RepoMirrors
/
selinux-refpolicy
mirror of https://github.com/SELinuxProject/refpolicy
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
selinux-refpolicy/policy/modules/system
History
Sven Vermeulen b00d94fb72 Allow capabilities for syslog-ng 
The syslog-ng logger has (build-optional) support for capabilities. If
capabilities support is enabled, running it without setcap/getcap
permissions gives the following upon start:

 * Starting syslog-ng ...
syslog-ng: Error setting capabilities, capability management disabled;
error='Permission denied' [ ok ]

Granting only setcap (initial AVC seen) does not fully help either:

 * Starting syslog-ng ...
 Error managing capability set, cap_set_proc returned an error;

With setcap and getcap enabled, syslog-ng starts and functions fine.

See also https://bugs.gentoo.org/show_bug.cgi?id=488718

Reported-by: Vincent Brillault <gentoo@lerya.net>
Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
 		2013-11-13 09:14:34 -05:00
..
application.fc
…
application.if Start pulling in pieces of Fedora policy in system layer. 2011-03-31 13:29:59 -04:00
application.te Start pulling in pieces of Fedora policy in system layer. 2011-03-31 13:29:59 -04:00
authlogin.fc authlogin: Sudo file context specification did not catch paths (squash me) 2013-09-26 09:25:27 -04:00
authlogin.if authlogin.if: Add auth_create_pam_console_data_dirs and auth_pid_filetrans_pam_var_console interfaces 2012-12-07 00:27:38 -05:00
authlogin.te Module version bump for fc fix in authlogin from Dominick Grift. 2013-09-26 09:27:04 -04:00
clock.fc
…
clock.if Rearrange interfaces in files, clock, and udev. 2012-10-30 14:16:30 -04:00
clock.te Bump module versions for release. 2013-04-24 16:14:52 -04:00
fstools.fc Add label for parted. 2013-08-26 08:30:49 -04:00
fstools.if System layer xml fixes. 2010-08-05 09:25:55 -04:00
fstools.te Add label for parted. 2013-08-26 08:30:49 -04:00
getty.fc trunk: 6 patches from the fedora policy, cherry picked by david hardeman. 2008-08-14 14:19:50 +00:00
getty.if System layer xml fixes. 2010-08-05 09:25:55 -04:00
getty.te Bump module versions for release. 2013-04-24 16:14:52 -04:00
hostname.fc
…
hostname.if System layer xml fixes. 2010-08-05 09:25:55 -04:00
hostname.te Module version bumps for dhcpc leaked fds to hostname. 2013-09-27 15:55:52 -04:00
hotplug.fc
…
hotplug.if System layer xml fixes. 2010-08-05 09:25:55 -04:00
hotplug.te Bump module versions for release. 2013-04-24 16:14:52 -04:00
init.fc Label /var/run/initctl as initctl_t 2013-01-23 07:08:38 -05:00
init.if init: create init_use_inherited_script_ptys() for tmpreaper (Debian) 2013-09-26 10:30:59 -04:00
init.te Module version bump for init interface and corecommand fc from Dominick Grift. 2013-09-26 10:45:51 -04:00
ipsec.fc Use substititions for /usr/local/lib and /etc/init.d 2012-08-15 10:30:25 -04:00
ipsec.if Pull in some changes from Fedora policy system layer. 2011-04-14 11:36:56 -04:00
ipsec.te Bump module versions for release. 2013-04-24 16:14:52 -04:00
iptables.fc Add conntrack fc entry. 2013-04-05 09:45:04 -04:00
iptables.if Add role attributes in iptables. 2011-09-21 08:27:24 -04:00
iptables.te Bump module versions for release. 2013-04-24 16:14:52 -04:00
libraries.fc Explicitly label dovecot libraries lib_t for debian 2012-10-30 13:42:05 -04:00
libraries.if Pull in some changes from Fedora policy system layer. 2011-04-14 11:36:56 -04:00
libraries.te Bump module versions for release. 2013-04-24 16:14:52 -04:00
locallogin.fc Pull in some changes from Fedora policy system layer. 2011-04-14 11:36:56 -04:00
locallogin.if System layer xml fixes. 2010-08-05 09:25:55 -04:00
locallogin.te Bump module versions for release. 2013-04-24 16:14:52 -04:00
logging.fc Remove generic log label for cron location 2012-11-27 09:13:15 -05:00
logging.if Rename logging_search_all_log_dirs to logging_search_all_logs 2012-10-30 13:27:10 -04:00
logging.te Allow capabilities for syslog-ng 2013-11-13 09:14:34 -05:00
lvm.fc udev-acl.ck lists /run/udev/tags/udev-acl udev blocks suspend, and compromises kernel 2013-09-27 16:35:28 -04:00
lvm.if System layer xml fixes. 2010-08-05 09:25:55 -04:00
lvm.te Module version bumps for Debian udev updates from Dominick Grift. 2013-09-27 16:44:54 -04:00
metadata.xml
…
miscfiles.fc Whitespace fix in miscfiles.fc. 2012-11-26 11:07:16 -05:00
miscfiles.if Adjust man cache interface names. 2012-11-26 11:07:32 -05:00
miscfiles.te Bump module versions for release. 2013-04-24 16:14:52 -04:00
modutils.fc split kmod fc into two lines. 2012-10-02 10:08:09 -04:00
modutils.if Changes to the modutils policy module 2012-10-19 08:14:32 -04:00
modutils.te Bump module versions for release. 2013-04-24 16:14:52 -04:00
mount.fc Add mount_var_run_t type and allow mount_t domain to manage the files and directories 2013-01-23 07:11:17 -05:00
mount.if Add role attributes to mount. 2011-09-21 08:27:32 -04:00
mount.te Module version bump for mount updates from Dominick Grift. 2013-09-27 16:54:54 -04:00
netlabel.fc
…
netlabel.if System layer xml fixes. 2010-08-05 09:25:55 -04:00
netlabel.te Whitespace change: drop unnecessary blank line at the start of .te files. 2010-06-10 08:16:35 -04:00
selinuxutil.fc Whitespace fixes from fc.subs changes. 2012-05-10 10:33:54 -04:00
selinuxutil.if Allow semodule to create symlink in semanage_store_t 2013-11-13 09:13:32 -05:00
selinuxutil.te Silence symlink reading by setfiles since it doesn't follow symlinks anyway. 2013-09-27 17:09:43 -04:00
setrans.fc trunk: init script for setrans. 2008-09-18 18:20:31 +00:00
setrans.if System layer xml fixes. 2010-08-05 09:25:55 -04:00
setrans.te Bump module versions for release. 2010-12-13 09:12:22 -05:00
sysnetwork.fc sysnetwork: Debian stores network interface configuration in /run/network (ifstate), That directory is created by the /etc/init.d/networking script. 2013-09-27 14:39:29 -04:00
sysnetwork.if hostname: do not audit attempts by hostname to read and write dhcpc udp sockets (looks like a leaked fd) 2013-09-27 15:13:19 -04:00
sysnetwork.te Module version bump for dhcpc fixes from Dominick Grift. 2013-09-27 17:15:22 -04:00
udev.fc udev-acl.ck lists /run/udev/tags/udev-acl udev blocks suspend, and compromises kernel 2013-09-27 16:35:28 -04:00
udev.if udev.if: Call files_search_pid instead of files_search_var_lib in udev_manage_pid_files 2013-01-23 07:09:05 -05:00
udev.te Module version bumps for Debian udev updates from Dominick Grift. 2013-09-27 16:44:54 -04:00
unconfined.fc Simplify .fc in light of file_contexts.subs_dist 2012-05-10 10:09:00 -04:00
unconfined.if Unconfined domains have unconfined access to all of dbus rather than only system bus 2013-09-26 10:14:30 -04:00
unconfined.te Module version bump for unconfined dbus fixes from Dominick Grift. 2013-09-26 10:25:47 -04:00
userdomain.fc trunk: merge UBAC. 2008-11-05 16:10:46 +00:00
userdomain.if userdomain: restricted xwindows user (squash me) 2013-09-26 09:28:55 -04:00
userdomain.te Module version bump for restricted x user template fix from Dominick Grift. 2013-09-26 09:29:42 -04:00