to fit file context style rules
2005-05-10 19:47:37 +00:00
add daemontools, djbdns, publicfile, and ucspitcp from Petre Rodan.
2006-01-16 18:30:14 +00:00
/var/axfrdns/log/main(/.*)? gen_context(system_u:object_r:var_log_t,s0)
/var/dnscache/log/main(/.*)? gen_context(system_u:object_r:var_log_t,s0)
- Move range transitions to modules. - Make number of MLS sensitivities, and number of MLS and MCS categories configurable as build options.
2006-10-04 17:25:34 +00:00
/var/log -d gen_context(system_u:object_r:var_log_t,s0-mls_systemhigh)
part of dan's mega patch
2006-01-06 22:51:40 +00:00
/var/log/.* gen_context(system_u:object_r:var_log_t,s0)
Move the use of var_log_t from authlogin.fc to logging.fc The type var_log_t is actually declared in logging.te. Moved the file contexts to label dmesg and syslog files with the var_log_t type from authlogin.fc to logging.fc. Signed-off-by: James Carter <jwcart2@tycho.nsa.gov>
2018-04-11 18:55:20 +00:00
/var/log/dmesg -- gen_context(system_u:object_r:var_log_t,s0)
/var/log/syslog -- gen_context(system_u:object_r:var_log_t,s0)
Pull in some changes from Fedora policy system layer.
2011-04-14 15:36:56 +00:00
/var/log/boot\.log -- gen_context(system_u:object_r:var_log_t,mls_systemhigh)
trunk: several fc updates from dan.
2007-12-12 15:55:21 +00:00
/var/log/messages[^/]* gen_context(system_u:object_r:var_log_t,mls_systemhigh)
/var/log/secure[^/]* gen_context(system_u:object_r:var_log_t,mls_systemhigh)
/var/log/maillog[^/]* gen_context(system_u:object_r:var_log_t,mls_systemhigh)
/var/log/spooler[^/]* gen_context(system_u:object_r:var_log_t,mls_systemhigh)
- Move range transitions to modules. - Make number of MLS sensitivities, and number of MLS and MCS categories configurable as build options.
2006-10-04 17:25:34 +00:00
/var/log/audit(/.*)? gen_context(system_u:object_r:auditd_log_t,mls_systemhigh)
Pull in some changes from Fedora policy system layer.
2011-04-14 15:36:56 +00:00
/var/log/syslog-ng(/.*)? gen_context(system_u:object_r:syslogd_var_run_t,mls_systemhigh)
reorder to fit file context style rules
2005-05-10 19:47:37 +00:00
gentoo testing fixes.
2006-10-13 21:44:02 +00:00
ifndef(`distro_gentoo',`
/var/log/audit\.log -- gen_context(system_u:object_r:auditd_log_t,mls_systemhigh)
')
trunk: several fc updates from dan.
2007-12-12 15:55:21 +00:00
ifdef(`distro_redhat',`
/var/named/chroot/var/log -d gen_context(system_u:object_r:var_log_t,s0)
Logging patch from Dan Walsh.
2010-03-17 18:40:06 +00:00
/var/named/chroot/dev/log -s gen_context(system_u:object_r:devlog_t,s0)
trunk: several fc updates from dan.
2007-12-12 15:55:21 +00:00
')
transition file contexts to /run Remove file context aliases and update file context paths to use the /run filesystem path. Add backward compatibility file context alias for /var/run using applications like https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=783321 Lock files are still seated at /var/lock
2016-12-16 20:07:56 +00:00
/run/audit_events -s gen_context(system_u:object_r:auditd_var_run_t,mls_systemhigh)
/run/audispd_events -s gen_context(system_u:object_r:audisp_var_run_t,mls_systemhigh)
/run/auditd\.pid -- gen_context(system_u:object_r:auditd_var_run_t,mls_systemhigh)
/run/auditd_sock -s gen_context(system_u:object_r:auditd_var_run_t,mls_systemhigh)
/run/klogd\.pid -- gen_context(system_u:object_r:klogd_var_run_t,s0)
/run/log -s gen_context(system_u:object_r:devlog_t,s0)
/run/log -d gen_context(system_u:object_r:var_log_t,s0-mls_systemhigh)
/run/metalog\.pid -- gen_context(system_u:object_r:syslogd_var_run_t,s0)
/run/rsyslogd\.pid -- gen_context(system_u:object_r:syslogd_var_run_t,mls_systemhigh)
/run/syslogd\.pid -- gen_context(system_u:object_r:syslogd_var_run_t,mls_systemhigh)
/run/syslog-ng.ctl -- gen_context(system_u:object_r:syslogd_var_run_t,s0)
/run/syslog-ng\.pid -- gen_context(system_u:object_r:syslogd_var_run_t,mls_systemhigh)
/run/syslog-ng(/.*)? gen_context(system_u:object_r:syslogd_var_run_t,s0)
/run/systemd/journal(/.*)? gen_context(system_u:object_r:syslogd_var_run_t,mls_systemhigh)
remove /var/run file context leftovers
2017-03-14 13:59:14 +00:00
/run/systemd/journal/socket -s gen_context(system_u:object_r:devlog_t,mls_systemhigh)
/run/systemd/journal/stdout -s gen_context(system_u:object_r:devlog_t,mls_systemhigh)
/run/systemd/journal/syslog -s gen_context(system_u:object_r:devlog_t,mls_systemhigh)
transition file contexts to /run Remove file context aliases and update file context paths to use the /run filesystem path. Add backward compatibility file context alias for /var/run using applications like https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=783321 Lock files are still seated at /var/lock
2016-12-16 20:07:56 +00:00
/run/systemd/journal/dev-log -s gen_context(system_u:object_r:devlog_t,mls_systemhigh)
add daemontools, djbdns, publicfile, and ucspitcp from Petre Rodan.
2006-01-16 18:30:14 +00:00
Pull in some changes from Fedora policy system layer.
2011-04-14 15:36:56 +00:00
/var/spool/audit(/.*)? gen_context(system_u:object_r:audit_spool_t,mls_systemhigh)
Logging patch from Dan Walsh.
2010-03-17 18:40:06 +00:00
/var/spool/bacula/log(/.*)? gen_context(system_u:object_r:var_log_t,s0)
fix optional in fc, move contexts to their proper modules
2006-02-02 20:41:12 +00:00
/var/spool/postfix/pid -d gen_context(system_u:object_r:var_run_t,s0)
Pull in some changes from Fedora policy system layer.
2011-04-14 15:36:56 +00:00
/var/spool/plymouth/boot\.log gen_context(system_u:object_r:var_log_t,mls_systemhigh)
Logging patch from Dan Walsh.
2010-03-17 18:40:06 +00:00
/var/spool/rsyslog(/.*)? gen_context(system_u:object_r:var_log_t,s0)
add daemontools, djbdns, publicfile, and ucspitcp from Petre Rodan.
2006-01-16 18:30:14 +00:00
fix optional in fc, move contexts to their proper modules
2006-02-02 20:41:12 +00:00
/var/tinydns/log/main(/.*)? gen_context(system_u:object_r:var_log_t,s0)