RepoMirrors
/
selinux-refpolicy
mirror of https://github.com/SELinuxProject/refpolicy
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

logrotate: Make MTA optional. 

Signed-off-by: Chris PeBenito <Christopher.PeBenito@microsoft.com>
This commit is contained in:
Chris PeBenito 2019-05-16 08:57:36 -04:00
parent 2d9ad29d04
commit 5a8c36f390
1 changed files with 13 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
policy/modules/admin/logrotate.te
View File

@ -29,8 +29,6 @@ files_type(logrotate_var_lib_t)
type logrotate_unit_t; type logrotate_unit_t;
init_unit_file(logrotate_unit_t) init_unit_file(logrotate_unit_t)
mta_base_mail_template(logrotate)
role system_r types logrotate_mail_t;
######################################## ########################################
# #
@ -131,8 +129,6 @@ userdom_use_user_terminals(logrotate_t)
userdom_list_user_home_dirs(logrotate_t) userdom_list_user_home_dirs(logrotate_t)
userdom_use_unpriv_users_fds(logrotate_t) userdom_use_unpriv_users_fds(logrotate_t)
mta_sendmail_domtrans(logrotate_t, logrotate_mail_t)
ifdef(`distro_debian',` ifdef(`distro_debian',`
allow logrotate_t logrotate_tmp_t:file relabel_file_perms; allow logrotate_t logrotate_tmp_t:file relabel_file_perms;
can_exec(logrotate_t, logrotate_exec_t) can_exec(logrotate_t, logrotate_exec_t)
@ -279,10 +275,18 @@ optional_policy(`
# Mail local policy # Mail local policy
# #
allow logrotate_mail_t logrotate_t:fd use; optional_policy(`
allow logrotate_mail_t logrotate_t:fifo_file rw_fifo_file_perms; mta_base_mail_template(logrotate)
allow logrotate_mail_t logrotate_t:process sigchld; role system_r types logrotate_mail_t;
manage_files_pattern(logrotate_mail_t, logrotate_tmp_t, logrotate_tmp_t) allow logrotate_mail_t logrotate_t:fd use;
allow logrotate_mail_t logrotate_t:fifo_file rw_fifo_file_perms;
allow logrotate_mail_t logrotate_t:process sigchld;
manage_files_pattern(logrotate_mail_t, logrotate_tmp_t, logrotate_tmp_t)
mta_sendmail_domtrans(logrotate_t, logrotate_mail_t)
logging_read_all_logs(logrotate_mail_t)
')
logging_read_all_logs(logrotate_mail_t)