|
Chris PeBenito |
96ce00a |
|
|
Chris PeBenito |
ed38ca9 |
policy_module(logrotate,1.3.1)
|
|
Chris PeBenito |
96ce00a |
|
|
Chris PeBenito |
96ce00a |
########################################
|
|
Chris PeBenito |
96ce00a |
#
|
|
Chris PeBenito |
96ce00a |
# Declarations
|
|
Chris PeBenito |
96ce00a |
#
|
|
Chris PeBenito |
96ce00a |
|
|
Chris PeBenito |
142e9f4 |
type logrotate_t;
|
|
Chris PeBenito |
96ce00a |
domain_type(logrotate_t)
|
|
Chris PeBenito |
1815bad |
domain_obj_id_change_exemption(logrotate_t)
|
|
Chris PeBenito |
1815bad |
domain_system_change_exemption(logrotate_t)
|
|
Chris PeBenito |
96ce00a |
role system_r types logrotate_t;
|
|
Chris PeBenito |
96ce00a |
|
|
Chris PeBenito |
96ce00a |
type logrotate_exec_t;
|
|
Chris PeBenito |
4483ee8 |
domain_entry_file(logrotate_t,logrotate_exec_t)
|
|
Chris PeBenito |
96ce00a |
|
|
Chris PeBenito |
98a8ead |
type logrotate_lock_t;
|
|
Chris PeBenito |
98a8ead |
files_lock_file(logrotate_lock_t)
|
|
Chris PeBenito |
98a8ead |
|
|
Chris PeBenito |
96ce00a |
type logrotate_tmp_t;
|
|
Chris PeBenito |
96ce00a |
files_tmp_file(logrotate_tmp_t)
|
|
Chris PeBenito |
96ce00a |
|
|
Chris PeBenito |
96ce00a |
type logrotate_var_lib_t;
|
|
Chris PeBenito |
8fd3673 |
files_type(logrotate_var_lib_t)
|
|
Chris PeBenito |
96ce00a |
|
|
Chris PeBenito |
96ce00a |
########################################
|
|
Chris PeBenito |
96ce00a |
#
|
|
Chris PeBenito |
96ce00a |
# Local policy
|
|
Chris PeBenito |
96ce00a |
#
|
|
Chris PeBenito |
96ce00a |
|
|
Chris PeBenito |
96ce00a |
# Change ownership on log files.
|
|
Chris PeBenito |
96ce00a |
allow logrotate_t self:capability { chown dac_override dac_read_search kill fsetid fowner sys_resource sys_nice };
|
|
Chris PeBenito |
96ce00a |
# for mailx
|
|
Chris PeBenito |
96ce00a |
dontaudit logrotate_t self:capability { setuid setgid };
|
|
Chris PeBenito |
96ce00a |
|
|
Chris PeBenito |
9d3bdc2 |
allow logrotate_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
|
|
Chris PeBenito |
96ce00a |
|
|
Chris PeBenito |
96ce00a |
# Set a context other than the default one for newly created files.
|
|
Chris PeBenito |
96ce00a |
allow logrotate_t self:process setfscreate;
|
|
Chris PeBenito |
96ce00a |
|
|
Chris PeBenito |
96ce00a |
allow logrotate_t self:fd use;
|
|
Chris PeBenito |
96ce00a |
allow logrotate_t self:fifo_file rw_file_perms;
|
|
Chris PeBenito |
96ce00a |
allow logrotate_t self:unix_dgram_socket create_socket_perms;
|
|
Chris PeBenito |
96ce00a |
allow logrotate_t self:unix_stream_socket create_stream_socket_perms;
|
|
Chris PeBenito |
96ce00a |
allow logrotate_t self:unix_dgram_socket sendto;
|
|
Chris PeBenito |
96ce00a |
allow logrotate_t self:unix_stream_socket connectto;
|
|
Chris PeBenito |
96ce00a |
allow logrotate_t self:shm create_shm_perms;
|
|
Chris PeBenito |
96ce00a |
allow logrotate_t self:sem create_sem_perms;
|
|
Chris PeBenito |
96ce00a |
allow logrotate_t self:msgq create_msgq_perms;
|
|
Chris PeBenito |
96ce00a |
allow logrotate_t self:msg { send receive };
|
|
Chris PeBenito |
96ce00a |
|
|
Chris PeBenito |
98a8ead |
allow logrotate_t logrotate_lock_t:file create_file_perms;
|
|
Chris PeBenito |
1c1ac67 |
files_lock_filetrans(logrotate_t,logrotate_lock_t,file)
|
|
Chris PeBenito |
98a8ead |
|
|
Chris PeBenito |
96ce00a |
can_exec(logrotate_t, logrotate_tmp_t)
|
|
Chris PeBenito |
96ce00a |
|
|
Chris PeBenito |
96ce00a |
allow logrotate_t logrotate_tmp_t:dir create_dir_perms;
|
|
Chris PeBenito |
96ce00a |
allow logrotate_t logrotate_tmp_t:file create_file_perms;
|
|
Chris PeBenito |
103fe28 |
files_tmp_filetrans(logrotate_t, logrotate_tmp_t, { file dir })
|
|
Chris PeBenito |
96ce00a |
|
|
Chris PeBenito |
5a2649c |
# for /var/lib/logrotate.status and /var/lib/logcheck
|
|
Chris PeBenito |
96ce00a |
allow logrotate_t logrotate_var_lib_t:dir { create rw_dir_perms };
|
|
Chris PeBenito |
5a2649c |
allow logrotate_t logrotate_var_lib_t:file create_file_perms;
|
|
Chris PeBenito |
1c1ac67 |
files_var_lib_filetrans(logrotate_t, logrotate_var_lib_t, file)
|
|
Chris PeBenito |
96ce00a |
|
|
Chris PeBenito |
96ce00a |
kernel_read_system_state(logrotate_t)
|
|
Chris PeBenito |
445522d |
kernel_read_kernel_sysctls(logrotate_t)
|
|
Chris PeBenito |
96ce00a |
|
|
Chris PeBenito |
96ce00a |
dev_read_urand(logrotate_t)
|
|
Chris PeBenito |
96ce00a |
|
|
Chris PeBenito |
96ce00a |
fs_search_auto_mountpoints(logrotate_t)
|
|
Chris PeBenito |
96ce00a |
fs_getattr_xattr_fs(logrotate_t)
|
|
Chris PeBenito |
96ce00a |
|
|
Chris PeBenito |
bf080a4 |
mls_file_read_up(logrotate_t)
|
|
Chris PeBenito |
bf080a4 |
mls_file_write_down(logrotate_t)
|
|
Chris PeBenito |
bf080a4 |
mls_file_upgrade(logrotate_t)
|
|
Chris PeBenito |
bf080a4 |
|
|
Chris PeBenito |
96ce00a |
selinux_get_fs_mount(logrotate_t)
|
|
Chris PeBenito |
a082484 |
selinux_get_enforce_mode(logrotate_t)
|
|
Chris PeBenito |
96ce00a |
|
|
Chris PeBenito |
96ce00a |
auth_manage_login_records(logrotate_t)
|
|
Chris PeBenito |
96ce00a |
|
|
Chris PeBenito |
96ce00a |
# Run helper programs.
|
|
Chris PeBenito |
96ce00a |
corecmd_exec_bin(logrotate_t)
|
|
Chris PeBenito |
96ce00a |
corecmd_exec_sbin(logrotate_t)
|
|
Chris PeBenito |
96ce00a |
corecmd_exec_shell(logrotate_t)
|
|
Chris PeBenito |
96ce00a |
corecmd_exec_ls(logrotate_t)
|
|
Chris PeBenito |
96ce00a |
|
|
Chris PeBenito |
96ce00a |
domain_signal_all_domains(logrotate_t)
|
|
Chris PeBenito |
15722ec |
domain_use_interactive_fds(logrotate_t)
|
|
Chris PeBenito |
5a2649c |
domain_getattr_all_entry_files(logrotate_t)
|
|
Chris PeBenito |
3774e4e |
# Read /proc/PID directories for all domains.
|
|
Chris PeBenito |
3774e4e |
domain_read_all_domains_state(logrotate_t)
|
|
Chris PeBenito |
96ce00a |
|
|
Chris PeBenito |
96ce00a |
files_read_usr_files(logrotate_t)
|
|
Chris PeBenito |
8fd3673 |
files_read_etc_files(logrotate_t)
|
|
Chris PeBenito |
96ce00a |
files_read_etc_runtime_files(logrotate_t)
|
|
Chris PeBenito |
96ce00a |
files_read_all_pids(logrotate_t)
|
|
Chris PeBenito |
96ce00a |
# Write to /var/spool/slrnpull - should be moved into its own type.
|
|
Chris PeBenito |
9e04f5c |
files_manage_generic_spool(logrotate_t)
|
|
Chris PeBenito |
8fd3673 |
files_manage_generic_spool_dirs(logrotate_t)
|
|
Chris PeBenito |
96ce00a |
|
|
Chris PeBenito |
96ce00a |
# cjp: why is this needed?
|
|
Chris PeBenito |
96ce00a |
init_domtrans_script(logrotate_t)
|
|
Chris PeBenito |
96ce00a |
|
|
Chris PeBenito |
96ce00a |
logging_manage_all_logs(logrotate_t)
|
|
Chris PeBenito |
5a2649c |
logging_send_syslog_msg(logrotate_t)
|
|
Chris PeBenito |
96ce00a |
# cjp: why is this needed?
|
|
Chris PeBenito |
96ce00a |
logging_exec_all_logs(logrotate_t)
|
|
Chris PeBenito |
96ce00a |
|
|
Chris PeBenito |
96ce00a |
libs_use_ld_so(logrotate_t)
|
|
Chris PeBenito |
96ce00a |
libs_use_shared_libs(logrotate_t)
|
|
Chris PeBenito |
96ce00a |
|
|
Chris PeBenito |
96ce00a |
miscfiles_read_localization(logrotate_t)
|
|
Chris PeBenito |
96ce00a |
|
|
Chris PeBenito |
a082484 |
seutil_dontaudit_read_config(logrotate_t)
|
|
Chris PeBenito |
5a2649c |
|
|
Chris PeBenito |
96ce00a |
sysnet_read_config(logrotate_t)
|
|
Chris PeBenito |
96ce00a |
|
|
Chris PeBenito |
ed38ca9 |
userdom_dontaudit_search_sysadm_home_dirs(logrotate_t)
|
|
Chris PeBenito |
103fe28 |
userdom_use_unpriv_users_fds(logrotate_t)
|
|
Chris PeBenito |
96ce00a |
|
|
Chris PeBenito |
96ce00a |
cron_system_entry(logrotate_t, logrotate_exec_t)
|
|
Chris PeBenito |
96ce00a |
cron_search_spool(logrotate_t)
|
|
Chris PeBenito |
96ce00a |
|
|
Chris PeBenito |
96ce00a |
mta_send_mail(logrotate_t)
|
|
Chris PeBenito |
96ce00a |
|
|
Chris PeBenito |
96ce00a |
ifdef(`distro_debian', `
|
|
Chris PeBenito |
96ce00a |
allow logrotate_t logrotate_tmp_t:file { relabelfrom relabelto };
|
|
Chris PeBenito |
96ce00a |
# for savelog
|
|
Chris PeBenito |
96ce00a |
can_exec(logrotate_t, logrotate_exec_t)
|
|
Chris PeBenito |
142e9f4 |
')
|
|
Chris PeBenito |
142e9f4 |
|
|
Chris PeBenito |
142e9f4 |
ifdef(`targeted_policy',`
|
|
Chris PeBenito |
9550194 |
unconfined_domain(logrotate_t)
|
|
Chris PeBenito |
96ce00a |
')
|
|
Chris PeBenito |
96ce00a |
|
|
Chris PeBenito |
bb7170f |
optional_policy(`
|
|
Chris PeBenito |
9a66d4e |
acct_domtrans(logrotate_t)
|
|
Chris PeBenito |
9a66d4e |
acct_manage_data(logrotate_t)
|
|
Chris PeBenito |
9a66d4e |
acct_exec_data(logrotate_t)
|
|
Chris PeBenito |
9a66d4e |
')
|
|
Chris PeBenito |
9a66d4e |
|
|
Chris PeBenito |
bb7170f |
optional_policy(`
|
|
Chris PeBenito |
a996bdf |
apache_read_config(logrotate_t)
|
|
Chris PeBenito |
a996bdf |
apache_domtrans(logrotate_t)
|
|
Chris PeBenito |
a996bdf |
apache_signull(logrotate_t)
|
|
Chris PeBenito |
a996bdf |
')
|
|
Chris PeBenito |
a996bdf |
|
|
Chris PeBenito |
bb7170f |
optional_policy(`
|
|
Chris PeBenito |
96ce00a |
consoletype_exec(logrotate_t)
|
|
Chris PeBenito |
96ce00a |
')
|
|
Chris PeBenito |
96ce00a |
|
|
Chris PeBenito |
bb7170f |
optional_policy(`
|
|
Chris PeBenito |
9fd4b81 |
cups_domtrans(logrotate_t)
|
|
Chris PeBenito |
9fd4b81 |
')
|
|
Chris PeBenito |
9fd4b81 |
|
|
Chris PeBenito |
bb7170f |
optional_policy(`
|
|
Chris PeBenito |
2705f9a |
hostname_exec(logrotate_t)
|
|
Chris PeBenito |
2705f9a |
')
|
|
Chris PeBenito |
2705f9a |
|
|
Chris PeBenito |
bb7170f |
optional_policy(`
|
|
Chris PeBenito |
84c9223 |
samba_exec_log(logrotate_t)
|
|
Chris PeBenito |
84c9223 |
')
|
|
Chris PeBenito |
84c9223 |
|
|
Chris PeBenito |
bb7170f |
optional_policy(`
|
|
Chris PeBenito |
799a0b4 |
mailman_exec(logrotate_t)
|
|
Chris PeBenito |
799a0b4 |
mailman_search_data(logrotate_t)
|
|
Chris PeBenito |
799a0b4 |
mailman_manage_log(logrotate_t)
|
|
Chris PeBenito |
799a0b4 |
')
|
|
Chris PeBenito |
799a0b4 |
|
|
Chris PeBenito |
bb7170f |
optional_policy(`
|
|
Chris PeBenito |
b6d37eb |
munin_read_config(logrotate_t)
|
|
Chris PeBenito |
b6d37eb |
munin_stream_connect(logrotate_t)
|
|
Chris PeBenito |
b6d37eb |
munin_search_lib(logrotate_t)
|
|
Chris PeBenito |
b6d37eb |
')
|
|
Chris PeBenito |
b6d37eb |
|
|
Chris PeBenito |
b6d37eb |
optional_policy(`
|
|
Chris PeBenito |
42be7c2 |
mysql_read_config(logrotate_t)
|
|
Chris PeBenito |
1815bad |
mysql_search_db(logrotate_t)
|
|
Chris PeBenito |
42be7c2 |
mysql_stream_connect(logrotate_t)
|
|
Chris PeBenito |
42be7c2 |
')
|
|
Chris PeBenito |
42be7c2 |
|
|
Chris PeBenito |
bb7170f |
optional_policy(`
|
|
Chris PeBenito |
96ce00a |
nis_use_ypbind(logrotate_t)
|
|
Chris PeBenito |
96ce00a |
')
|
|
Chris PeBenito |
96ce00a |
|
|
Chris PeBenito |
bb7170f |
optional_policy(`
|
|
Chris PeBenito |
1815bad |
nscd_socket_use(logrotate_t)
|
|
Chris PeBenito |
493d6c4 |
')
|
|
Chris PeBenito |
493d6c4 |
|
|
Chris PeBenito |
bb7170f |
optional_policy(`
|
|
Chris PeBenito |
1d427ac |
slrnpull_manage_spool(logrotate_t)
|
|
Chris PeBenito |
1d427ac |
')
|
|
Chris PeBenito |
1d427ac |
|
|
Chris PeBenito |
bb7170f |
optional_policy(`
|
|
Chris PeBenito |
0f707d5 |
# cjp: why?
|
|
Chris PeBenito |
0f707d5 |
squid_domtrans(logrotate_t)
|
|
Chris PeBenito |
0f707d5 |
')
|
|
Chris PeBenito |
0f707d5 |
|
|
Chris PeBenito |
96ce00a |
ifdef(`TODO',`
|
|
Chris PeBenito |
96ce00a |
# it should not require this
|
|
Chris PeBenito |
96ce00a |
allow logrotate_t {staff_home_dir_t sysadm_home_dir_t}:dir { getattr read search };
|
|
Chris PeBenito |
96ce00a |
|
|
Chris PeBenito |
96ce00a |
# for /var/backups on Debian
|
|
Chris PeBenito |
96ce00a |
ifdef(`backup.te', `
|
|
Chris PeBenito |
96ce00a |
rw_dir_create_file(logrotate_t, backup_store_t)
|
|
Chris PeBenito |
96ce00a |
')
|
|
Chris PeBenito |
96ce00a |
|
|
Chris PeBenito |
ebdc3b7 |
allow logrotate_t syslogd_exec_t:file r_file_perms;
|
|
Chris PeBenito |
96ce00a |
') dnl end TODO
|