RepoMirrors
/
selinux-refpolicy
mirror of https://github.com/SELinuxProject/refpolicy
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
selinux-refpolicy/policy/modules/system/logging.fc

89 lines
5.2 KiB
Plaintext
Raw Normal View History

Change /dev/log fc to MLS system high. When the syslog recreates this sock_file on startup, it gets this sensitivity anyway. This will prevent incorrect relabeling if /dev is relabeled.
2010-11-05 17:13:21 +00:00
/dev/log -s gen_context(system_u:object_r:devlog_t,mls_systemhigh)
initial commit
2005-04-19 21:08:13 +00:00
trunk: 3 patches from dan.
2007-11-05 19:35:08 +00:00
/etc/rsyslog.conf gen_context(system_u:object_r:syslog_conf_t,s0)
/etc/syslog.conf gen_context(system_u:object_r:syslog_conf_t,s0)
- Move range transitions to modules. - Make number of MLS sensitivities, and number of MLS and MCS categories configurable as build options.
2006-10-04 17:25:34 +00:00
/etc/audit(/.*)? gen_context(system_u:object_r:auditd_etc_t,mls_systemhigh)
trunk: logging update from dan.
2008-09-18 13:20:57 +00:00
/etc/rc\.d/init\.d/auditd -- gen_context(system_u:object_r:auditd_initrc_exec_t,s0)
/etc/rc\.d/init\.d/rsyslog -- gen_context(system_u:object_r:syslogd_initrc_exec_t,s0)
more merging from nsa cvs
2005-09-16 13:36:26 +00:00
trunk: fedora update cherry picked by david hardeman.
2008-08-22 15:17:01 +00:00
/sbin/audispd -- gen_context(system_u:object_r:audisp_exec_t,s0)
/sbin/audisp-remote -- gen_context(system_u:object_r:audisp_remote_exec_t,s0)
rename context_template() to gen_context()
2005-10-06 19:33:06 +00:00
/sbin/auditctl -- gen_context(system_u:object_r:auditctl_exec_t,s0)
/sbin/auditd -- gen_context(system_u:object_r:auditd_exec_t,s0)
/sbin/klogd -- gen_context(system_u:object_r:klogd_exec_t,s0)
/sbin/minilogd -- gen_context(system_u:object_r:syslogd_exec_t,s0)
trunk: 3 patches from dan.
2007-09-12 14:53:39 +00:00
/sbin/rklogd -- gen_context(system_u:object_r:klogd_exec_t,s0)
/sbin/rsyslogd -- gen_context(system_u:object_r:syslogd_exec_t,s0)
rename context_template() to gen_context()
2005-10-06 19:33:06 +00:00
/sbin/syslogd -- gen_context(system_u:object_r:syslogd_exec_t,s0)
/sbin/syslog-ng -- gen_context(system_u:object_r:syslogd_exec_t,s0)
reorder to fit file context style rules
2005-05-10 19:47:37 +00:00
Add systemd units for core refpolicy services. Only for services that already have a named init script. Add rules to init_startstop_service(), with conditional arg until all of refpolicy-contrib callers are updated.
2015-10-20 18:33:56 +00:00
/usr/lib/systemd/system/auditd.* -- gen_context(system_u:object_r:auditd_unit_t,s0)
/usr/lib/systemd/system/[^/]*systemd-journal.* -- gen_context(system_u:object_r:syslogd_unit_t,s0)
Whitespace change in logging.fc.
2014-09-12 13:49:37 +00:00
/usr/lib/systemd/systemd-journald -- gen_context(system_u:object_r:syslogd_exec_t,s0)
Systemd units from Russell Coker.
2016-08-06 23:14:18 +00:00
/usr/lib/systemd/system/rsyslog.*\.service -- gen_context(system_u:object_r:syslogd_unit_t,s0)
Label systemd-journald files and directories
2014-09-07 21:28:12 +00:00
rename context_template() to gen_context()
2005-10-06 19:33:06 +00:00
/usr/sbin/klogd -- gen_context(system_u:object_r:klogd_exec_t,s0)
/usr/sbin/metalog -- gen_context(system_u:object_r:syslogd_exec_t,s0)
trunk: fc fix and if addtion from Stefan Schulze Frielinghaus.
2008-02-25 14:20:56 +00:00
/usr/sbin/rklogd -- gen_context(system_u:object_r:klogd_exec_t,s0)
/usr/sbin/rsyslogd -- gen_context(system_u:object_r:syslogd_exec_t,s0)
fixes from serge
2006-01-19 22:47:40 +00:00
/usr/sbin/syslog-ng -- gen_context(system_u:object_r:syslogd_exec_t,s0)
trunk: fc fix and if addtion from Stefan Schulze Frielinghaus.
2008-02-25 14:20:56 +00:00
/usr/sbin/syslogd -- gen_context(system_u:object_r:syslogd_exec_t,s0)
reorder to fit file context style rules
2005-05-10 19:47:37 +00:00
Allow syslogd to create /var/lib/syslog and /var/lib/misc/syslog-ng.persist If the /var/lib/syslog directory does not exist, then syslog-ng (running in syslogd_t) will attempt to create the directory. Allow the syslogd_t domain to create the directory, and use an automatic file transition towards syslogd_var_lib_t. Also, the syslog-ng daemon uses a persistence file in /var/lib/misc/syslog-ng.persist (and .persist- if it suspects a collision). As /var/lib/misc is still a generic var_lib_t, we have the syslogd_t daemon write its files as syslogd_var_lib_t therein. Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
2012-09-08 15:45:51 +00:00
/var/lib/misc/syslog-ng.persist-? -- gen_context(system_u:object_r:syslogd_var_lib_t,s0)
trunk: fedora update cherry picked by david hardeman.
2008-08-22 15:17:01 +00:00
/var/lib/syslog-ng(/.*)? gen_context(system_u:object_r:syslogd_var_lib_t,s0)
Pull in some changes from Fedora policy system layer.
2011-04-14 15:36:56 +00:00
/var/lib/r?syslog(/.*)? gen_context(system_u:object_r:syslogd_var_lib_t,s0)
trunk: small fixes for gentoo system.
2008-03-20 14:55:17 +00:00
/var/lib/syslog-ng.persist -- gen_context(system_u:object_r:syslogd_var_lib_t,s0)
initial commit
2005-04-19 21:08:13 +00:00
ifdef(`distro_suse', `
rename context_template() to gen_context()
2005-10-06 19:33:06 +00:00
/var/lib/stunnel/dev/log -s gen_context(system_u:object_r:devlog_t,s0)
initial commit
2005-04-19 21:08:13 +00:00
')
reorder to fit file context style rules
2005-05-10 19:47:37 +00:00
add daemontools, djbdns, publicfile, and ucspitcp from Petre Rodan.
2006-01-16 18:30:14 +00:00
/var/axfrdns/log/main(/.*)? gen_context(system_u:object_r:var_log_t,s0)
/var/dnscache/log/main(/.*)? gen_context(system_u:object_r:var_log_t,s0)
- Move range transitions to modules. - Make number of MLS sensitivities, and number of MLS and MCS categories configurable as build options.
2006-10-04 17:25:34 +00:00
/var/log -d gen_context(system_u:object_r:var_log_t,s0-mls_systemhigh)
part of dan's mega patch
2006-01-06 22:51:40 +00:00
/var/log/.* gen_context(system_u:object_r:var_log_t,s0)
Pull in some changes from Fedora policy system layer.
2011-04-14 15:36:56 +00:00
/var/log/boot\.log -- gen_context(system_u:object_r:var_log_t,mls_systemhigh)
trunk: several fc updates from dan.
2007-12-12 15:55:21 +00:00
/var/log/messages[^/]* gen_context(system_u:object_r:var_log_t,mls_systemhigh)
/var/log/secure[^/]* gen_context(system_u:object_r:var_log_t,mls_systemhigh)
/var/log/maillog[^/]* gen_context(system_u:object_r:var_log_t,mls_systemhigh)
/var/log/spooler[^/]* gen_context(system_u:object_r:var_log_t,mls_systemhigh)
- Move range transitions to modules. - Make number of MLS sensitivities, and number of MLS and MCS categories configurable as build options.
2006-10-04 17:25:34 +00:00
/var/log/audit(/.*)? gen_context(system_u:object_r:auditd_log_t,mls_systemhigh)
Pull in some changes from Fedora policy system layer.
2011-04-14 15:36:56 +00:00
/var/log/syslog-ng(/.*)? gen_context(system_u:object_r:syslogd_var_run_t,mls_systemhigh)
reorder to fit file context style rules
2005-05-10 19:47:37 +00:00
gentoo testing fixes.
2006-10-13 21:44:02 +00:00
ifndef(`distro_gentoo',`
/var/log/audit\.log -- gen_context(system_u:object_r:auditd_log_t,mls_systemhigh)
')
trunk: several fc updates from dan.
2007-12-12 15:55:21 +00:00
ifdef(`distro_redhat',`
/var/named/chroot/var/log -d gen_context(system_u:object_r:var_log_t,s0)
Logging patch from Dan Walsh.
2010-03-17 18:40:06 +00:00
/var/named/chroot/dev/log -s gen_context(system_u:object_r:devlog_t,s0)
trunk: several fc updates from dan.
2007-12-12 15:55:21 +00:00
')
transition file contexts to /run Remove file context aliases and update file context paths to use the /run filesystem path. Add backward compatibility file context alias for /var/run using applications like https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=783321 Lock files are still seated at /var/lock
2016-12-16 20:07:56 +00:00
/run/audit_events -s gen_context(system_u:object_r:auditd_var_run_t,mls_systemhigh)
/run/audispd_events -s gen_context(system_u:object_r:audisp_var_run_t,mls_systemhigh)
/run/auditd\.pid -- gen_context(system_u:object_r:auditd_var_run_t,mls_systemhigh)
/run/auditd_sock -s gen_context(system_u:object_r:auditd_var_run_t,mls_systemhigh)
/run/klogd\.pid -- gen_context(system_u:object_r:klogd_var_run_t,s0)
/run/log -s gen_context(system_u:object_r:devlog_t,s0)
/run/log -d gen_context(system_u:object_r:var_log_t,s0-mls_systemhigh)
/run/log/journal(/.*)? gen_context(system_u:object_r:var_log_t,mls_systemhigh)
/run/metalog\.pid -- gen_context(system_u:object_r:syslogd_var_run_t,s0)
/run/rsyslogd\.pid -- gen_context(system_u:object_r:syslogd_var_run_t,mls_systemhigh)
/run/syslogd\.pid -- gen_context(system_u:object_r:syslogd_var_run_t,mls_systemhigh)
/run/syslog-ng.ctl -- gen_context(system_u:object_r:syslogd_var_run_t,s0)
/run/syslog-ng\.pid -- gen_context(system_u:object_r:syslogd_var_run_t,mls_systemhigh)
/run/syslog-ng(/.*)? gen_context(system_u:object_r:syslogd_var_run_t,s0)
/run/systemd/journal(/.*)? gen_context(system_u:object_r:syslogd_var_run_t,mls_systemhigh)
/run/systemd/journal/socket -s gen_context(system_u:object_r:devlog_t,mls_systemhigh)
/run/systemd/journal/syslog -s gen_context(system_u:object_r:devlog_t,mls_systemhigh)
/run/systemd/journal/dev-log -s gen_context(system_u:object_r:devlog_t,mls_systemhigh)
add daemontools, djbdns, publicfile, and ucspitcp from Petre Rodan.
2006-01-16 18:30:14 +00:00
Pull in some changes from Fedora policy system layer.
2011-04-14 15:36:56 +00:00
/var/spool/audit(/.*)? gen_context(system_u:object_r:audit_spool_t,mls_systemhigh)
Logging patch from Dan Walsh.
2010-03-17 18:40:06 +00:00
/var/spool/bacula/log(/.*)? gen_context(system_u:object_r:var_log_t,s0)
fix optional in fc, move contexts to their proper modules
2006-02-02 20:41:12 +00:00
/var/spool/postfix/pid -d gen_context(system_u:object_r:var_run_t,s0)
Pull in some changes from Fedora policy system layer.
2011-04-14 15:36:56 +00:00
/var/spool/plymouth/boot\.log gen_context(system_u:object_r:var_log_t,mls_systemhigh)
Logging patch from Dan Walsh.
2010-03-17 18:40:06 +00:00
/var/spool/rsyslog(/.*)? gen_context(system_u:object_r:var_log_t,s0)
add daemontools, djbdns, publicfile, and ucspitcp from Petre Rodan.
2006-01-16 18:30:14 +00:00
fix optional in fc, move contexts to their proper modules
2006-02-02 20:41:12 +00:00
/var/tinydns/log/main(/.*)? gen_context(system_u:object_r:var_log_t,s0)