Changeset 2788

Timestamp:

08/22/08 10:17:01 (3 months ago)

Author:

cpebenito

Message:

trunk: fedora update cherry picked by david hardeman.

Files:

• trunk/policy/modules/services/setroubleshoot.te (modified) (2 diffs)
• trunk/policy/modules/system/logging.fc (modified) (5 diffs)
• trunk/policy/modules/system/logging.if (modified) (7 diffs)
• trunk/policy/modules/system/logging.te (modified) (13 diffs)

trunk/policy/modules/services/setroubleshoot.te

@@ -1 +1 @@
-
-0
+1
-
-########################################
@@ -99 +99 @@
-
-logging_send_syslog_msg(setroubleshootd_t)
-auditd
+dispatcher
-
-seutil_read_config(setroubleshootd_t)

trunk/policy/modules/system/logging.fc

@@ -5 +5 @@
-/etc/audit(/.*)?                gen_context(system_u:object_r:auditd_etc_t,mls_systemhigh)
-
+/sbin/audispd           --      gen_context(system_u:object_r:audisp_exec_t,s0)
+/sbin/audisp-remote     --      gen_context(system_u:object_r:audisp_remote_exec_t,s0)
-/sbin/auditctl          --      gen_context(system_u:object_r:auditctl_exec_t,s0)
-/sbin/auditd            --      gen_context(system_u:object_r:auditd_exec_t,s0)
@@ -21 +23 @@
-/usr/sbin/syslogd       --      gen_context(system_u:object_r:syslogd_exec_t,s0)
-
+/var/lib/syslog-ng(/.*)?        gen_context(system_u:object_r:syslogd_var_lib_t,s0)
-/var/lib/syslog-ng.persist --   gen_context(system_u:object_r:syslogd_var_lib_t,s0)
-
@@ -29 +32 @@
-/var/axfrdns/log/main(/.*)?     gen_context(system_u:object_r:var_log_t,s0)
-/var/dnscache/log/main(/.*)?    gen_context(system_u:object_r:var_log_t,s0)
+/var/cfengine/outputs(/.*)?     gen_context(system_u:object_r:var_log_t,s0)
-
-/var/log                -d      gen_context(system_u:object_r:var_log_t,s0-mls_systemhigh)
@@ -38 +42 @@
-/var/log/spooler[^/]*           gen_context(system_u:object_r:var_log_t,mls_systemhigh)
-/var/log/audit(/.*)?            gen_context(system_u:object_r:auditd_log_t,mls_systemhigh)
---
+
-
-ifndef(`distro_gentoo',`
@@ -49 +53 @@
-
-/var/run/audit_events   -s      gen_context(system_u:object_r:auditd_var_run_t,s0)
-td
+sp
-/var/run/auditd\.pid    --      gen_context(system_u:object_r:auditd_var_run_t,s0)
-/var/run/auditd_sock    -s      gen_context(system_u:object_r:auditd_var_run_t,s0)

trunk/policy/modules/system/logging.if

@@ -214 +214 @@
-#
-interface(`logging_stream_connect_auditd',`
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-        ')
-
-        files_search_pids($1)
-auditd_var_run_t,auditd_var_run_t,auditd
+ audisp_var_run_t, audisp_var_run_t, audisp
-')
-
@@ -531 +616 @@
-
-        files_search_var($1)
-
-
+
-')
-
@@ -580 +664 @@
-########################################
-## <summary>
+##      read/write to all log files.
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+#
+interface(`logging_rw_all_logs',`
+        gen_require(`
+                attribute logfile;
+        ')
+
+        files_search_var($1)
+        rw_files_pattern($1, logfile, logfile)
+')
+
+########################################
+## <summary>
-##      Create, read, write, and delete all log files.
-## </summary>
@@ -642 +745 @@
-########################################
-## <summary>
+##      Dontaudit Write generic log files.
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+#
+interface(`logging_dontaudit_write_generic_logs',`
+        gen_require(`
+                type var_log_t;
+        ')
+
+        dontaudit $1 var_log_t:file write;
+')
+
+########################################
+## <summary>
-##      Read and write generic log files.
-## </summary>
@@ -691 +812 @@
-##      </summary>
-## </param>
+## <param name="role">
+##      <summary>
+##      User role allowed access.
+##      </summary>
+## </param>
+## <param name="terminal">
+##      <summary>
+##      User terminal type.
+##      </summary>
+## </param>
-## <rolecap/>
-#
@@ -710 +841 @@
-        manage_dirs_pattern($1, auditd_var_run_t, auditd_var_run_t)
-        manage_files_pattern($1, auditd_var_run_t, auditd_var_run_t)
+
+        logging_run_auditctl($1, $2, $3)
-')
-
@@ -769 +902 @@
-##      </summary>
-## </param>
+## <param name="role">
+##      <summary>
+##      User role allowed access.
+##      </summary>
+## </param>
+## <param name="terminal">
+##      <summary>
+##      User terminal type.
+##      </summary>
+## </param>
-## <rolecap/>
-#
-interface(`logging_admin',`
-
+, $2, $3
-        logging_admin_syslog($1)
-')

trunk/policy/modules/system/logging.te

@@ -1 +1 @@
-
-1
+2
-
-########################################
@@ -28 +28 @@
-files_pid_file(auditd_var_run_t)
-
+type audisp_t;
+type audisp_exec_t;
+init_system_domain(audisp_t, audisp_exec_t)
+
+type audisp_var_run_t;
+files_pid_file(audisp_var_run_t)
+
+type audisp_remote_t;
+type audisp_remote_exec_t;
+logging_dispatcher_domain(audisp_remote_t, audisp_remote_exec_t)
+
-type devlog_t;
-files_type(devlog_t)
@@ -63 +74 @@
-
-ifdef(`enable_mls',`
-
+
+
-')
-
@@ -151 +163 @@
-logging_set_audit_parameters(auditd_t)
-logging_send_syslog_msg(auditd_t)
+logging_domtrans_dispatcher(auditd_t)
+logging_signal_dispatcher(auditd_t)
-
-libs_use_ld_so(auditd_t)
@@ -161 +175 @@
-
-seutil_dontaudit_read_config(auditd_t)
+
+sysnet_dns_name_resolve(auditd_t)
-
-userdom_dontaudit_use_unpriv_user_fds(auditd_t)
@@ -173 +189 @@
-
-optional_policy(`
+        mta_send_mail(auditd_t)
+')
+
+optional_policy(`
-        seutil_sigchld_newrole(auditd_t)
-')
@@ -179 +199 @@
-        udev_read_db(auditd_t)
-')
+
+########################################
+#
+# audit dispatcher local policy
+#
+
+allow audisp_t self:capability sys_nice;
+allow audisp_t self:process setsched;
+allow audisp_t self:fifo_file rw_file_perms;
+allow audisp_t self:unix_stream_socket create_stream_socket_perms;
+allow audisp_t self:unix_dgram_socket create_socket_perms;
+
+allow audisp_t auditd_t:unix_stream_socket rw_file_perms;
+
+manage_sock_files_pattern(audisp_t, audisp_var_run_t, audisp_var_run_t)
+files_pid_filetrans(audisp_t, audisp_var_run_t, sock_file)
+
+corecmd_search_bin(audisp_t)
+
+domain_use_interactive_fds(audisp_t)
+
+files_read_etc_files(audisp_t)
+
+mls_file_write_all_levels(audisp_t)
+
+libs_use_ld_so(audisp_t)
+libs_use_shared_libs(audisp_t)
+
+logging_send_syslog_msg(audisp_t)
+
+miscfiles_read_localization(audisp_t)
+
+########################################
+#
+# Audit remote logger local policy
+#
+
+allow audisp_remote_t self:tcp_socket create_socket_perms;
+
+corenet_all_recvfrom_unlabeled(audisp_remote_t)
+corenet_all_recvfrom_netlabel(audisp_remote_t)
+corenet_tcp_sendrecv_all_if(audisp_remote_t)
+corenet_tcp_sendrecv_all_nodes(audisp_remote_t)
+
+files_read_etc_files(audisp_remote_t)
+
+libs_use_ld_so(audisp_remote_t)
+libs_use_shared_libs(audisp_remote_t)
+
+logging_send_syslog_msg(audisp_remote_t)
+
+miscfiles_read_localization(audisp_remote_t)
+
+sysnet_dns_name_resolve(audisp_remote_t)
-
-########################################
@@ -254 +328 @@
-# setpgid for metalog
-allow syslogd_t self:process { signal_perms setpgid };
-allow syslogd_t self:netlink_route_socket r_netlink_socket_perms;
-# receive messages to be logged
-allow syslogd_t self:unix_dgram_socket create_socket_perms;
@@ -291 +364 @@
-files_pid_filetrans(syslogd_t,syslogd_var_run_t,file)
-
+kernel_read_system_state(syslogd_t)
-kernel_read_kernel_sysctls(syslogd_t)
-kernel_read_proc_symlinks(syslogd_t)
@@ -297 +371 @@
-kernel_clear_ring_buffer(syslogd_t)
-kernel_change_ring_buffer_level(syslogd_t)
-
-dev_filetrans(syslogd_t,devlog_t,sock_file)
-dev_read_sysfs(syslogd_t)
-
-fs_search_auto_mountpoints(syslogd_t)
-
-term_write_console(syslogd_t)
-# Allow syslog to a terminal
-term_write_unallocated_ttys(syslogd_t)
-
-# for sending messages to logged in users
-init_read_utmp(syslogd_t)
-init_dontaudit_write_utmp(syslogd_t)
-term_write_all_user_ttys(syslogd_t)
-
-corenet_all_recvfrom_unlabeled(syslogd_t)
@@ -329 +389 @@
-corenet_tcp_bind_syslogd_port(syslogd_t)
-corenet_tcp_connect_syslogd_port(syslogd_t)
+corenet_tcp_connect_postgresql_port(syslogd_t)
+corenet_tcp_connect_mysqld_port(syslogd_t)
-
-# syslog-ng can send or receive logs
-corenet_sendrecv_syslogd_client_packets(syslogd_t)
-corenet_sendrecv_syslogd_server_packets(syslogd_t)
-
-
-
-
+
+
+
+
+
-
-domain_use_interactive_fds(syslogd_t)
-
-files_read_etc_files(syslogd_t)
+files_read_usr_files(syslogd_t)
-files_read_var_files(syslogd_t)
-files_read_etc_runtime_files(syslogd_t)
-# /initrd is not umounted before minilog starts
-files_dontaudit_search_isid_type_dirs(syslogd_t)
+files_read_kernel_symbol_table(syslogd_t)
+
+fs_getattr_all_fs(syslogd_t)
+fs_search_auto_mountpoints(syslogd_t)
+
+mls_file_write_all_levels(syslogd_t) # Need to be able to write to /var/run/ and /var/log directories
+
+term_write_console(syslogd_t)
+# Allow syslog to a terminal
+term_write_unallocated_ttys(syslogd_t)
+
+# for sending messages to logged in users
+init_read_utmp(syslogd_t)
+init_dontaudit_write_utmp(syslogd_t)
+term_write_all_user_ttys(syslogd_t)
+
+auth_use_nsswitch(syslogd_t)
+
+init_use_fds(syslogd_t)
-
-libs_use_ld_so(syslogd_t)
@@ -351 +434 @@
-# cjp: this doesnt make sense
-logging_send_syslog_msg(syslogd_t)
-
-sysnet_read_config(syslogd_t)
-
-miscfiles_read_localization(syslogd_t)
@@ -383 +464 @@
-
-optional_policy(`
-
-
-
-
-
+
-')
-