From d5b81a81ff767b0712aa962e20c6bf41b62056c5 Mon Sep 17 00:00:00 2001 From: Chris PeBenito Date: Jun 12 2007 18:46:14 +0000 Subject: trunk: Add logging_send_audit_msgs() interface and deprecate send_audit_msgs_pattern(). --- diff --git a/Changelog b/Changelog index 0290b04..c22e117 100644 --- a/Changelog +++ b/Changelog @@ -1,3 +1,5 @@ +- Add logging_send_audit_msgs() interface and deprecate + send_audit_msgs_pattern(). - Openct updates patch from Dan Walsh. - Merge restorecon into setfiles. - Patch to begin separating out hald helper programs from Dan Walsh. diff --git a/policy/modules/services/aide.te b/policy/modules/services/aide.te index 2e345f0..9464a0a 100644 --- a/policy/modules/services/aide.te +++ b/policy/modules/services/aide.te @@ -1,5 +1,5 @@ -policy_module(aide,1.0.1) +policy_module(aide,1.0.2) ######################################## # @@ -26,8 +26,6 @@ files_type(aide_db_t) allow aide_t self:capability { dac_override fowner }; -send_audit_msgs_pattern(aide_t) - # database actions manage_files_pattern(aide_t,aide_db_t,aide_db_t) @@ -40,4 +38,6 @@ files_read_all_files(aide_t) libs_use_ld_so(aide_t) libs_use_shared_libs(aide_t) +logging_send_audit_msgs(aide_t) + seutil_use_newrole_fds(aide_t) diff --git a/policy/modules/services/cups.te b/policy/modules/services/cups.te index 3a12135..30072d8 100644 --- a/policy/modules/services/cups.te +++ b/policy/modules/services/cups.te @@ -1,5 +1,5 @@ -policy_module(cups,1.6.0) +policy_module(cups,1.6.1) ######################################## # @@ -93,8 +93,6 @@ allow cupsd_t self:appletalk_socket create_socket_perms; # generic socket here until appletalk socket is available in kernels allow cupsd_t self:socket create_socket_perms; -send_audit_msgs_pattern(cupsd_t) - allow cupsd_t cupsd_etc_t:{ dir file } setattr; read_files_pattern(cupsd_t,cupsd_etc_t,cupsd_etc_t) read_lnk_files_pattern(cupsd_t,cupsd_etc_t,cupsd_etc_t) @@ -213,6 +211,7 @@ libs_use_shared_libs(cupsd_t) # Read /usr/lib/gconv/gconv-modules.* and /usr/lib/python2.2/.* libs_read_lib_files(cupsd_t) +logging_send_audit_msgs(cupsd_t) logging_send_syslog_msg(cupsd_t) miscfiles_read_localization(cupsd_t) diff --git a/policy/modules/services/dbus.if b/policy/modules/services/dbus.if index caae921..12fdb09 100644 --- a/policy/modules/services/dbus.if +++ b/policy/modules/services/dbus.if @@ -78,8 +78,6 @@ template(`dbus_per_role_template',` allow $1_dbusd_t self:tcp_socket create_stream_socket_perms; allow $1_dbusd_t self:netlink_selinux_socket create_socket_perms; - send_audit_msgs_pattern($1_dbusd_t) - # For connecting to the bus allow $2 $1_dbusd_t:unix_stream_socket connectto; type_change $2 $1_dbusd_t:dbus $1_dbusd_$1_t; @@ -140,6 +138,7 @@ template(`dbus_per_role_template',` libs_use_ld_so($1_dbusd_t) libs_use_shared_libs($1_dbusd_t) + logging_send_audit_msgs($1_dbusd_t) logging_send_syslog_msg($1_dbusd_t) miscfiles_read_localization($1_dbusd_t) diff --git a/policy/modules/services/dbus.te b/policy/modules/services/dbus.te index a9d8737..4273b44 100644 --- a/policy/modules/services/dbus.te +++ b/policy/modules/services/dbus.te @@ -1,5 +1,5 @@ -policy_module(dbus,1.5.0) +policy_module(dbus,1.5.1) gen_require(` class dbus { send_msg acquire_svc }; @@ -40,8 +40,6 @@ allow system_dbusd_t self:unix_dgram_socket create_socket_perms; # Receive notifications of policy reloads and enforcing status changes. allow system_dbusd_t self:netlink_selinux_socket { create bind read }; -send_audit_msgs_pattern(system_dbusd_t) - allow system_dbusd_t dbusd_etc_t:dir list_dir_perms; read_files_pattern(system_dbusd_t,dbusd_etc_t,dbusd_etc_t) read_lnk_files_pattern(system_dbusd_t,dbusd_etc_t,dbusd_etc_t) @@ -92,6 +90,7 @@ init_use_script_ptys(system_dbusd_t) libs_use_ld_so(system_dbusd_t) libs_use_shared_libs(system_dbusd_t) +logging_send_audit_msgs(system_dbusd_t) logging_send_syslog_msg(system_dbusd_t) miscfiles_read_localization(system_dbusd_t) diff --git a/policy/modules/services/hal.te b/policy/modules/services/hal.te index a940ce9..6dcf4a5 100644 --- a/policy/modules/services/hal.te +++ b/policy/modules/services/hal.te @@ -1,5 +1,5 @@ -policy_module(hal,1.6.1) +policy_module(hal,1.6.2) ######################################## # @@ -61,8 +61,6 @@ allow hald_t self:udp_socket create_socket_perms; # For backwards compatibility with older kernels allow hald_t self:netlink_socket create_socket_perms; -send_audit_msgs_pattern(hald_t) - manage_files_pattern(hald_t,hald_cache_t,hald_cache_t) # log files for hald @@ -170,6 +168,7 @@ libs_use_shared_libs(hald_t) libs_exec_ld_so(hald_t) libs_exec_lib_files(hald_t) +logging_send_audit_msgs(hald_t) logging_send_syslog_msg(hald_t) logging_search_logs(hald_t) diff --git a/policy/modules/services/pegasus.te b/policy/modules/services/pegasus.te index 2ec8742..a307720 100644 --- a/policy/modules/services/pegasus.te +++ b/policy/modules/services/pegasus.te @@ -1,5 +1,5 @@ -policy_module(pegasus,1.3.0) +policy_module(pegasus,1.3.1) ######################################## # @@ -38,8 +38,6 @@ allow pegasus_t self:unix_dgram_socket create_socket_perms; allow pegasus_t self:unix_stream_socket create_stream_socket_perms; allow pegasus_t self:tcp_socket create_stream_socket_perms; -send_audit_msgs_pattern(pegasus_t) - allow pegasus_t pegasus_conf_t:dir rw_dir_perms; allow pegasus_t pegasus_conf_t:file { read_file_perms link unlink }; allow pegasus_t pegasus_conf_t:lnk_file read_lnk_file_perms; @@ -113,6 +111,8 @@ init_stream_connect_script(pegasus_t) libs_use_ld_so(pegasus_t) libs_use_shared_libs(pegasus_t) +logging_send_audit_msgs(pegasus_t) + miscfiles_read_localization(pegasus_t) sysnet_read_config(pegasus_t) diff --git a/policy/modules/system/authlogin.if b/policy/modules/system/authlogin.if index 351eab6..892032f 100644 --- a/policy/modules/system/authlogin.if +++ b/policy/modules/system/authlogin.if @@ -30,8 +30,6 @@ template(`authlogin_common_auth_domain_template',` allow $1_chkpwd_t self:capability { audit_control setuid }; allow $1_chkpwd_t self:process getattr; - send_audit_msgs_pattern($1_chkpwd_t) - files_list_etc($1_chkpwd_t) allow $1_chkpwd_t shadow_t:file { getattr read }; @@ -52,6 +50,7 @@ template(`authlogin_common_auth_domain_template',` libs_use_ld_so($1_chkpwd_t) libs_use_shared_libs($1_chkpwd_t) + logging_send_audit_msgs($1_chkpwd_t) logging_send_syslog_msg($1_chkpwd_t) miscfiles_read_localization($1_chkpwd_t) @@ -322,7 +321,6 @@ interface(`auth_domtrans_chk_passwd',` # cjp: is this really needed? allow $1 self:capability audit_control; - send_audit_msgs_pattern($1) corecmd_search_bin($1) domtrans_pattern($1,chkpwd_exec_t,system_chkpwd_t) @@ -332,6 +330,8 @@ interface(`auth_domtrans_chk_passwd',` dev_read_rand($1) dev_read_urand($1) + logging_send_audit_msgs($1) + miscfiles_read_certs($1) sysnet_dns_name_resolve($1) diff --git a/policy/modules/system/authlogin.te b/policy/modules/system/authlogin.te index 3a26997..63210a2 100644 --- a/policy/modules/system/authlogin.te +++ b/policy/modules/system/authlogin.te @@ -1,5 +1,5 @@ -policy_module(authlogin,1.6.1) +policy_module(authlogin,1.6.2) ######################################## # diff --git a/policy/modules/system/clock.te b/policy/modules/system/clock.te index 1467b45..0062506 100644 --- a/policy/modules/system/clock.te +++ b/policy/modules/system/clock.te @@ -1,5 +1,5 @@ -policy_module(clock,1.3.0) +policy_module(clock,1.3.1) ######################################## # @@ -26,8 +26,6 @@ dontaudit hwclock_t self:capability sys_tty_config; allow hwclock_t self:process signal_perms; allow hwclock_t self:fifo_file { getattr read write }; -send_audit_msgs_pattern(hwclock_t) - # Allow hwclock to store & retrieve correction factors. allow hwclock_t adjtime_t:file { rw_file_perms setattr }; @@ -60,6 +58,7 @@ files_dontaudit_search_isid_type_dirs(hwclock_t) libs_use_ld_so(hwclock_t) libs_use_shared_libs(hwclock_t) +logging_send_audit_msgs(hwclock_t) logging_send_syslog_msg(hwclock_t) miscfiles_read_localization(hwclock_t) diff --git a/policy/modules/system/logging.if b/policy/modules/system/logging.if index e7a4d72..6ee2f5b 100644 --- a/policy/modules/system/logging.if +++ b/policy/modules/system/logging.if @@ -22,6 +22,21 @@ interface(`logging_log_file',` typeattribute $1 logfile; ') +####################################### +## +## Send audit messages. +## +## +## +## Domain allowed access. +## +## +# +interface(`logging_send_audit_msgs',` + allow $1 self:capability audit_write; + allow $1 self:netlink_audit_socket { create_netlink_socket_perms nlmsg_relay }; +') + ######################################## ## ## Read the audit log. diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te index dd0209f..ab0e9a3 100644 --- a/policy/modules/system/logging.te +++ b/policy/modules/system/logging.te @@ -1,5 +1,5 @@ -policy_module(logging,1.6.0) +policy_module(logging,1.6.1) ######################################## # diff --git a/policy/support/misc_patterns.spt b/policy/support/misc_patterns.spt index 7efe286..3469bfd 100644 --- a/policy/support/misc_patterns.spt +++ b/policy/support/misc_patterns.spt @@ -42,6 +42,7 @@ define(`domtrans_pattern',` # Other process permissions # define(`send_audit_msgs_pattern',` + refpolicywarn(`$0($*) has been deprecated, please use logging_send_audit_msgs($1) instead.') allow $1 self:capability audit_write; allow $1 self:netlink_audit_socket { create_netlink_socket_perms nlmsg_relay }; ')