nnd/selinux-refpolicy
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
3a7e30c22d
selinux-refpolicy/policy/modules/system
History
Nicolas Iooss 3a7e30c22d Allow journald to read the kernel ring buffer and to use /dev/kmsg 
audit.log shows that journald needs to read the kernel read buffer:

    avc:  denied  { syslog_read } for  pid=147 comm="systemd-journal" scontext=system_u:system_r:syslogd_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1

Moreover journald uses RW access to /dev/kmsg, according to its code:
http://cgit.freedesktop.org/systemd/systemd/tree/src/journal/journald-kmsg.c?id=v215#n394
2014-09-12 09:52:18 -04:00
..
application.fc
application.if Start pulling in pieces of Fedora policy in system layer. 2011-03-31 13:29:59 -04:00
application.te Start pulling in pieces of Fedora policy in system layer. 2011-03-31 13:29:59 -04:00
authlogin.fc authlogin: Sudo file context specification did not catch paths (squash me) 2013-09-26 09:25:27 -04:00
authlogin.if authlogin.if: Add auth_create_pam_console_data_dirs and auth_pid_filetrans_pam_var_console interfaces 2012-12-07 00:27:38 -05:00
authlogin.te Bump module versions for release. 2014-03-11 08:16:57 -04:00
clock.fc
clock.if Rearrange interfaces in files, clock, and udev. 2012-10-30 14:16:30 -04:00
clock.te Bump module versions for release. 2014-03-11 08:16:57 -04:00
fstools.fc Label /usr/sbin/{add, del}part as fsadm_exec_t 2014-08-14 15:41:40 -04:00
fstools.if system/fstools.if: Add fstools_use_fds interface 2014-08-18 15:24:46 -04:00
fstools.te Module version bump for losetup fixes from Luis Ressel. 2014-08-19 08:45:38 -04:00
getty.fc
getty.if System layer xml fixes. 2010-08-05 09:25:55 -04:00
getty.te Bump module versions for release. 2013-04-24 16:14:52 -04:00
hostname.fc
hostname.if System layer xml fixes. 2010-08-05 09:25:55 -04:00
hostname.te Bump module versions for release. 2014-03-11 08:16:57 -04:00
hotplug.fc
hotplug.if System layer xml fixes. 2010-08-05 09:25:55 -04:00
hotplug.te Bump module versions for release. 2014-03-11 08:16:57 -04:00
init.fc Move systemd fc entry. 2014-09-12 09:42:59 -04:00
init.if Introduce init_search_run interface 2014-09-12 09:46:01 -04:00
init.te Label systemd files in init module 2014-09-12 09:41:25 -04:00
ipsec.fc Use substititions for /usr/local/lib and /etc/init.d 2012-08-15 10:30:25 -04:00
ipsec.if Pull in some changes from Fedora policy system layer. 2011-04-14 11:36:56 -04:00
ipsec.te Bump module versions for release. 2013-04-24 16:14:52 -04:00
iptables.fc Add conntrack fc entry. 2013-04-05 09:45:04 -04:00
iptables.if Add role attributes in iptables. 2011-09-21 08:27:24 -04:00
iptables.te Bump module versions for release. 2014-03-11 08:16:57 -04:00
libraries.fc Label /lib symlink as lib_t for every distro 2014-07-08 08:49:37 -04:00
libraries.if Pull in some changes from Fedora policy system layer. 2011-04-14 11:36:56 -04:00
libraries.te Module version bump for libraries fc fix from Nicolas Iooss. 2014-07-08 08:53:06 -04:00
locallogin.fc Pull in some changes from Fedora policy system layer. 2011-04-14 11:36:56 -04:00
locallogin.if System layer xml fixes. 2010-08-05 09:25:55 -04:00
locallogin.te Bump module versions for release. 2014-03-11 08:16:57 -04:00
logging.fc Whitespace change in logging.fc. 2014-09-12 09:49:37 -04:00
logging.if Support logging with /run/systemd/journal/dev-log 2014-09-12 09:50:48 -04:00
logging.te Allow journald to read the kernel ring buffer and to use /dev/kmsg 2014-09-12 09:52:18 -04:00
lvm.fc udev-acl.ck lists /run/udev/tags/udev-acl udev blocks suspend, and compromises kernel 2013-09-27 16:35:28 -04:00
lvm.if System layer xml fixes. 2010-08-05 09:25:55 -04:00
lvm.te Bump module versions for release. 2014-03-11 08:16:57 -04:00
metadata.xml
miscfiles.fc Label /etc/locale.alias as locale_t on Debian 2014-04-21 09:02:26 -04:00
miscfiles.if Fix misspelling 2014-06-09 08:21:45 -04:00
miscfiles.te Module version bump for fixes from Laurent Bigonville. 2014-04-21 09:24:28 -04:00
modutils.fc split kmod fc into two lines. 2012-10-02 10:08:09 -04:00
modutils.if Changes to the modutils policy module 2012-10-19 08:14:32 -04:00
modutils.te Bump module versions for release. 2014-03-11 08:16:57 -04:00
mount.fc Rearrange ZFS fc entries. 2014-01-21 08:55:28 -05:00
mount.if system/mount.if: Add mount_rw_loopback_files interface 2014-08-18 15:24:46 -04:00
mount.te Module version bump for FUSE fix for mount from Luis Ressel. 2014-08-21 09:53:51 -04:00
netlabel.fc
netlabel.if System layer xml fixes. 2010-08-05 09:25:55 -04:00
netlabel.te
selinuxutil.fc Label /etc/selinux/([^/]*/)?modules(/.*)? as semanage_store_t 2014-01-16 16:12:44 -05:00
selinuxutil.if Label /etc/selinux/([^/]*/)?modules(/.*)? as semanage_store_t 2014-01-16 16:12:44 -05:00
selinuxutil.te Module version bump for 2 patch sets from Laurent Bigonville. 2014-04-11 11:21:03 -04:00
setrans.fc
setrans.if System layer xml fixes. 2010-08-05 09:25:55 -04:00
setrans.te Module version bump for init_daemon_pid_file from Sven Vermeulen. 2014-06-30 14:34:51 -04:00
sysnetwork.fc ifconfig can also be in /bin 2014-05-27 08:53:55 -04:00
sysnetwork.if hostname: do not audit attempts by hostname to read and write dhcpc udp sockets (looks like a leaked fd) 2013-09-27 15:13:19 -04:00
sysnetwork.te Module version bump for init_daemon_pid_file from Sven Vermeulen. 2014-06-30 14:34:51 -04:00
udev.fc Label /usr/share/virtualbox/VBoxCreateUSBNode.sh as udev_helper_exec_t 2014-04-21 10:15:51 -04:00
udev.if udev.if: Call files_search_pid instead of files_search_var_lib in udev_manage_pid_files 2013-01-23 07:09:05 -05:00
udev.te Module version bump for init_daemon_pid_file from Sven Vermeulen. 2014-06-30 14:34:51 -04:00
unconfined.fc Simplify .fc in light of file_contexts.subs_dist 2012-05-10 10:09:00 -04:00
unconfined.if Allow unconfined domains to use syslog capability 2014-06-09 09:28:33 -04:00
unconfined.te Module version bump for unconfined syslog cap from Nicolas Iooss. 2014-06-09 09:29:12 -04:00
userdomain.fc
userdomain.if Fix misspelling 2014-06-09 08:21:45 -04:00
userdomain.te Module version bump for deprecated interface usage removal from Nicolas Iooss. 2014-05-27 09:23:29 -04:00