RepoMirrors
/
selinux-refpolicy
mirror of https://github.com/SELinuxProject/refpolicy
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
selinux-refpolicy/policy/modules/system/logging.fc

96 lines
6.0 KiB
Plaintext
Raw Normal View History

Change /dev/log fc to MLS system high. When the syslog recreates this sock_file on startup, it gets this sensitivity anyway. This will prevent incorrect relabeling if /dev is relabeled.
2010-11-05 17:13:21 +00:00
/dev/log -s gen_context(system_u:object_r:devlog_t,mls_systemhigh)
initial commit
2005-04-19 21:08:13 +00:00
label journald configuraiton files syslog_conf_t journald already runs as syslogd_t label the config files similarly to allow editing by domains that can edit syslog configuration files. Also added some missing '\' before dot in filenames. Signed-off-by: Dave Sugar <dsugar@tresys.com>
2019-01-15 03:20:29 +00:00
/etc/rsyslog\.conf -- gen_context(system_u:object_r:syslog_conf_t,s0)
/etc/syslog\.conf -- gen_context(system_u:object_r:syslog_conf_t,s0)
/etc/rsyslog\.d(/.*)? gen_context(system_u:object_r:syslog_conf_t,s0)
/etc/audit(/.*)? gen_context(system_u:object_r:auditd_etc_t,mls_systemhigh)
/etc/systemd/journal.*\.conf -- gen_context(system_u:object_r:syslog_conf_t,s0)
/etc/systemd/journald\.conf\.d(/.*)? gen_context(system_u:object_r:syslog_conf_t,s0)
/etc/rc\.d/init\.d/auditd -- gen_context(system_u:object_r:auditd_initrc_exec_t,s0)
/etc/rc\.d/init\.d/rsyslog -- gen_context(system_u:object_r:syslogd_initrc_exec_t,s0)
more merging from nsa cvs
2005-09-16 13:36:26 +00:00
Support systems with a single /usr/bin directory On systems such as Arch Linux, all programs which are usually located in /bin, /sbin, /usr/bin and /usr/sbin are present in /usr/bin and the other locations are symbolic links to this directory. With such a configuration, the file contexts which define types for files in /bin, /sbin and /usr/sbin need to be duplicated to provide definitions for /usr/bin/... As the "/bin vs. /usr/bin" part of the needed definitions has already been done with the "usr merge" patches, the next step consists in duplicating file contexts for /usr/sbin. This is what this patch does for all modules which are not in contrib. This is the second iteration of an idea I have previously posted on http://oss.tresys.com/pipermail/refpolicy/2017-March/009176.html
2017-04-15 18:49:07 +00:00
/usr/bin/audispd -- gen_context(system_u:object_r:audisp_exec_t,s0)
/usr/bin/audisp-remote -- gen_context(system_u:object_r:audisp_remote_exec_t,s0)
/usr/bin/auditctl -- gen_context(system_u:object_r:auditctl_exec_t,s0)
/usr/bin/auditd -- gen_context(system_u:object_r:auditd_exec_t,s0)
/usr/bin/klogd -- gen_context(system_u:object_r:klogd_exec_t,s0)
/usr/bin/metalog -- gen_context(system_u:object_r:syslogd_exec_t,s0)
/usr/bin/minilogd -- gen_context(system_u:object_r:syslogd_exec_t,s0)
/usr/bin/rklogd -- gen_context(system_u:object_r:klogd_exec_t,s0)
/usr/bin/rsyslogd -- gen_context(system_u:object_r:syslogd_exec_t,s0)
/usr/bin/syslog-ng -- gen_context(system_u:object_r:syslogd_exec_t,s0)
/usr/bin/syslogd -- gen_context(system_u:object_r:syslogd_exec_t,s0)
Add systemd units for core refpolicy services. Only for services that already have a named init script. Add rules to init_startstop_service(), with conditional arg until all of refpolicy-contrib callers are updated.
2015-10-20 18:33:56 +00:00
/usr/lib/systemd/system/auditd.* -- gen_context(system_u:object_r:auditd_unit_t,s0)
/usr/lib/systemd/system/[^/]*systemd-journal.* -- gen_context(system_u:object_r:syslogd_unit_t,s0)
Systemd units from Russell Coker.
2016-08-06 23:14:18 +00:00
/usr/lib/systemd/system/rsyslog.*\.service -- gen_context(system_u:object_r:syslogd_unit_t,s0)
Systemd fixes from Russell Coker.
2017-02-24 01:03:23 +00:00
/usr/lib/systemd/systemd-journald -- gen_context(system_u:object_r:syslogd_exec_t,s0)
/usr/lib/systemd/systemd-kmsg-syslogd -- gen_context(system_u:object_r:syslogd_exec_t,s0)
Label systemd-journald files and directories
2014-09-07 21:28:12 +00:00
Add file contexts in /usr for /bin, /usr/sbin and /usr/lib Some policy modules define file contexts in /bin, /sbin and /lib without defining similar file contexts in the same directory under /usr. Add these missing file contexts when there are outside ifdef blocks.
2016-12-27 16:06:54 +00:00
/usr/sbin/audispd -- gen_context(system_u:object_r:audisp_exec_t,s0)
/usr/sbin/audisp-remote -- gen_context(system_u:object_r:audisp_remote_exec_t,s0)
/usr/sbin/auditctl -- gen_context(system_u:object_r:auditctl_exec_t,s0)
/usr/sbin/auditd -- gen_context(system_u:object_r:auditd_exec_t,s0)
rename context_template() to gen_context()
2005-10-06 19:33:06 +00:00
/usr/sbin/klogd -- gen_context(system_u:object_r:klogd_exec_t,s0)
/usr/sbin/metalog -- gen_context(system_u:object_r:syslogd_exec_t,s0)
Add file contexts in /usr for /bin, /usr/sbin and /usr/lib Some policy modules define file contexts in /bin, /sbin and /lib without defining similar file contexts in the same directory under /usr. Add these missing file contexts when there are outside ifdef blocks.
2016-12-27 16:06:54 +00:00
/usr/sbin/minilogd -- gen_context(system_u:object_r:syslogd_exec_t,s0)
trunk: fc fix and if addtion from Stefan Schulze Frielinghaus.
2008-02-25 14:20:56 +00:00
/usr/sbin/rklogd -- gen_context(system_u:object_r:klogd_exec_t,s0)
/usr/sbin/rsyslogd -- gen_context(system_u:object_r:syslogd_exec_t,s0)
fixes from serge
2006-01-19 22:47:40 +00:00
/usr/sbin/syslog-ng -- gen_context(system_u:object_r:syslogd_exec_t,s0)
trunk: fc fix and if addtion from Stefan Schulze Frielinghaus.
2008-02-25 14:20:56 +00:00
/usr/sbin/syslogd -- gen_context(system_u:object_r:syslogd_exec_t,s0)
reorder to fit file context style rules
2005-05-10 19:47:37 +00:00
Remove unescaped single dot from the policy In a pattern, a dot can match any character, including slash. It makes sense when it is combined with ?, + or *, but makes little sense when left alone. Most of the time, the label was for file containing dots, where the dot was not escaped. A few times, the dot was really intended to match any character. In such case, [^/] better suits the intent. Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
2019-08-27 21:38:09 +00:00
/var/lib/misc/syslog-ng\.persist-? -- gen_context(system_u:object_r:syslogd_var_lib_t,s0)
trunk: fedora update cherry picked by david hardeman.
2008-08-22 15:17:01 +00:00
/var/lib/syslog-ng(/.*)? gen_context(system_u:object_r:syslogd_var_lib_t,s0)
Pull in some changes from Fedora policy system layer.
2011-04-14 15:36:56 +00:00
/var/lib/r?syslog(/.*)? gen_context(system_u:object_r:syslogd_var_lib_t,s0)
Remove unescaped single dot from the policy In a pattern, a dot can match any character, including slash. It makes sense when it is combined with ?, + or *, but makes little sense when left alone. Most of the time, the label was for file containing dots, where the dot was not escaped. A few times, the dot was really intended to match any character. In such case, [^/] better suits the intent. Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
2019-08-27 21:38:09 +00:00
/var/lib/syslog-ng\.persist -- gen_context(system_u:object_r:syslogd_var_lib_t,s0)
trunk: small fixes for gentoo system.
2008-03-20 14:55:17 +00:00
initial commit
2005-04-19 21:08:13 +00:00
ifdef(`distro_suse', `
rename context_template() to gen_context()
2005-10-06 19:33:06 +00:00
/var/lib/stunnel/dev/log -s gen_context(system_u:object_r:devlog_t,s0)
initial commit
2005-04-19 21:08:13 +00:00
')
reorder to fit file context style rules
2005-05-10 19:47:37 +00:00
add daemontools, djbdns, publicfile, and ucspitcp from Petre Rodan.
2006-01-16 18:30:14 +00:00
/var/axfrdns/log/main(/.*)? gen_context(system_u:object_r:var_log_t,s0)
/var/dnscache/log/main(/.*)? gen_context(system_u:object_r:var_log_t,s0)
- Move range transitions to modules. - Make number of MLS sensitivities, and number of MLS and MCS categories configurable as build options.
2006-10-04 17:25:34 +00:00
/var/log -d gen_context(system_u:object_r:var_log_t,s0-mls_systemhigh)
part of dan's mega patch
2006-01-06 22:51:40 +00:00
/var/log/.* gen_context(system_u:object_r:var_log_t,s0)
Move the use of var_log_t from authlogin.fc to logging.fc The type var_log_t is actually declared in logging.te. Moved the file contexts to label dmesg and syslog files with the var_log_t type from authlogin.fc to logging.fc. Signed-off-by: James Carter <jwcart2@tycho.nsa.gov>
2018-04-11 18:55:20 +00:00
/var/log/dmesg -- gen_context(system_u:object_r:var_log_t,s0)
/var/log/syslog -- gen_context(system_u:object_r:var_log_t,s0)
Pull in some changes from Fedora policy system layer.
2011-04-14 15:36:56 +00:00
/var/log/boot\.log -- gen_context(system_u:object_r:var_log_t,mls_systemhigh)
trunk: several fc updates from dan.
2007-12-12 15:55:21 +00:00
/var/log/messages[^/]* gen_context(system_u:object_r:var_log_t,mls_systemhigh)
/var/log/secure[^/]* gen_context(system_u:object_r:var_log_t,mls_systemhigh)
/var/log/maillog[^/]* gen_context(system_u:object_r:var_log_t,mls_systemhigh)
/var/log/spooler[^/]* gen_context(system_u:object_r:var_log_t,mls_systemhigh)
- Move range transitions to modules. - Make number of MLS sensitivities, and number of MLS and MCS categories configurable as build options.
2006-10-04 17:25:34 +00:00
/var/log/audit(/.*)? gen_context(system_u:object_r:auditd_log_t,mls_systemhigh)
Rename *_var_run_t types to *_runtime_t. Signed-off-by: Chris PeBenito <pebenito@ieee.org>
2019-09-08 20:55:02 +00:00
/var/log/syslog-ng(/.*)? gen_context(system_u:object_r:syslogd_runtime_t,mls_systemhigh)
reorder to fit file context style rules
2005-05-10 19:47:37 +00:00
trunk: several fc updates from dan.
2007-12-12 15:55:21 +00:00
ifdef(`distro_redhat',`
/var/named/chroot/var/log -d gen_context(system_u:object_r:var_log_t,s0)
Logging patch from Dan Walsh.
2010-03-17 18:40:06 +00:00
/var/named/chroot/dev/log -s gen_context(system_u:object_r:devlog_t,s0)
trunk: several fc updates from dan.
2007-12-12 15:55:21 +00:00
')
Rename *_var_run_t types to *_runtime_t. Signed-off-by: Chris PeBenito <pebenito@ieee.org>
2019-09-08 20:55:02 +00:00
/run/audit_events -s gen_context(system_u:object_r:auditd_runtime_t,mls_systemhigh)
/run/audispd_events -s gen_context(system_u:object_r:audisp_runtime_t,mls_systemhigh)
/run/auditd\.pid -- gen_context(system_u:object_r:auditd_runtime_t,mls_systemhigh)
/run/auditd_sock -s gen_context(system_u:object_r:auditd_runtime_t,mls_systemhigh)
/run/klogd\.pid -- gen_context(system_u:object_r:klogd_runtime_t,s0)
transition file contexts to /run Remove file context aliases and update file context paths to use the /run filesystem path. Add backward compatibility file context alias for /var/run using applications like https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=783321 Lock files are still seated at /var/lock
2016-12-16 20:07:56 +00:00
/run/log -s gen_context(system_u:object_r:devlog_t,s0)
/run/log -d gen_context(system_u:object_r:var_log_t,s0-mls_systemhigh)
Rename *_var_run_t types to *_runtime_t. Signed-off-by: Chris PeBenito <pebenito@ieee.org>
2019-09-08 20:55:02 +00:00
/run/metalog\.pid -- gen_context(system_u:object_r:syslogd_runtime_t,s0)
/run/rsyslogd\.pid -- gen_context(system_u:object_r:syslogd_runtime_t,mls_systemhigh)
/run/syslogd\.pid -- gen_context(system_u:object_r:syslogd_runtime_t,mls_systemhigh)
/run/syslog-ng\.ctl -- gen_context(system_u:object_r:syslogd_runtime_t,s0)
/run/syslog-ng\.pid -- gen_context(system_u:object_r:syslogd_runtime_t,mls_systemhigh)
/run/syslog-ng(/.*)? gen_context(system_u:object_r:syslogd_runtime_t,s0)
/run/systemd/journal(/.*)? gen_context(system_u:object_r:syslogd_runtime_t,mls_systemhigh)
remove /var/run file context leftovers
2017-03-14 13:59:14 +00:00
/run/systemd/journal/socket -s gen_context(system_u:object_r:devlog_t,mls_systemhigh)
/run/systemd/journal/stdout -s gen_context(system_u:object_r:devlog_t,mls_systemhigh)
/run/systemd/journal/syslog -s gen_context(system_u:object_r:devlog_t,mls_systemhigh)
transition file contexts to /run Remove file context aliases and update file context paths to use the /run filesystem path. Add backward compatibility file context alias for /var/run using applications like https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=783321 Lock files are still seated at /var/lock
2016-12-16 20:07:56 +00:00
/run/systemd/journal/dev-log -s gen_context(system_u:object_r:devlog_t,mls_systemhigh)
add daemontools, djbdns, publicfile, and ucspitcp from Petre Rodan.
2006-01-16 18:30:14 +00:00
Pull in some changes from Fedora policy system layer.
2011-04-14 15:36:56 +00:00
/var/spool/audit(/.*)? gen_context(system_u:object_r:audit_spool_t,mls_systemhigh)
Logging patch from Dan Walsh.
2010-03-17 18:40:06 +00:00
/var/spool/bacula/log(/.*)? gen_context(system_u:object_r:var_log_t,s0)
Pull in some changes from Fedora policy system layer.
2011-04-14 15:36:56 +00:00
/var/spool/plymouth/boot\.log gen_context(system_u:object_r:var_log_t,mls_systemhigh)
Logging patch from Dan Walsh.
2010-03-17 18:40:06 +00:00
/var/spool/rsyslog(/.*)? gen_context(system_u:object_r:var_log_t,s0)
add daemontools, djbdns, publicfile, and ucspitcp from Petre Rodan.
2006-01-16 18:30:14 +00:00
fix optional in fc, move contexts to their proper modules
2006-02-02 20:41:12 +00:00
/var/tinydns/log/main(/.*)? gen_context(system_u:object_r:var_log_t,s0)