diff --git a/policy/modules/system/logging.fc b/policy/modules/system/logging.fc index ba5542f92..b5e845af5 100644 --- a/policy/modules/system/logging.fc +++ b/policy/modules/system/logging.fc @@ -3,6 +3,8 @@ /etc/rsyslog.conf gen_context(system_u:object_r:syslog_conf_t,s0) /etc/syslog.conf gen_context(system_u:object_r:syslog_conf_t,s0) /etc/audit(/.*)? gen_context(system_u:object_r:auditd_etc_t,mls_systemhigh) +/etc/rc\.d/init\.d/auditd -- gen_context(system_u:object_r:auditd_initrc_exec_t,s0) +/etc/rc\.d/init\.d/rsyslog -- gen_context(system_u:object_r:syslogd_initrc_exec_t,s0) /sbin/audispd -- gen_context(system_u:object_r:audisp_exec_t,s0) /sbin/audisp-remote -- gen_context(system_u:object_r:audisp_remote_exec_t,s0) diff --git a/policy/modules/system/logging.if b/policy/modules/system/logging.if index 64bea0953..05d6d6958 100644 --- a/policy/modules/system/logging.if +++ b/policy/modules/system/logging.if @@ -281,7 +281,7 @@ interface(`logging_dispatcher_domain',` role system_r types $1; domtrans_pattern(audisp_t, $2, $1) - allow $1 audisp_t:process signal; + allow audisp_t $1:process { sigkill sigstop signull signal }; allow audisp_t $2:file getattr; allow $1 audisp_t:unix_stream_socket rw_socket_perms; diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te index 9474b1099..ab4edef1a 100644 --- a/policy/modules/system/logging.te +++ b/policy/modules/system/logging.te @@ -1,5 +1,5 @@ -policy_module(logging, 1.11.3) +policy_module(logging, 1.11.4) ######################################## # @@ -24,6 +24,9 @@ type auditd_t; type auditd_exec_t; init_daemon_domain(auditd_t,auditd_exec_t) +type auditd_initrc_exec_t; +init_script_file(auditd_initrc_exec_t) + type auditd_var_run_t; files_pid_file(auditd_var_run_t) @@ -59,6 +62,9 @@ type syslogd_t; type syslogd_exec_t; init_daemon_domain(syslogd_t,syslogd_exec_t) +type syslogd_initrc_exec_t; +init_script_file(syslogd_initrc_exec_t) + type syslogd_tmp_t; files_tmp_file(syslogd_tmp_t)