From 1abafe3707cd3cec6ef2b3747da4696b15527f2e Mon Sep 17 00:00:00 2001
From: Chris PeBenito <cpebenito@tresys.com>
Date: Wed, 12 Dec 2007 16:18:50 +0000
Subject: [PATCH] trunk: Patch for debian logrotate to handle
 syslogd-listfiles, from Vaclav Ovsik.

---
 Changelog                         |  1 +
 policy/modules/admin/logrotate.te |  5 ++++-
 policy/modules/system/logging.if  | 19 +++++++++++++++++++
 policy/modules/system/logging.te  |  2 +-
 4 files changed, 25 insertions(+), 2 deletions(-)

diff --git a/Changelog b/Changelog
index a892416ce..df6aad65f 100644
--- a/Changelog
+++ b/Changelog
@@ -1,3 +1,4 @@
+- Patch for debian logrotate to handle syslogd-listfiles, from Vaclav Ovsik.
 - Improve several tunables descriptions from Dan Walsh.
 - Patch to clean up ns switch usage in the policy from Dan Walsh.
 - More complete labeled networking infrastructure from KaiGai Kohei.
diff --git a/policy/modules/admin/logrotate.te b/policy/modules/admin/logrotate.te
index 271e1a3bf..31999fed1 100644
--- a/policy/modules/admin/logrotate.te
+++ b/policy/modules/admin/logrotate.te
@@ -1,5 +1,5 @@
 
-policy_module(logrotate,1.6.0)
+policy_module(logrotate,1.6.1)
 
 ########################################
 #
@@ -127,6 +127,9 @@ ifdef(`distro_debian', `
 	allow logrotate_t logrotate_tmp_t:file { relabelfrom relabelto };
 	# for savelog
 	can_exec(logrotate_t, logrotate_exec_t)
+
+	# for syslogd-listfiles
+	logging_read_syslog_config(logrotate_t)
 ')
 
 optional_policy(`
diff --git a/policy/modules/system/logging.if b/policy/modules/system/logging.if
index 4b702fbb0..e566ab1fd 100644
--- a/policy/modules/system/logging.if
+++ b/policy/modules/system/logging.if
@@ -398,6 +398,25 @@ interface(`logging_dontaudit_search_audit_config',`
 	dontaudit $1 auditd_etc_t:dir search_dir_perms;
 ')
 
+########################################
+## <summary>
+##	Read syslog configuration files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`logging_read_syslog_config',`
+	gen_require(`
+		type syslog_conf_t;
+	')
+
+	allow $1 syslog_conf_t:file read_file_perms;
+')
+
 ########################################
 ## <summary>
 ##	Allows the domain to open a file in the
diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te
index 8f7bc86cb..f6619dc30 100644
--- a/policy/modules/system/logging.te
+++ b/policy/modules/system/logging.te
@@ -1,5 +1,5 @@
 
-policy_module(logging,1.8.3)
+policy_module(logging,1.8.4)
 
 ########################################
 #