diff --git a/policy/modules/services/procmail.te b/policy/modules/services/procmail.te
index 490eed46..6d0a04fa 100644
--- a/policy/modules/services/procmail.te
+++ b/policy/modules/services/procmail.te
@@ -1,5 +1,5 @@
-policy_module(procmail,1.6.1)
+policy_module(procmail,1.6.2)
########################################
#
@@ -27,6 +27,8 @@ allow procmail_t self:unix_dgram_socket create_socket_perms;
allow procmail_t self:tcp_socket create_stream_socket_perms;
allow procmail_t self:udp_socket create_socket_perms;
+can_exec(procmail_t,procmail_exec_t)
+
allow procmail_t procmail_tmp_t:file manage_file_perms;
files_tmp_filetrans(procmail_t, procmail_tmp_t, file)
@@ -108,6 +110,9 @@ optional_policy(`
# for a bug in the postfix local program
postfix_dontaudit_rw_local_tcp_sockets(procmail_t)
postfix_dontaudit_use_fds(procmail_t)
+ postfix_read_spool_files(procmail_t)
+ postfix_read_local_state(procmail_t)
+ postfix_read_master_state(procmail_t)
')
optional_policy(`
diff --git a/policy/modules/services/rhgb.te b/policy/modules/services/rhgb.te
index 2fcb6994..f5e8717a 100644
--- a/policy/modules/services/rhgb.te
+++ b/policy/modules/services/rhgb.te
@@ -1,5 +1,5 @@
-policy_module(rhgb,1.4.0)
+policy_module(rhgb,1.4.1)
########################################
#
@@ -106,6 +106,7 @@ sysnet_domtrans_ifconfig(rhgb_t)
userdom_dontaudit_use_unpriv_user_fds(rhgb_t)
userdom_dontaudit_search_sysadm_home_dirs(rhgb_t)
+userdom_dontaudit_search_all_users_home_content(rhgb_t)
xserver_read_xdm_xserver_tmp_files(rhgb_t)
xserver_kill_xdm_xserver(rhgb_t)
diff --git a/policy/modules/system/logging.fc b/policy/modules/system/logging.fc
index 2f75efa5..1224ba28 100644
--- a/policy/modules/system/logging.fc
+++ b/policy/modules/system/logging.fc
@@ -1,4 +1,3 @@
-
/dev/log -s gen_context(system_u:object_r:devlog_t,s0)
/etc/audit(/.*)? gen_context(system_u:object_r:auditd_etc_t,mls_systemhigh)
@@ -7,6 +6,8 @@
/sbin/auditd -- gen_context(system_u:object_r:auditd_exec_t,s0)
/sbin/klogd -- gen_context(system_u:object_r:klogd_exec_t,s0)
/sbin/minilogd -- gen_context(system_u:object_r:syslogd_exec_t,s0)
+/sbin/rklogd -- gen_context(system_u:object_r:klogd_exec_t,s0)
+/sbin/rsyslogd -- gen_context(system_u:object_r:syslogd_exec_t,s0)
/sbin/syslogd -- gen_context(system_u:object_r:syslogd_exec_t,s0)
/sbin/syslog-ng -- gen_context(system_u:object_r:syslogd_exec_t,s0)
diff --git a/policy/modules/system/logging.if b/policy/modules/system/logging.if
index 7841e713..3a56695f 100644
--- a/policy/modules/system/logging.if
+++ b/policy/modules/system/logging.if
@@ -217,6 +217,25 @@ interface(`logging_manage_audit_log',`
manage_files_pattern($1,auditd_log_t,auditd_log_t)
')
+########################################
+##
+## Execute klogd in the klog domain.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`logging_domtrans_klog',`
+ gen_require(`
+ type klogd_t, klogd_exec_t;
+ ')
+
+ corecmd_search_bin($1)
+ domtrans_pattern($1,klogd_exec_t,klogd_t)
+')
+
########################################
##
## Execute syslogd in the syslog domain.
@@ -470,7 +489,7 @@ interface(`logging_read_all_logs',`
files_search_var($1)
allow $1 var_log_t:dir list_dir_perms;
- read_files_pattern($1,var_log_t,logfile)
+ read_files_pattern($1,logfile, logfile)
')
########################################
diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te
index 12332f03..b0463775 100644
--- a/policy/modules/system/logging.te
+++ b/policy/modules/system/logging.te
@@ -1,5 +1,5 @@
-policy_module(logging,1.7.3)
+policy_module(logging,1.7.4)
########################################
#
@@ -61,10 +61,10 @@ ifdef(`enable_mls',`
########################################
#
-# Auditd local policy
+# Auditctl local policy
#
-allow auditctl_t self:capability { audit_write audit_control };
+allow auditctl_t self:capability { fsetid dac_read_search dac_override audit_write audit_control };
allow auditctl_t self:netlink_audit_socket { create_netlink_socket_perms nlmsg_relay nlmsg_readpriv };
read_files_pattern(auditctl_t,auditd_etc_t,auditd_etc_t)
@@ -72,6 +72,7 @@ allow auditctl_t auditd_etc_t:dir list_dir_perms;
# Needed for adding watches
files_getattr_all_dirs(auditctl_t)
+files_getattr_all_files(auditctl_t)
files_read_etc_files(auditctl_t)
kernel_read_kernel_sysctls(auditctl_t)
@@ -265,6 +266,8 @@ files_pid_filetrans(syslogd_t,devlog_t,sock_file)
# create/append log files.
manage_files_pattern(syslogd_t,var_log_t,var_log_t)
+rw_fifo_files_pattern(syslogd_t,var_log_t,var_log_t)
+
# Allow access for syslog-ng
allow syslogd_t var_log_t:dir { create setattr };
@@ -330,6 +333,7 @@ init_use_fds(syslogd_t)
domain_use_interactive_fds(syslogd_t)
files_read_etc_files(syslogd_t)
+files_read_var_files(syslogd_t)
files_read_etc_runtime_files(syslogd_t)
# /initrd is not umounted before minilog starts
files_dontaudit_search_isid_type_dirs(syslogd_t)