selinux-policy/refpolicy/policy/modules/admin/logrotate.te


policy_module(logrotate,1.2.0)

########################################
#
# Declarations
#

type logrotate_t;
domain_type(logrotate_t)
domain_obj_id_change_exemption(logrotate_t)
domain_system_change_exemption(logrotate_t)
role system_r types logrotate_t;

type logrotate_exec_t;
domain_entry_file(logrotate_t,logrotate_exec_t)

type logrotate_lock_t;
files_lock_file(logrotate_lock_t)

type logrotate_tmp_t;
files_tmp_file(logrotate_tmp_t)

type logrotate_var_lib_t;
files_type(logrotate_var_lib_t)

########################################
#
# Local policy
#

# Change ownership on log files.
allow logrotate_t self:capability { chown dac_override dac_read_search kill fsetid fowner sys_resource sys_nice };
# for mailx
dontaudit logrotate_t self:capability { setuid setgid };

allow logrotate_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };

# Set a context other than the default one for newly created files.
allow logrotate_t self:process setfscreate;

allow logrotate_t self:fd use;
allow logrotate_t self:fifo_file rw_file_perms;
allow logrotate_t self:unix_dgram_socket create_socket_perms;
allow logrotate_t self:unix_stream_socket create_stream_socket_perms;
allow logrotate_t self:unix_dgram_socket sendto;
allow logrotate_t self:unix_stream_socket connectto;
allow logrotate_t self:shm create_shm_perms;
allow logrotate_t self:sem create_sem_perms;
allow logrotate_t self:msgq create_msgq_perms;
allow logrotate_t self:msg { send receive };

allow logrotate_t logrotate_lock_t:file create_file_perms;
files_lock_filetrans(logrotate_t,logrotate_lock_t,file)

can_exec(logrotate_t, logrotate_tmp_t)

allow logrotate_t logrotate_tmp_t:dir create_dir_perms;
allow logrotate_t logrotate_tmp_t:file create_file_perms;
files_tmp_filetrans(logrotate_t, logrotate_tmp_t, { file dir })

# for /var/lib/logrotate.status and /var/lib/logcheck
allow logrotate_t logrotate_var_lib_t:dir { create rw_dir_perms };
allow logrotate_t logrotate_var_lib_t:file create_file_perms;
files_var_lib_filetrans(logrotate_t, logrotate_var_lib_t, file)

kernel_read_system_state(logrotate_t)
kernel_read_kernel_sysctls(logrotate_t)

dev_read_urand(logrotate_t)

fs_search_auto_mountpoints(logrotate_t)
fs_getattr_xattr_fs(logrotate_t)

mls_file_read_up(logrotate_t)
mls_file_write_down(logrotate_t)
mls_file_upgrade(logrotate_t)

selinux_get_fs_mount(logrotate_t)
selinux_get_enforce_mode(logrotate_t)

auth_manage_login_records(logrotate_t)

# Run helper programs.
corecmd_exec_bin(logrotate_t)
corecmd_exec_sbin(logrotate_t)
corecmd_exec_shell(logrotate_t)
corecmd_exec_ls(logrotate_t)

domain_signal_all_domains(logrotate_t)
domain_use_interactive_fds(logrotate_t)
domain_getattr_all_entry_files(logrotate_t)
# Read /proc/PID directories for all domains.
domain_read_all_domains_state(logrotate_t)

files_read_usr_files(logrotate_t)
files_read_etc_files(logrotate_t)
files_read_etc_runtime_files(logrotate_t)
files_read_all_pids(logrotate_t)
# Write to /var/spool/slrnpull - should be moved into its own type.
files_manage_generic_spool(logrotate_t)
files_manage_generic_spool_dirs(logrotate_t)

# cjp: why is this needed?
init_domtrans_script(logrotate_t)

logging_manage_all_logs(logrotate_t)
logging_send_syslog_msg(logrotate_t)
# cjp: why is this needed?
logging_exec_all_logs(logrotate_t)

libs_use_ld_so(logrotate_t)
libs_use_shared_libs(logrotate_t)

miscfiles_read_localization(logrotate_t)

seutil_dontaudit_read_config(logrotate_t)

sysnet_read_config(logrotate_t)

userdom_use_unpriv_users_fds(logrotate_t)

cron_system_entry(logrotate_t, logrotate_exec_t)
cron_search_spool(logrotate_t)

mta_send_mail(logrotate_t)

ifdef(`distro_debian', `
	allow logrotate_t logrotate_tmp_t:file { relabelfrom relabelto };
	# for savelog
	can_exec(logrotate_t, logrotate_exec_t)
')

ifdef(`targeted_policy',`
	unconfined_domain(logrotate_t)
')

optional_policy(`acct',`
	acct_domtrans(logrotate_t)
	acct_manage_data(logrotate_t)
	acct_exec_data(logrotate_t)
')

optional_policy(`apache',`
	apache_read_config(logrotate_t)
	apache_domtrans(logrotate_t)
	apache_signull(logrotate_t)
')

optional_policy(`consoletype',`
	consoletype_exec(logrotate_t)
')

optional_policy(`cups',`
	cups_domtrans(logrotate_t)
')

optional_policy(`hostname',`
	hostname_exec(logrotate_t)
')

optional_policy(`samba',`
	samba_exec_log(logrotate_t)
')

optional_policy(`mailman',`
	mailman_exec(logrotate_t)
	mailman_search_data(logrotate_t)
	mailman_manage_log(logrotate_t)
')

optional_policy(`mysql',`
	mysql_read_config(logrotate_t)
	mysql_search_db(logrotate_t)
	mysql_stream_connect(logrotate_t)
')

optional_policy(`nis',`
	nis_use_ypbind(logrotate_t)
')

optional_policy(`nscd',`
	nscd_socket_use(logrotate_t)
')

optional_policy(`slrnpull',`
	slrnpull_manage_spool(logrotate_t)
')

optional_policy(`squid',`
	# cjp: why?
	squid_domtrans(logrotate_t)
')

ifdef(`TODO',`
ifdef(`gnome-pty-helper.te', `allow logrotate_t sysadm_gph_t:fd use;')

# it should not require this
allow logrotate_t {staff_home_dir_t sysadm_home_dir_t}:dir { getattr read search };

# for /var/backups on Debian
ifdef(`backup.te', `
rw_dir_create_file(logrotate_t, backup_store_t)
')

allow logrotate_t syslogd_exec_t:file r_file_perms;
') dnl end TODO
add logrotate, more low-hanging fruit 2005-06-28 20:54:49 +00:00
bump versions for release. 2006-01-17 20:14:04 +00:00			`policy_module(logrotate,1.2.0)`
add logrotate, more low-hanging fruit 2005-06-28 20:54:49 +00:00
			`########################################`
			`#`
			`# Declarations`
			`#`

targeted and redhat cleanups 2005-09-21 14:49:41 +00:00			`type logrotate_t;`
add logrotate, more low-hanging fruit 2005-06-28 20:54:49 +00:00			`domain_type(logrotate_t)`
another slew of renaming 2006-02-02 21:08:12 +00:00			`domain_obj_id_change_exemption(logrotate_t)`
			`domain_system_change_exemption(logrotate_t)`
add logrotate, more low-hanging fruit 2005-06-28 20:54:49 +00:00			`role system_r types logrotate_t;`

			`type logrotate_exec_t;`
add apm and arpwatch. fix implementation error on fs_getattr_all_files, splitting it up into correct interfaces. 2005-10-10 18:11:46 +00:00			`domain_entry_file(logrotate_t,logrotate_exec_t)`
add logrotate, more low-hanging fruit 2005-06-28 20:54:49 +00:00
more updates 2005-09-15 21:03:29 +00:00			`type logrotate_lock_t;`
			`files_lock_file(logrotate_lock_t)`

add logrotate, more low-hanging fruit 2005-06-28 20:54:49 +00:00			`type logrotate_tmp_t;`
			`files_tmp_file(logrotate_tmp_t)`

			`type logrotate_var_lib_t;`
another round of renaming, for consistency 2005-06-29 14:26:41 +00:00			`files_type(logrotate_var_lib_t)`
add logrotate, more low-hanging fruit 2005-06-28 20:54:49 +00:00
			`########################################`
			`#`
			`# Local policy`
			`#`

			`# Change ownership on log files.`
			`allow logrotate_t self:capability { chown dac_override dac_read_search kill fsetid fowner sys_resource sys_nice };`
			`# for mailx`
			`dontaudit logrotate_t self:capability { setuid setgid };`

fix bugs uncovered from sediff 2005-09-01 20:13:42 +00:00			`allow logrotate_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };`
add logrotate, more low-hanging fruit 2005-06-28 20:54:49 +00:00
			`# Set a context other than the default one for newly created files.`
			`allow logrotate_t self:process setfscreate;`

			`allow logrotate_t self:fd use;`
			`allow logrotate_t self:fifo_file rw_file_perms;`
			`allow logrotate_t self:unix_dgram_socket create_socket_perms;`
			`allow logrotate_t self:unix_stream_socket create_stream_socket_perms;`
			`allow logrotate_t self:unix_dgram_socket sendto;`
			`allow logrotate_t self:unix_stream_socket connectto;`
			`allow logrotate_t self:shm create_shm_perms;`
			`allow logrotate_t self:sem create_sem_perms;`
			`allow logrotate_t self:msgq create_msgq_perms;`
			`allow logrotate_t self:msg { send receive };`

more updates 2005-09-15 21:03:29 +00:00			`allow logrotate_t logrotate_lock_t:file create_file_perms;`
make (almost) all interface parameters required. move boot_t, system_map_t, and modules_object_t to files module. fd use interface renames, udp sendto interface renames. 2006-03-02 23:41:11 +00:00			`files_lock_filetrans(logrotate_t,logrotate_lock_t,file)`
more updates 2005-09-15 21:03:29 +00:00
add logrotate, more low-hanging fruit 2005-06-28 20:54:49 +00:00			`can_exec(logrotate_t, logrotate_tmp_t)`

			`allow logrotate_t logrotate_tmp_t:dir create_dir_perms;`
			`allow logrotate_t logrotate_tmp_t:file create_file_perms;`
another round of renaming 2006-02-21 18:40:44 +00:00			`files_tmp_filetrans(logrotate_t, logrotate_tmp_t, { file dir })`
add logrotate, more low-hanging fruit 2005-06-28 20:54:49 +00:00
cleanup 2005-09-14 19:27:30 +00:00			`# for /var/lib/logrotate.status and /var/lib/logcheck`
add logrotate, more low-hanging fruit 2005-06-28 20:54:49 +00:00			`allow logrotate_t logrotate_var_lib_t:dir { create rw_dir_perms };`
cleanup 2005-09-14 19:27:30 +00:00			`allow logrotate_t logrotate_var_lib_t:file create_file_perms;`
make (almost) all interface parameters required. move boot_t, system_map_t, and modules_object_t to files module. fd use interface renames, udp sendto interface renames. 2006-03-02 23:41:11 +00:00			`files_var_lib_filetrans(logrotate_t, logrotate_var_lib_t, file)`
add logrotate, more low-hanging fruit 2005-06-28 20:54:49 +00:00
			`kernel_read_system_state(logrotate_t)`
renaming from 20060131 interface review, round 2 2006-01-31 16:49:43 +00:00			`kernel_read_kernel_sysctls(logrotate_t)`
add logrotate, more low-hanging fruit 2005-06-28 20:54:49 +00:00
			`dev_read_urand(logrotate_t)`

			`fs_search_auto_mountpoints(logrotate_t)`
			`fs_getattr_xattr_fs(logrotate_t)`

part of dan's mega patch 2006-01-06 22:51:40 +00:00			`mls_file_read_up(logrotate_t)`
			`mls_file_write_down(logrotate_t)`
			`mls_file_upgrade(logrotate_t)`

add logrotate, more low-hanging fruit 2005-06-28 20:54:49 +00:00			`selinux_get_fs_mount(logrotate_t)`
more merging from nsa cvs 2005-09-16 13:36:26 +00:00			`selinux_get_enforce_mode(logrotate_t)`
add logrotate, more low-hanging fruit 2005-06-28 20:54:49 +00:00
			`auth_manage_login_records(logrotate_t)`

			`# Run helper programs.`
			`corecmd_exec_bin(logrotate_t)`
			`corecmd_exec_sbin(logrotate_t)`
			`corecmd_exec_shell(logrotate_t)`
			`corecmd_exec_ls(logrotate_t)`

			`domain_signal_all_domains(logrotate_t)`
another round of renaming 2006-02-20 21:33:25 +00:00			`domain_use_interactive_fds(logrotate_t)`
cleanup 2005-09-14 19:27:30 +00:00			`domain_getattr_all_entry_files(logrotate_t)`
todo cleanup 2005-09-20 20:48:17 +00:00			`# Read /proc/PID directories for all domains.`
			`domain_read_all_domains_state(logrotate_t)`
add logrotate, more low-hanging fruit 2005-06-28 20:54:49 +00:00
			`files_read_usr_files(logrotate_t)`
another round of renaming, for consistency 2005-06-29 14:26:41 +00:00			`files_read_etc_files(logrotate_t)`
add logrotate, more low-hanging fruit 2005-06-28 20:54:49 +00:00			`files_read_etc_runtime_files(logrotate_t)`
			`files_read_all_pids(logrotate_t)`
			`# Write to /var/spool/slrnpull - should be moved into its own type.`
renaming from 20060131 interface review, round 3 2006-01-31 19:21:01 +00:00			`files_manage_generic_spool(logrotate_t)`
another round of renaming, for consistency 2005-06-29 14:26:41 +00:00			`files_manage_generic_spool_dirs(logrotate_t)`
add logrotate, more low-hanging fruit 2005-06-28 20:54:49 +00:00
			`# cjp: why is this needed?`
			`init_domtrans_script(logrotate_t)`

			`logging_manage_all_logs(logrotate_t)`
cleanup 2005-09-14 19:27:30 +00:00			`logging_send_syslog_msg(logrotate_t)`
add logrotate, more low-hanging fruit 2005-06-28 20:54:49 +00:00			`# cjp: why is this needed?`
			`logging_exec_all_logs(logrotate_t)`

			`libs_use_ld_so(logrotate_t)`
			`libs_use_shared_libs(logrotate_t)`

			`miscfiles_read_localization(logrotate_t)`

more merging from nsa cvs 2005-09-16 13:36:26 +00:00			`seutil_dontaudit_read_config(logrotate_t)`
cleanup 2005-09-14 19:27:30 +00:00
add logrotate, more low-hanging fruit 2005-06-28 20:54:49 +00:00			`sysnet_read_config(logrotate_t)`

another round of renaming 2006-02-21 18:40:44 +00:00			`userdom_use_unpriv_users_fds(logrotate_t)`
add logrotate, more low-hanging fruit 2005-06-28 20:54:49 +00:00
			`cron_system_entry(logrotate_t, logrotate_exec_t)`
			`cron_search_spool(logrotate_t)`

			`mta_send_mail(logrotate_t)`

			ifdef(`distro_debian', `
			`allow logrotate_t logrotate_tmp_t:file { relabelfrom relabelto };`
			`# for savelog`
			`can_exec(logrotate_t, logrotate_exec_t)`
targeted and redhat cleanups 2005-09-21 14:49:41 +00:00			`')`

			ifdef(`targeted_policy',`
patch from dan Wed, 01 Feb 2006 08:33:30 -0500 2006-02-06 22:47:46 +00:00			`unconfined_domain(logrotate_t)`
add logrotate, more low-hanging fruit 2005-06-28 20:54:49 +00:00			`')`

Change optional_policy() to refer to the module name rather than modulename.te. 2005-11-23 20:24:27 +00:00			optional_policy(`acct',`
add acct 2005-08-05 14:32:12 +00:00			`acct_domtrans(logrotate_t)`
			`acct_manage_data(logrotate_t)`
			`acct_exec_data(logrotate_t)`
			`')`

Change optional_policy() to refer to the module name rather than modulename.te. 2005-11-23 20:24:27 +00:00			optional_policy(`apache',`
add most of apache 2005-09-29 20:59:00 +00:00			`apache_read_config(logrotate_t)`
			`apache_domtrans(logrotate_t)`
			`apache_signull(logrotate_t)`
			`')`

Change optional_policy() to refer to the module name rather than modulename.te. 2005-11-23 20:24:27 +00:00			optional_policy(`consoletype',`
add logrotate, more low-hanging fruit 2005-06-28 20:54:49 +00:00			`consoletype_exec(logrotate_t)`
			`')`

fix several modular build problems 2005-11-29 21:27:15 +00:00			optional_policy(`cups',`
			`cups_domtrans(logrotate_t)`
			`')`

Change optional_policy() to refer to the module name rather than modulename.te. 2005-11-23 20:24:27 +00:00			optional_policy(`hostname',`
begin merging in upstream NSA CVS changes 2005-09-12 21:40:56 +00:00			`hostname_exec(logrotate_t)`
			`')`

Change optional_policy() to refer to the module name rather than modulename.te. 2005-11-23 20:24:27 +00:00			optional_policy(`samba',`
add samba 2005-09-14 18:33:53 +00:00			`samba_exec_log(logrotate_t)`
			`')`

Change optional_policy() to refer to the module name rather than modulename.te. 2005-11-23 20:24:27 +00:00			optional_policy(`mailman',`
add mailman 2005-10-11 15:36:53 +00:00			`mailman_exec(logrotate_t)`
			`mailman_search_data(logrotate_t)`
			`mailman_manage_log(logrotate_t)`
			`')`

Change optional_policy() to refer to the module name rather than modulename.te. 2005-11-23 20:24:27 +00:00			optional_policy(`mysql',`
add mysql 2005-08-03 17:56:26 +00:00			`mysql_read_config(logrotate_t)`
another slew of renaming 2006-02-02 21:08:12 +00:00			`mysql_search_db(logrotate_t)`
add mysql 2005-08-03 17:56:26 +00:00			`mysql_stream_connect(logrotate_t)`
			`')`

Change optional_policy() to refer to the module name rather than modulename.te. 2005-11-23 20:24:27 +00:00			optional_policy(`nis',`
add logrotate, more low-hanging fruit 2005-06-28 20:54:49 +00:00			`nis_use_ypbind(logrotate_t)`
			`')`

Change optional_policy() to refer to the module name rather than modulename.te. 2005-11-23 20:24:27 +00:00			optional_policy(`nscd',`
another slew of renaming 2006-02-02 21:08:12 +00:00			`nscd_socket_use(logrotate_t)`
add nscd 2005-07-13 20:48:51 +00:00			`')`

add slrnpull 2006-01-04 20:44:30 +00:00			optional_policy(`slrnpull',`
			`slrnpull_manage_spool(logrotate_t)`
			`')`

Change optional_policy() to refer to the module name rather than modulename.te. 2005-11-23 20:24:27 +00:00			optional_policy(`squid',`
add squid 2005-09-02 19:11:07 +00:00			`# cjp: why?`
			`squid_domtrans(logrotate_t)`
			`')`

add logrotate, more low-hanging fruit 2005-06-28 20:54:49 +00:00			ifdef(`TODO',`
			ifdef(`gnome-pty-helper.te', `allow logrotate_t sysadm_gph_t:fd use;')

			`# it should not require this`
			`allow logrotate_t {staff_home_dir_t sysadm_home_dir_t}:dir { getattr read search };`

			`# for /var/backups on Debian`
			ifdef(`backup.te', `
			`rw_dir_create_file(logrotate_t, backup_store_t)`
			`')`

clean up more todos 2005-06-29 20:53:53 +00:00			`allow logrotate_t syslogd_exec_t:file r_file_perms;`
add logrotate, more low-hanging fruit 2005-06-28 20:54:49 +00:00			`') dnl end TODO`