selinux-policy/refpolicy/policy/modules/system/logging.te

357 lines
8.6 KiB
Plaintext
Raw Normal View History

2005-04-20 19:07:16 +00:00
policy_module(logging,1.0)
2005-06-07 14:27:19 +00:00
########################################
#
# Declarations
#
2005-04-14 20:18:17 +00:00
attribute logfile;
2005-09-15 15:34:31 +00:00
type auditctl_t; #, privlog;
type auditctl_exec_t;
init_system_domain(auditctl_t,auditctl_exec_t)
role system_r types auditctl_t;
type auditd_etc_t;
files_security_file(auditd_etc_t)
2005-09-15 15:34:31 +00:00
type auditd_log_t;
files_security_file(auditd_log_t)
2005-06-07 14:27:19 +00:00
type auditd_t;
type auditd_exec_t;
2005-06-13 17:35:46 +00:00
init_daemon_domain(auditd_t,auditd_exec_t)
2005-06-07 14:27:19 +00:00
type auditd_var_run_t;
2005-06-13 17:35:46 +00:00
files_pid_file(auditd_var_run_t)
2005-06-07 14:27:19 +00:00
2005-09-26 20:26:32 +00:00
type devlog_t;
files_type(devlog_t)
2005-09-26 20:26:32 +00:00
mls_trusted_object(devlog_t)
2005-09-26 20:26:32 +00:00
type klogd_t;
type klogd_exec_t;
2005-06-13 17:35:46 +00:00
init_daemon_domain(klogd_t,klogd_exec_t)
type klogd_tmp_t;
2005-06-13 17:35:46 +00:00
files_tmp_file(klogd_tmp_t)
type klogd_var_run_t;
2005-06-13 17:35:46 +00:00
files_pid_file(klogd_var_run_t)
type syslogd_t;
type syslogd_exec_t;
2005-06-13 17:35:46 +00:00
init_daemon_domain(syslogd_t,syslogd_exec_t)
type syslogd_tmp_t;
2005-06-13 17:35:46 +00:00
files_tmp_file(syslogd_tmp_t)
type syslogd_var_run_t;
2005-06-13 17:35:46 +00:00
files_pid_file(syslogd_var_run_t)
type var_log_t, logfile;
files_type(var_log_t)
2005-09-19 21:17:45 +00:00
files_associate_tmp(var_log_t)
2005-06-07 14:27:19 +00:00
########################################
#
# Auditd local policy
#
2005-09-15 15:34:31 +00:00
allow auditctl_t self:capability { audit_write audit_control };
allow auditctl_t self:netlink_audit_socket { create_netlink_socket_perms nlmsg_relay nlmsg_readpriv };
libs_use_ld_so(auditctl_t)
libs_use_shared_libs(auditctl_t)
allow auditctl_t etc_t:file { getattr read };
allow auditctl_t auditd_etc_t:file r_file_perms;
kernel_read_kernel_sysctl(auditctl_t)
domain_use_wide_inherit_fd(auditctl_t)
init_use_script_pty(auditctl_t)
init_dontaudit_use_fd(auditctl_t)
locallogin_dontaudit_use_fd(auditctl_t)
ifdef(`TODO',`
role secadm_r types auditctl_t;
role sysadm_r types auditctl_t;
audit_manager_domain(secadm_t)
ifdef(`targeted_policy', `', `
ifdef(`separate_secadm', `', `
audit_manager_domain(sysadm_t)
allow auditctl_t admin_tty_type:chr_file rw_file_perms;
')
')
') dnl end TODO
########################################
#
# Auditd local policy
#
allow auditd_t self:capability { audit_write audit_control sys_nice sys_resource };
2005-06-07 14:27:19 +00:00
dontaudit auditd_t self:capability sys_tty_config;
2005-09-01 20:13:42 +00:00
allow auditd_t self:process { signal_perms setsched };
2005-09-15 15:34:31 +00:00
allow auditd_t self:file { getattr read write };
allow auditd_t self:unix_dgram_socket create_socket_perms;
allow auditd_t self:netlink_audit_socket { create_netlink_socket_perms nlmsg_relay nlmsg_readpriv };
allow auditd_t auditd_etc_t:file r_file_perms;
2005-06-07 14:27:19 +00:00
2005-09-15 15:34:31 +00:00
allow auditd_t auditd_log_t:dir rw_dir_perms;
2005-06-09 18:08:26 +00:00
allow auditd_t auditd_log_t:file create_file_perms;
2005-09-15 15:34:31 +00:00
allow auditd_t var_log_t:dir search;
2005-06-07 14:27:19 +00:00
2005-06-09 18:08:26 +00:00
allow auditd_t auditd_var_run_t:file create_file_perms;
2005-06-13 17:35:46 +00:00
files_create_pid(auditd_t,auditd_var_run_t)
2005-06-07 14:27:19 +00:00
kernel_read_kernel_sysctl(auditd_t)
2005-07-08 20:44:57 +00:00
kernel_list_proc(auditd_t)
kernel_read_proc_symlinks(auditd_t)
dev_read_sysfs(auditd_t)
2005-06-07 14:27:19 +00:00
2005-06-10 01:01:13 +00:00
fs_getattr_all_fs(auditd_t)
2005-06-27 16:30:55 +00:00
fs_search_auto_mountpoints(auditd_t)
2005-06-07 14:27:19 +00:00
2005-06-10 01:01:13 +00:00
term_dontaudit_use_console(auditd_t)
2005-06-07 14:27:19 +00:00
# cjp: why?
corecmd_exec_sbin(auditd_t)
2005-06-07 14:27:19 +00:00
2005-06-13 17:35:46 +00:00
domain_use_wide_inherit_fd(auditd_t)
2005-06-07 14:27:19 +00:00
files_read_etc_files(auditd_t)
2005-09-05 18:17:17 +00:00
files_list_usr(auditd_t)
2005-06-07 14:27:19 +00:00
init_use_fd(auditd_t)
init_exec(auditd_t)
init_write_initctl(auditd_t)
init_use_script_pty(auditd_t)
2005-06-13 17:35:46 +00:00
logging_send_syslog_msg(auditd_t)
2005-06-07 14:27:19 +00:00
2005-06-13 17:35:46 +00:00
libs_use_ld_so(auditd_t)
libs_use_shared_libs(auditd_t)
2005-06-07 14:27:19 +00:00
miscfiles_read_localization(auditd_t)
2005-09-26 20:26:32 +00:00
mls_file_read_up(klogd_t)
2005-06-27 16:30:55 +00:00
userdom_dontaudit_use_unpriv_user_fd(auditd_t)
userdom_dontaudit_search_sysadm_home_dir(auditd_t)
2005-07-07 15:25:28 +00:00
# cjp: this is questionable
2005-06-30 18:54:08 +00:00
userdom_use_sysadm_tty(auditd_t)
2005-06-27 16:30:55 +00:00
optional_policy(`selinuxutil.te',`
seutil_sigchld_newrole(auditd_t)
2005-06-07 14:27:19 +00:00
')
optional_policy(`udev.te', `
2005-06-13 17:35:46 +00:00
udev_read_db(auditd_t)
2005-06-07 14:27:19 +00:00
')
ifdef(`TODO',`
optional_policy(`rhgb.te', `
2005-06-27 16:30:55 +00:00
rhgb_domain(auditd_t)
2005-06-07 14:27:19 +00:00
')
') dnl endif TODO
########################################
#
# klogd local policy
#
allow klogd_t klogd_tmp_t:file create_file_perms;
2005-06-13 17:35:46 +00:00
files_create_tmp_files(klogd_t,klogd_tmp_t)
allow klogd_t klogd_var_run_t:file create_file_perms;
allow klogd_t self:capability sys_admin;
dontaudit klogd_t self:capability sys_resource;
kernel_read_system_state(klogd_t)
kernel_read_messages(klogd_t)
# Control syslog and console logging
kernel_clear_ring_buffer(klogd_t)
kernel_change_ring_buffer_level(klogd_t)
bootloader_read_kernel_symbol_table(klogd_t)
2005-06-13 16:22:32 +00:00
dev_read_raw_memory(klogd_t)
2005-06-10 01:01:13 +00:00
fs_getattr_all_fs(klogd_t)
2005-06-13 17:35:46 +00:00
files_create_pid(klogd_t,klogd_var_run_t)
files_read_etc_runtime_files(klogd_t)
# read /etc/nsswitch.conf
files_read_etc_files(klogd_t)
2005-06-13 17:35:46 +00:00
init_use_fd(klogd_t)
2005-06-13 17:35:46 +00:00
libs_use_ld_so(klogd_t)
libs_use_shared_libs(klogd_t)
2005-06-13 17:35:46 +00:00
logging_send_syslog_msg(klogd_t)
miscfiles_read_localization(klogd_t)
2005-09-15 21:03:29 +00:00
ifdef(`TODO',`
ifdef(`targeted_policy', `
allow klogd_t unconfined_t:system syslog_mod;
')
')
########################################
#
# syslogd local policy
#
2005-09-15 15:34:31 +00:00
# sys_admin chown fsetid for syslog-ng
2005-09-13 13:06:07 +00:00
# cjp: why net_admin!
2005-09-15 15:34:31 +00:00
allow syslogd_t self:capability { dac_override sys_resource sys_tty_config net_admin sys_admin chown fsetid };
dontaudit syslogd_t self:capability sys_tty_config;
2005-05-31 23:02:11 +00:00
allow syslogd_t self:process signal_perms;
2005-09-15 15:34:31 +00:00
allow syslogd_t self:netlink_route_socket r_netlink_socket_perms;
2005-05-31 23:02:11 +00:00
# receive messages to be logged
2005-06-09 18:08:26 +00:00
allow syslogd_t self:unix_dgram_socket create_socket_perms;
allow syslogd_t self:unix_stream_socket create_stream_socket_perms;
2005-05-31 23:02:11 +00:00
allow syslogd_t self:unix_dgram_socket sendto;
2005-06-09 18:08:26 +00:00
allow syslogd_t self:fifo_file rw_file_perms;
allow syslogd_t self:udp_socket { connected_socket_perms connect };
2005-09-15 15:34:31 +00:00
# Create and bind to /dev/log or /var/run/log.
allow syslogd_t devlog_t:sock_file create_file_perms;
files_create_pid(syslogd_t,devlog_t,sock_file)
# cjp: I belive these are not needed:
allow syslogd_t devlog_t:unix_stream_socket name_bind;
allow syslogd_t devlog_t:unix_dgram_socket name_bind;
# create/append log files.
allow syslogd_t var_log_t:dir rw_dir_perms;
allow syslogd_t var_log_t:file create_file_perms;
2005-09-15 15:34:31 +00:00
# Allow access for syslog-ng
allow syslogd_t var_log_t:dir { create setattr };
# manage temporary files
allow syslogd_t syslogd_tmp_t:file create_file_perms;
2005-06-13 17:35:46 +00:00
files_create_tmp_files(syslogd_t,syslogd_tmp_t)
allow syslogd_t syslogd_var_run_t:file create_file_perms;
2005-06-13 17:35:46 +00:00
files_create_pid(syslogd_t,syslogd_var_run_t,file)
# manage pid file
2005-06-09 18:08:26 +00:00
allow syslogd_t syslogd_var_run_t:file create_file_perms;
2005-06-13 17:35:46 +00:00
files_create_pid(syslogd_t,syslogd_var_run_t)
kernel_read_kernel_sysctl(syslogd_t)
2005-07-08 20:44:57 +00:00
kernel_read_proc_symlinks(syslogd_t)
2005-09-12 15:17:39 +00:00
kernel_send_syslog_msg_from(devlog_t,syslogd_t)
2005-09-15 15:34:31 +00:00
# Allow access to /proc/kmsg for syslog-ng
kernel_read_messages(klogd_t)
kernel_clear_ring_buffer(klogd_t)
kernel_change_ring_buffer_level(klogd_t)
2005-06-13 16:22:32 +00:00
dev_create_dev_node(syslogd_t,devlog_t,sock_file)
dev_read_sysfs(syslogd_t)
2005-06-27 16:30:55 +00:00
fs_search_auto_mountpoints(syslogd_t)
2005-06-10 01:01:13 +00:00
term_dontaudit_use_console(syslogd_t)
# Allow syslog to a terminal
2005-06-10 01:01:13 +00:00
term_write_unallocated_ttys(syslogd_t)
# for sending messages to logged in users
2005-06-13 17:35:46 +00:00
init_read_script_pid(syslogd_t)
init_dontaudit_write_script_pid(syslogd_t)
2005-06-10 01:01:13 +00:00
term_write_all_user_ttys(syslogd_t)
2005-06-10 01:01:13 +00:00
corenet_raw_sendrecv_all_if(syslogd_t)
corenet_udp_sendrecv_all_if(syslogd_t)
corenet_raw_sendrecv_all_nodes(syslogd_t)
corenet_udp_sendrecv_all_nodes(syslogd_t)
corenet_udp_sendrecv_all_ports(syslogd_t)
corenet_udp_bind_all_nodes(syslogd_t)
2005-09-15 15:34:31 +00:00
corenet_tcp_bind_syslogd_port(syslogd_t)
#cjp: why?
corenet_tcp_connect_rsh_port(syslogd_t)
2005-06-10 01:01:13 +00:00
fs_getattr_all_fs(syslogd_t)
2005-06-13 17:35:46 +00:00
init_use_fd(syslogd_t)
init_use_script_pty(syslogd_t)
2005-06-13 17:35:46 +00:00
domain_use_wide_inherit_fd(syslogd_t)
files_read_etc_files(syslogd_t)
files_read_etc_runtime_files(syslogd_t)
2005-09-15 15:34:31 +00:00
# /initrd is not umounted before minilog starts
files_dontaudit_search_isid_type_dir(syslogd_t)
2005-06-13 17:35:46 +00:00
libs_use_ld_so(syslogd_t)
libs_use_shared_libs(syslogd_t)
2005-06-13 17:35:46 +00:00
sysnet_read_config(syslogd_t)
2005-04-25 21:28:25 +00:00
miscfiles_read_localization(syslogd_t)
2005-06-13 17:35:46 +00:00
userdom_dontaudit_use_unpriv_user_fd(syslogd_t)
userdom_dontaudit_search_sysadm_home_dir(syslogd_t)
2005-09-15 15:34:31 +00:00
ifdef(`distro_suse',`
2005-07-18 18:31:49 +00:00
# suse creates a /dev/log under /var/lib/stunnel for chrooted stunnel
files_create_var_lib(syslogd_t,devlog_t,sock_file)
')
2005-09-15 15:34:31 +00:00
ifdef(`targeted_policy',`
allow syslogd_t var_run_t:fifo_file { ioctl read write };
2005-06-10 01:01:13 +00:00
term_dontaudit_use_unallocated_tty(syslogd_t)
term_dontaudit_use_generic_pty(syslogd_t)
2005-06-13 17:35:46 +00:00
files_dontaudit_read_root_file(syslogd_t)
')
optional_policy(`inn.te',`
inn_manage_log(syslogd_t)
')
2005-06-27 16:30:55 +00:00
optional_policy(`nis.te',`
nis_use_ypbind(syslogd_t)
')
optional_policy(`nscd.te',`
nscd_use_socket(syslogd_t)
')
optional_policy(`selinuxutil.te',`
seutil_sigchld_newrole(syslogd_t)
')
optional_policy(`udev.te', `
2005-06-13 17:35:46 +00:00
udev_read_db(syslogd_t)
')
ifdef(`TODO',`
optional_policy(`rhgb.te', `
2005-06-27 16:30:55 +00:00
rhgb_domain(syslogd_t)
')
2005-09-15 15:34:31 +00:00
allow syslogd_t tmpfs_t:dir search;
dontaudit syslogd_t unlabeled_t:file { getattr read };
dontaudit syslogd_t { userpty_type devpts_t }:chr_file getattr;
# log to the xconsole
allow syslogd_t xconsole_device_t:fifo_file { ioctl read write };
#
# Special case to handle crashes
#
2005-09-15 15:34:31 +00:00
allow syslogd_t { device_t file_t }:sock_file { getattr unlink };
') dnl end TODO