selinux-policy/policy/modules/admin/logrotate.te

192 lines
4.9 KiB
Plaintext
Raw Normal View History

2005-06-28 20:54:49 +00:00
policy_module(logrotate, 1.11.0)
2005-06-28 20:54:49 +00:00
########################################
#
# Declarations
#
2005-09-21 14:49:41 +00:00
type logrotate_t;
2005-06-28 20:54:49 +00:00
domain_type(logrotate_t)
2006-02-02 21:08:12 +00:00
domain_obj_id_change_exemption(logrotate_t)
domain_system_change_exemption(logrotate_t)
2005-06-28 20:54:49 +00:00
role system_r types logrotate_t;
type logrotate_exec_t;
domain_entry_file(logrotate_t, logrotate_exec_t)
2005-06-28 20:54:49 +00:00
2005-09-15 21:03:29 +00:00
type logrotate_lock_t;
files_lock_file(logrotate_lock_t)
2005-06-28 20:54:49 +00:00
type logrotate_tmp_t;
files_tmp_file(logrotate_tmp_t)
type logrotate_var_lib_t;
files_type(logrotate_var_lib_t)
2005-06-28 20:54:49 +00:00
########################################
#
# Local policy
#
# Change ownership on log files.
allow logrotate_t self:capability { chown dac_override dac_read_search kill fsetid fowner sys_resource sys_nice };
# for mailx
dontaudit logrotate_t self:capability { setuid setgid };
2005-09-01 20:13:42 +00:00
allow logrotate_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
2005-06-28 20:54:49 +00:00
# Set a context other than the default one for newly created files.
allow logrotate_t self:process setfscreate;
allow logrotate_t self:fd use;
2006-12-12 20:08:08 +00:00
allow logrotate_t self:fifo_file rw_fifo_file_perms;
2005-06-28 20:54:49 +00:00
allow logrotate_t self:unix_dgram_socket create_socket_perms;
allow logrotate_t self:unix_stream_socket create_stream_socket_perms;
allow logrotate_t self:unix_dgram_socket sendto;
allow logrotate_t self:unix_stream_socket connectto;
allow logrotate_t self:shm create_shm_perms;
allow logrotate_t self:sem create_sem_perms;
allow logrotate_t self:msgq create_msgq_perms;
allow logrotate_t self:msg { send receive };
2006-12-12 20:08:08 +00:00
allow logrotate_t logrotate_lock_t:file manage_file_perms;
files_lock_filetrans(logrotate_t, logrotate_lock_t, file)
2005-09-15 21:03:29 +00:00
2005-06-28 20:54:49 +00:00
can_exec(logrotate_t, logrotate_tmp_t)
manage_dirs_pattern(logrotate_t, logrotate_tmp_t, logrotate_tmp_t)
manage_files_pattern(logrotate_t, logrotate_tmp_t, logrotate_tmp_t)
2006-02-21 18:40:44 +00:00
files_tmp_filetrans(logrotate_t, logrotate_tmp_t, { file dir })
2005-06-28 20:54:49 +00:00
2005-09-14 19:27:30 +00:00
# for /var/lib/logrotate.status and /var/lib/logcheck
create_dirs_pattern(logrotate_t, logrotate_var_lib_t, logrotate_var_lib_t)
manage_files_pattern(logrotate_t, logrotate_var_lib_t, logrotate_var_lib_t)
files_var_lib_filetrans(logrotate_t, logrotate_var_lib_t, file)
2005-06-28 20:54:49 +00:00
kernel_read_system_state(logrotate_t)
kernel_read_kernel_sysctls(logrotate_t)
2005-06-28 20:54:49 +00:00
dev_read_urand(logrotate_t)
fs_search_auto_mountpoints(logrotate_t)
fs_getattr_xattr_fs(logrotate_t)
fs_list_inotifyfs(logrotate_t)
2005-06-28 20:54:49 +00:00
mls_file_read_all_levels(logrotate_t)
mls_file_write_all_levels(logrotate_t)
2006-01-06 22:51:40 +00:00
mls_file_upgrade(logrotate_t)
2005-06-28 20:54:49 +00:00
selinux_get_fs_mount(logrotate_t)
2005-09-16 13:36:26 +00:00
selinux_get_enforce_mode(logrotate_t)
2005-06-28 20:54:49 +00:00
auth_manage_login_records(logrotate_t)
auth_use_nsswitch(logrotate_t)
2005-06-28 20:54:49 +00:00
# Run helper programs.
corecmd_exec_bin(logrotate_t)
corecmd_exec_shell(logrotate_t)
domain_signal_all_domains(logrotate_t)
2006-02-20 21:33:25 +00:00
domain_use_interactive_fds(logrotate_t)
2005-09-14 19:27:30 +00:00
domain_getattr_all_entry_files(logrotate_t)
2005-09-20 20:48:17 +00:00
# Read /proc/PID directories for all domains.
domain_read_all_domains_state(logrotate_t)
2005-06-28 20:54:49 +00:00
files_read_usr_files(logrotate_t)
files_read_etc_files(logrotate_t)
2005-06-28 20:54:49 +00:00
files_read_etc_runtime_files(logrotate_t)
files_read_all_pids(logrotate_t)
files_search_all(logrotate_t)
2005-06-28 20:54:49 +00:00
# Write to /var/spool/slrnpull - should be moved into its own type.
files_manage_generic_spool(logrotate_t)
files_manage_generic_spool_dirs(logrotate_t)
files_getattr_generic_locks(logrotate_t)
2005-06-28 20:54:49 +00:00
# cjp: why is this needed?
init_domtrans_script(logrotate_t)
logging_manage_all_logs(logrotate_t)
2005-09-14 19:27:30 +00:00
logging_send_syslog_msg(logrotate_t)
2005-06-28 20:54:49 +00:00
# cjp: why is this needed?
logging_exec_all_logs(logrotate_t)
miscfiles_read_localization(logrotate_t)
2005-09-16 13:36:26 +00:00
seutil_dontaudit_read_config(logrotate_t)
2005-09-14 19:27:30 +00:00
2008-11-05 16:10:46 +00:00
userdom_use_user_terminals(logrotate_t)
userdom_dontaudit_search_user_home_dirs(logrotate_t)
2006-02-21 18:40:44 +00:00
userdom_use_unpriv_users_fds(logrotate_t)
2005-06-28 20:54:49 +00:00
cron_system_entry(logrotate_t, logrotate_exec_t)
cron_search_spool(logrotate_t)
mta_send_mail(logrotate_t)
ifdef(`distro_debian', `
allow logrotate_t logrotate_tmp_t:file { relabelfrom relabelto };
# for savelog
can_exec(logrotate_t, logrotate_exec_t)
# for syslogd-listfiles
logging_read_syslog_config(logrotate_t)
# for "test -x /sbin/syslogd"
logging_check_exec_syslog(logrotate_t)
2005-09-21 14:49:41 +00:00
')
optional_policy(`
2005-08-05 14:32:12 +00:00
acct_domtrans(logrotate_t)
acct_manage_data(logrotate_t)
acct_exec_data(logrotate_t)
')
optional_policy(`
2005-09-29 20:59:00 +00:00
apache_read_config(logrotate_t)
apache_domtrans(logrotate_t)
apache_signull(logrotate_t)
')
optional_policy(`
2005-06-28 20:54:49 +00:00
consoletype_exec(logrotate_t)
')
optional_policy(`
2005-11-29 21:27:15 +00:00
cups_domtrans(logrotate_t)
')
optional_policy(`
hostname_exec(logrotate_t)
')
optional_policy(`
2005-09-14 18:33:53 +00:00
samba_exec_log(logrotate_t)
')
optional_policy(`
mailman_domtrans(logrotate_t)
2005-10-11 15:36:53 +00:00
mailman_search_data(logrotate_t)
mailman_manage_log(logrotate_t)
')
2006-04-28 15:50:06 +00:00
optional_policy(`
munin_read_config(logrotate_t)
munin_stream_connect(logrotate_t)
munin_search_lib(logrotate_t)
')
optional_policy(`
2005-08-03 17:56:26 +00:00
mysql_read_config(logrotate_t)
2006-02-02 21:08:12 +00:00
mysql_search_db(logrotate_t)
2005-08-03 17:56:26 +00:00
mysql_stream_connect(logrotate_t)
')
optional_policy(`
2006-01-04 20:44:30 +00:00
slrnpull_manage_spool(logrotate_t)
')
optional_policy(`
squid_signal(logrotate_t)
2005-09-02 19:11:07 +00:00
')