selinux-policy/refpolicy/policy/modules/system/logging.if

## <summary>Policy for the kernel message logger and system logging daemon.</summary>

#######################################
## <summary>
##	Make the specified type a file
##	used for logs.
## </summary>
## <param name="file_type">
##	Type of the file to be used as a log.
## </param>
#
interface(`logging_log_file',`
	gen_require(`
		attribute logfile;
	')

	files_type($1)
	files_associate_tmp($1)
	fs_associate_tmpfs($1)
	typeattribute $1 logfile;
')

########################################
## <summary>
##	Execute auditctl in the auditctl domain.
## </summary>
## <param name="domain">
##	Domain allowed access.
## </param>
#
interface(`logging_domtrans_auditctl',`
	gen_require(`
		type auditctl_t, auditctl_exec_t;
	')

	domain_auto_trans($1,auditctl_exec_t,auditctl_t)

	allow $1 auditctl_t:fd use;
	allow auditctl_t $1:fd use;
	allow auditctl_t $1:fifo_file rw_file_perms;
	allow auditctl_t $1:process sigchld;
')

########################################
## <summary>
##	Execute syslogd in the syslog domain.
## </summary>
## <param name="domain">
##	The type of the process performing this action.
## </param>
#
interface(`logging_domtrans_syslog',`
	gen_require(`
		type syslogd_t, syslogd_exec_t;
		class process sigchld;
		class fd use;
		class fifo_file rw_file_perms;
	')

	corecmd_search_sbin($1)
	domain_auto_trans($1,syslogd_exec_t,syslogd_t)

	allow $1 syslogd_t:fd use;
	allow syslogd_t $1:fd use;
	allow syslogd_t $1:fifo_file rw_file_perms;
	allow syslogd_t $1:process sigchld;
')

########################################
#
# logging_create_log(domain,privatetype,[class(es)])
#
interface(`logging_create_log',`
	gen_require(`
		type var_log_t;
		class dir rw_dir_perms;
	')

	allow $1 var_log_t:dir rw_dir_perms;

	ifelse(`$3',`',`
		type_transition $1 var_log_t:file $2;
	',`
		type_transition $1 var_log_t:$3 $2;
	')
')

#######################################
#
# logging_send_syslog_msg(domain)
#
interface(`logging_send_syslog_msg',`
	gen_require(`
		type syslogd_t, devlog_t;
		class lnk_file read;
		class sock_file rw_file_perms;
		class unix_dgram_socket { create_socket_perms sendto };
		class unix_stream_socket { create_socket_perms connectto };
	')

	allow $1 devlog_t:lnk_file read;
	allow $1 devlog_t:sock_file rw_file_perms;

	# the type of socket depends on the syslog daemon
	allow $1 syslogd_t:unix_dgram_socket sendto;
	allow $1 syslogd_t:unix_stream_socket connectto;
	allow $1 self:unix_dgram_socket create_socket_perms;
	allow $1 self:unix_stream_socket create_socket_perms;

	# cjp: this should most likely be removed:
	term_use_console($1)
')

########################################
## <summary>
##	Read the auditd configuration files.
## </summary>
## <param name="domain">
##	Domain allowed access.
## </param>
#
interface(`logging_read_auditd_config',`
	gen_require(`
		type auditd_etc_t;
		class file r_file_perms;
	')

	files_search_etc($1)
	allow $1 auditd_etc_t:file r_file_perms;
')

########################################
## <summary>
##	Allows the domain to open a file in the
##	log directory, but does not allow the listing
##	of the contents of the log directory.
## </summary>
## <param name="domain">
##	The type of the process performing this action.
## </param>
#
interface(`logging_search_logs',`
	gen_require(`
		type var_log_t;
		class dir search;
	')

	files_search_var($1)
	allow $1 var_log_t:dir search;
')

#######################################
## <summary>
##	List the contents of the generic log directory (/var/log).
## </summary>
## <param name="domain">
##	Domain allowed access.
## </param>
#
interface(`logging_list_logs',`
	gen_require(`
		type var_log_t;
	')

	files_search_var($1)
	allow $1 var_log_t:dir r_dir_perms;
')

#######################################
## <summary>
##	Read and write the generic log directory (/var/log).
## </summary>
## <param name="domain">
##	The type of the process performing this action.
## </param>
#
interface(`logging_rw_log_dir',`
	gen_require(`
		type var_log_t;
		class dir rw_dir_perms;
	')

	files_search_var($1)
	allow $1 var_log_t:dir rw_dir_perms;
')

#######################################
#
# logging_dontaudit_getattr_all_logs(domain)
#
interface(`logging_dontaudit_getattr_all_logs',`
	gen_require(`
		attribute logfile;
		class file getattr;
	')

	dontaudit $1 logfile:file getattr;
')

#######################################
#
# logging_append_all_logs(domain)
#
interface(`logging_append_all_logs',`
	gen_require(`
		attribute logfile;
		type var_log_t;
		class dir r_dir_perms;
		class file { getattr append };
	')

	files_search_var($1)
	allow $1 var_log_t:dir r_dir_perms;
	allow $1 logfile:file { getattr append };
')

#######################################
#
# logging_read_all_logs(domain)
#
interface(`logging_read_all_logs',`
	gen_require(`
		attribute logfile;
		type var_log_t;
		class dir r_dir_perms;
		class file r_file_perms;
	')

	files_search_var($1)
	allow $1 var_log_t:dir r_dir_perms;
	allow $1 logfile:file r_file_perms;
')

########################################
## <summary>
##	Execute all log files in the caller domain.
## </summary>
## <param name="domain">
##	The type of the process performing this action.
## </param>
#
# cjp: not sure why this is needed.  This was added
# because of logrotate.
interface(`logging_exec_all_logs',`
	gen_require(`
		attribute logfile;
		class dir r_dir_perms;
	')

	files_search_var($1)
	allow $1 logfile:dir r_dir_perms;
	can_exec($1,logfile)
')

#######################################
#
# logging_manage_all_logs(domain)
#
interface(`logging_manage_all_logs',`
	gen_require(`
		attribute logfile;
		class dir rw_dir_perms;
		class file create_file_perms;
	')

	files_search_var($1)
	allow $1 logfile:dir rw_dir_perms;
	allow $1 logfile:lnk_file read;
	allow $1 logfile:file create_file_perms;
')

#######################################
#
# logging_read_generic_logs(domain)
#
interface(`logging_read_generic_logs',`
	gen_require(`
		type var_log_t;
		class dir r_dir_perms;
		class file r_file_perms;
	')

	files_search_var($1)
	allow $1 var_log_t:dir r_dir_perms;
	allow $1 var_log_t:file r_file_perms;
')

#######################################
#
# logging_write_generic_logs(domain)
#
interface(`logging_write_generic_logs',`
	gen_require(`
		type var_log_t;
		class dir r_dir_perms;
		class file { getattr write };
	')

	files_search_var($1)
	allow $1 var_log_t:dir r_dir_perms;
	allow $1 var_log_t:file { getattr write };
')

########################################
## <summary>
##	Read and write generic log files.
## </summary>
## <param name="domain">
##	Domain allowed access.
## </param>
#
interface(`logging_rw_generic_logs',`
	gen_require(`
		type var_log_t;
		class dir r_dir_perms;
		class file rw_file_perms;
	')

	files_search_var($1)
	allow $1 var_log_t:dir r_dir_perms;
	allow $1 var_log_t:file rw_file_perms;
')

########################################
## <summary>
##	Create, read, write, and delete
##	generic log files.
## </summary>
## <param name="domain">
##	Domain allowed access.
## </param>
#
interface(`logging_manage_generic_logs',`
	gen_require(`
		type var_log_t;
		class dir rw_dir_perms;
		class file create_file_perms;
	')

	files_search_var($1)
	allow $1 var_log_t:dir rw_dir_perms;
	allow $1 var_log_t:file create_file_perms;
')