RepoMirrors
/
selinux-refpolicy
mirror of https://github.com/SELinuxProject/refpolicy
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
selinux-refpolicy/policy/modules/admin/logrotate.te

293 lines
7.0 KiB
Plaintext
Raw Normal View History

Bump module versions for release. Signed-off-by: Chris PeBenito <pebenito@ieee.org>
2019-06-09 18:05:19 +00:00
policy_module(logrotate, 1.23.0)
Re-add policy modules from old refpolicy-contrib submodule.
2018-06-23 13:00:56 +00:00
########################################
#
# Declarations
#
attribute_role logrotate_roles;
roleattribute system_r logrotate_roles;
type logrotate_t;
type logrotate_exec_t;
domain_type(logrotate_t)
domain_obj_id_change_exemption(logrotate_t)
domain_system_change_exemption(logrotate_t)
domain_entry_file(logrotate_t, logrotate_exec_t)
init_system_domain(logrotate_t, logrotate_exec_t)
role logrotate_roles types logrotate_t;
type logrotate_lock_t;
files_lock_file(logrotate_lock_t)
type logrotate_tmp_t;
files_tmp_file(logrotate_tmp_t)
type logrotate_var_lib_t;
files_type(logrotate_var_lib_t)
type logrotate_unit_t;
init_unit_file(logrotate_unit_t)
########################################
#
# Local policy
#
yet more tiny stuff I think this should be self-explanatory. I've added an audit trace for the sys_ptrace access that was previously rejected. Here is the audit log for sys_ptrace: type=PROCTITLE msg=audit(22/01/19 00:00:18.998:61459) : proctitle=systemctl restart cups.service type=PATH msg=audit(22/01/19 00:00:18.998:61459) : item=0 name=/proc/1/root nametype=UNKNOWN cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 type=CWD msg=audit(22/01/19 00:00:18.998:61459) : cwd=/ type=SYSCALL msg=audit(22/01/19 00:00:18.998:61459) : arch=x86_64 syscall=newfstatat success=no exit=EACCES(Permission denied) a0=0xffffff9c a1=0x55dd7ea7a23d a2=0x7ffee0a8a1b0 a3=0x0 items=1 ppid=12745 pid=12750 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=systemctl exe=/bin/systemctl subj=system_u:system_r:logrotate_t:s0 key=(null) type=AVC msg=audit(22/01/19 00:00:18.998:61459) : avc: denied { sys_ptrace } for pid=12750 comm=systemctl capability=sys_ptrace scontext=system_u:system_r:logrotate_t:s0 tcontext=system_u:system_r:logrotate_t:s0 tclass=capability permissive=0
2019-01-21 22:59:28 +00:00
# sys_ptrace is for systemctl
allow logrotate_t self:capability { chown dac_override dac_read_search fowner fsetid kill setgid setuid sys_ptrace sys_nice sys_resource };
systemd misc This patch has policy changes related to systemd and the systemd versions of system programs. Also has some dbus policy which probably isn't strictly a systemd thing, but it all came at the same time.
2019-01-04 07:54:22 +00:00
# systemctl asks for net_admin
dontaudit logrotate_t self:capability net_admin;
Re-add policy modules from old refpolicy-contrib submodule.
2018-06-23 13:00:56 +00:00
allow logrotate_t self:process { transition signal_perms getsched setsched getsession getpgid setpgid getcap setcap share getattr setfscreate noatsecure siginh setrlimit rlimitinh dyntransition setkeycreate setsockcreate getrlimit };
allow logrotate_t self:fd use;
allow logrotate_t self:key manage_key_perms;
allow logrotate_t self:fifo_file rw_fifo_file_perms;
allow logrotate_t self:unix_dgram_socket sendto;
allow logrotate_t self:unix_stream_socket { accept connectto listen };
allow logrotate_t self:shm create_shm_perms;
allow logrotate_t self:sem create_sem_perms;
allow logrotate_t self:msgq create_msgq_perms;
allow logrotate_t self:msg { send receive };
allow logrotate_t logrotate_lock_t:file manage_file_perms;
files_lock_filetrans(logrotate_t, logrotate_lock_t, file)
manage_dirs_pattern(logrotate_t, logrotate_tmp_t, logrotate_tmp_t)
manage_files_pattern(logrotate_t, logrotate_tmp_t, logrotate_tmp_t)
files_tmp_filetrans(logrotate_t, logrotate_tmp_t, { file dir })
create_dirs_pattern(logrotate_t, logrotate_var_lib_t, logrotate_var_lib_t)
manage_files_pattern(logrotate_t, logrotate_var_lib_t, logrotate_var_lib_t)
read_lnk_files_pattern(logrotate_t, logrotate_var_lib_t, logrotate_var_lib_t)
files_var_lib_filetrans(logrotate_t, logrotate_var_lib_t, file)
can_exec(logrotate_t, { logrotate_exec_t logrotate_tmp_t })
kernel_read_system_state(logrotate_t)
kernel_read_kernel_sysctls(logrotate_t)
corecmd_exec_bin(logrotate_t)
corecmd_exec_shell(logrotate_t)
corecmd_getattr_all_executables(logrotate_t)
dev_read_urand(logrotate_t)
domain_signal_all_domains(logrotate_t)
domain_use_interactive_fds(logrotate_t)
domain_getattr_all_entry_files(logrotate_t)
domain_read_all_domains_state(logrotate_t)
files_map_etc_files(logrotate_t)
files_read_usr_files(logrotate_t)
files_read_etc_runtime_files(logrotate_t)
files_read_all_pids(logrotate_t)
files_search_all(logrotate_t)
files_read_var_lib_files(logrotate_t)
files_manage_generic_spool(logrotate_t)
files_manage_generic_spool_dirs(logrotate_t)
files_getattr_generic_locks(logrotate_t)
files_dontaudit_list_mnt(logrotate_t)
fs_search_auto_mountpoints(logrotate_t)
fs_getattr_xattr_fs(logrotate_t)
fs_list_inotifyfs(logrotate_t)
fs_getattr_tmpfs(logrotate_t)
last misc stuff More tiny patches. Note that this and the other 2 patches I just sent are not dependent on each other, please apply any that you like.
2019-01-04 07:35:03 +00:00
# killall reads nsfs files
fs_read_nsfs_files(logrotate_t)
Re-add policy modules from old refpolicy-contrib submodule.
2018-06-23 13:00:56 +00:00
mls_file_read_all_levels(logrotate_t)
mls_file_write_all_levels(logrotate_t)
mls_file_upgrade(logrotate_t)
mls_process_write_to_clearance(logrotate_t)
selinux_get_fs_mount(logrotate_t)
selinux_get_enforce_mode(logrotate_t)
auth_manage_login_records(logrotate_t)
auth_use_nsswitch(logrotate_t)
init_all_labeled_script_domtrans(logrotate_t)
init_startstop_all_script_services(logrotate_t)
init_get_generic_units_status(logrotate_t)
init_get_all_units_status(logrotate_t)
init_get_system_status(logrotate_t)
init_dbus_chat(logrotate_t)
init_stream_connect(logrotate_t)
init_manage_all_units(logrotate_t)
logging_manage_all_logs(logrotate_t)
logging_send_syslog_msg(logrotate_t)
logging_send_audit_msgs(logrotate_t)
logging_exec_all_logs(logrotate_t)
miscfiles_read_localization(logrotate_t)
seutil_dontaudit_read_config(logrotate_t)
userdom_use_user_terminals(logrotate_t)
userdom_list_user_home_dirs(logrotate_t)
userdom_use_unpriv_users_fds(logrotate_t)
ifdef(`distro_debian',`
allow logrotate_t logrotate_tmp_t:file relabel_file_perms;
can_exec(logrotate_t, logrotate_exec_t)
logging_check_exec_syslog(logrotate_t)
logging_read_syslog_config(logrotate_t)
')
optional_policy(`
abrt_manage_cache(logrotate_t)
')
optional_policy(`
acct_domtrans(logrotate_t)
acct_manage_data(logrotate_t)
acct_exec_data(logrotate_t)
')
optional_policy(`
apache_read_config(logrotate_t)
apache_domtrans(logrotate_t)
apache_signull(logrotate_t)
')
optional_policy(`
asterisk_domtrans(logrotate_t)
')
optional_policy(`
awstats_domtrans(logrotate_t)
')
optional_policy(`
bind_manage_cache(logrotate_t)
')
optional_policy(`
callweaver_exec(logrotate_t)
callweaver_stream_connect(logrotate_t)
')
optional_policy(`
consoletype_exec(logrotate_t)
')
optional_policy(`
cron_system_entry(logrotate_t, logrotate_exec_t)
cron_search_spool(logrotate_t)
')
optional_policy(`
cups_domtrans(logrotate_t)
')
optional_policy(`
dbus_system_bus_client(logrotate_t)
init: rename *_pid_* interfaces to use "runtime" The name of these interfaces is clearer that way. This comes from a suggestion from https://lore.kernel.org/selinux-refpolicy/dedf3ce8-4e9f-2313-6799-bbc9dc3a8124@ieee.org/
2019-01-11 20:07:57 +00:00
init_write_runtime_socket(logrotate_t)
Re-add policy modules from old refpolicy-contrib submodule.
2018-06-23 13:00:56 +00:00
')
optional_policy(`
Allow logrotate to execute fail2ban-client fail2ban logrotate configuration runs "fail2ban-client flushlogs" after rotating the logs
2019-05-03 11:32:04 +00:00
fail2ban_domtrans_client(logrotate_t)
Re-add policy modules from old refpolicy-contrib submodule.
2018-06-23 13:00:56 +00:00
fail2ban_stream_connect(logrotate_t)
')
optional_policy(`
hostname_exec(logrotate_t)
')
optional_policy(`
chronyd_read_key_files(logrotate_t)
')
optional_policy(`
icecast_signal(logrotate_t)
')
optional_policy(`
mailman_domtrans(logrotate_t)
mailman_search_data(logrotate_t)
mailman_manage_log(logrotate_t)
')
optional_policy(`
# reload after log rotation
monit_reload(logrotate_t)
')
optional_policy(`
munin_read_config(logrotate_t)
munin_stream_connect(logrotate_t)
munin_search_lib(logrotate_t)
')
optional_policy(`
mysql_read_config(logrotate_t)
mysql_stream_connect(logrotate_t)
mysql_signal(logrotate_t)
')
optional_policy(`
openvswitch_read_pid_files(logrotate_t)
openvswitch_domtrans(logrotate_t)
')
optional_policy(`
polipo_log_filetrans_log(logrotate_t, file, "polipo")
')
optional_policy(`
psad_domtrans(logrotate_t)
')
optional_policy(`
samba_exec_log(logrotate_t)
')
optional_policy(`
sssd_domtrans(logrotate_t)
')
optional_policy(`
slrnpull_manage_spool(logrotate_t)
')
optional_policy(`
squid_domtrans(logrotate_t)
')
optional_policy(`
su_exec(logrotate_t)
')
optional_policy(`
varnishd_manage_log(logrotate_t)
')
optional_policy(`
manage_webalizer_var_lib(logrotate_t)
webalizer_run(logrotate_t, system_r)
')
#######################################
#
# Mail local policy
#
logrotate: Make MTA optional. Signed-off-by: Chris PeBenito <Christopher.PeBenito@microsoft.com>
2019-05-16 12:57:36 +00:00
optional_policy(`
mta_base_mail_template(logrotate)
role system_r types logrotate_mail_t;
allow logrotate_mail_t logrotate_t:fd use;
allow logrotate_mail_t logrotate_t:fifo_file rw_fifo_file_perms;
allow logrotate_mail_t logrotate_t:process sigchld;
Re-add policy modules from old refpolicy-contrib submodule.
2018-06-23 13:00:56 +00:00
logrotate: Make MTA optional. Signed-off-by: Chris PeBenito <Christopher.PeBenito@microsoft.com>
2019-05-16 12:57:36 +00:00
manage_files_pattern(logrotate_mail_t, logrotate_tmp_t, logrotate_tmp_t)
mta_sendmail_domtrans(logrotate_t, logrotate_mail_t)
logging_read_all_logs(logrotate_mail_t)
')
Re-add policy modules from old refpolicy-contrib submodule.
2018-06-23 13:00:56 +00:00