attack with sediff, make fs:getattr interfaces consistent, create init and

daemon domains

refpolicy/policy/modules/kernel/bootloader.te

@@ -73,7 +73,7 @@ logging_send_system_log_message(bootloader_t)
 #files_create_private_config(bootloader_t,bootloader_etc_t)
 #allow bootloader_t bootloader_etc_t:file { create ioctl read getattr lock write setattr append link unlink rename };
 
-filesystem_read_persistent_filesystem_attributes(bootloader_t)
+filesystem_get_persistent_filesystem_attributes(bootloader_t)
 
 terminal_use_controlling_terminal(bootloader_t)
 

refpolicy/policy/modules/kernel/corenetwork.if

@@ -446,7 +446,7 @@ allow $1 node_type:tcp_socket node_bind;
 ')
 
 define(`corenetwork_bind_udp_on_all_nodes_depend',`
-type node_type;
+attribute node_type;
 class tcp_socket node_bind;
 ')
 
@@ -460,7 +460,7 @@ allow $1 node_type:udp_socket node_bind;
 ')
 
 define(`corenetwork_bind_udp_on_all_nodes_depend',`
-type node_type;
+attribute node_type;
 class udp_socket node_bind;
 ')
 

refpolicy/policy/modules/kernel/filesystem.if

@@ -91,28 +91,28 @@ class filesystem unmount;
 
 ########################################
 #
-# filesystem_read_persistent_filesystem_attributes(domain,[`optional'])
+# filesystem_get_persistent_filesystem_attributes(domain,[`optional'])
 #
-define(`filesystem_read_persistent_filesystem_attributes',`
-requires_block_template(filesystem_read_persistent_filesystem_attributes_depend,$2)
+define(`filesystem_get_persistent_filesystem_attributes',`
+requires_block_template(filesystem_get_persistent_filesystem_attributes_depend,$2)
 allow $1 fs_t:filesystem getattr;
 ')
 
-define(`filesystem_read_persistent_filesystem_attributes_depend',`
+define(`filesystem_get_persistent_filesystem_attributes_depend',`
 type fs_t;
 class filesystem getattr;
 ')
 
 ########################################
 #
-# filesystem_ignore_read_persistent_filesystem_attributes(domain,[`optional'])
+# filesystem_ignore_get_persistent_filesystem_attributes(domain,[`optional'])
 #
-define(`filesystem_ignore_read_persistent_filesystem_attributes',`
-requires_block_template(filesystem_ignore_read_persistent_filesystem_attributes_depend,$2)
+define(`filesystem_ignore_get_persistent_filesystem_attributes',`
+requires_block_template(filesystem_ignore_get_persistent_filesystem_attributes_depend,$2)
 dontaudit $1 fs_t:filesystem getattr;
 ')
 
-define(`filesystem_ignore_read_persistent_filesystem_attributes_depend',`
+define(`filesystem_ignore_get_persistent_filesystem_attributes_depend',`
 type fs_t;
 class filesystem getattr;
 ')
@@ -161,14 +161,14 @@ class filesystem unmount;
 
 ########################################
 #
-# filesystem_read_automount_filesystem_attributes(domain,[`optional'])
+# filesystem_get_automount_filesystem_attributes(domain,[`optional'])
 #
-define(`filesystem_read_automount_filesystem_attributes',`
-requires_block_template(filesystem_read_automount_filesystem_attributes_depend,$2)
+define(`filesystem_get_automount_filesystem_attributes',`
+requires_block_template(filesystem_get_automount_filesystem_attributes_depend,$2)
 allow $1 autofs_t:filesystem getattr;
 ')
 
-define(`filesystem_read_automount_filesystem_attributes_depend',`
+define(`filesystem_get_automount_filesystem_attributes_depend',`
 type autofs_t;
 class filesystem getattr;
 ')
@@ -233,14 +233,14 @@ class filesystem unmount;
 
 ########################################
 #
-# filesystem_read_windows_network_filesystem_attributes(domain,[`optional'])
+# filesystem_get_windows_network_filesystem_attributes(domain,[`optional'])
 #
-define(`filesystem_read_windows_network_filesystem_attributes',`
-requires_block_template(filesystem_read_windows_network_filesystem_attributes_depend,$2)
+define(`filesystem_get_windows_network_filesystem_attributes',`
+requires_block_template(filesystem_get_windows_network_filesystem_attributes_depend,$2)
 allow $1 cifs_t:filesystem getattr;
 ')
 
-define(`filesystem_read_windows_network_filesystem_attributes_depend',`
+define(`filesystem_get_windows_network_filesystem_attributes_depend',`
 type cifs_t;
 class filesystem getattr;
 ')
@@ -289,14 +289,14 @@ class filesystem unmount;
 
 ########################################
 #
-# filesystem_read_dos_filesystem_attributes(domain,[`optional'])
+# filesystem_get_dos_filesystem_attributes(domain,[`optional'])
 #
-define(`filesystem_read_dos_filesystem_attributes',`
-requires_block_template(filesystem_read_dos_filesystem_attributes_depend,$2)
+define(`filesystem_get_dos_filesystem_attributes',`
+requires_block_template(filesystem_get_dos_filesystem_attributes_depend,$2)
 allow $1 dosfs_t:filesystem getattr;
 ')
 
-define(`filesystem_read_dos_filesystem_attributes_depend',`
+define(`filesystem_get_dos_filesystem_attributes_depend',`
 type dosfs_t;
 class filesystem getattr;
 ')
@@ -345,14 +345,14 @@ class filesystem unmount;
 
 ########################################
 #
-# filesystem_read_cd_filesystem_attributes(domain,[`optional'])
+# filesystem_get_cd_filesystem_attributes(domain,[`optional'])
 #
-define(`filesystem_read_cd_filesystem_attributes',`
-requires_block_template(filesystem_read_cd_filesystem_attributes_depend,$2)
+define(`filesystem_get_cd_filesystem_attributes',`
+requires_block_template(filesystem_get_cd_filesystem_attributes_depend,$2)
 allow $1 iso9660_t:filesystem getattr;
 ')
 
-define(`filesystem_read_cd_filesystem_attributes_depend',`
+define(`filesystem_get_cd_filesystem_attributes_depend',`
 type iso9660_t;
 class filesystem getattr;
 ')
@@ -401,14 +401,14 @@ class filesystem unmount;
 
 ########################################
 #
-# filesystem_read_nfs_filesystem_attributes(domain,[`optional'])
+# filesystem_get_nfs_filesystem_attributes(domain,[`optional'])
 #
-define(`filesystem_read_nfs_filesystem_attributes',`
-requires_block_template(filesystem_read_nfs_filesystem_attributes_depend,$2)
+define(`filesystem_get_nfs_filesystem_attributes',`
+requires_block_template(filesystem_get_nfs_filesystem_attributes_depend,$2)
 allow $1 nfs_t:filesystem getattr;
 ')
 
-define(`filesystem_read_nfs_filesystem_attributes_depend',`
+define(`filesystem_get_nfs_filesystem_attributes_depend',`
 type nfs_t;
 class filesystem getattr;
 ')
@@ -457,14 +457,14 @@ class filesystem unmount;
 
 ########################################
 #
-# filesystem_read_nfsd_filesystem_attributes(domain,[`optional'])
+# filesystem_get_nfsd_filesystem_attributes(domain,[`optional'])
 #
-define(`filesystem_read_nfsd_filesystem_attributes',`
-requires_block_template(filesystem_read_nfsd_filesystem_attributes_depend,$2)
+define(`filesystem_get_nfsd_filesystem_attributes',`
+requires_block_template(filesystem_get_nfsd_filesystem_attributes_depend,$2)
 allow $1 nfsd_fs_t:filesystem getattr;
 ')
 
-define(`filesystem_read_nfsd_filesystem_attributes_depend',`
+define(`filesystem_get_nfsd_filesystem_attributes_depend',`
 type nfsd_fs_t;
 class filesystem getattr;
 ')
@@ -513,14 +513,14 @@ class filesystem unmount;
 
 ########################################
 #
-# filesystem_read_ram_filesystem_attributes(domain,[`optional'])
+# filesystem_get_ram_filesystem_attributes(domain,[`optional'])
 #
-define(`filesystem_read_ram_filesystem_attributes',`
-requires_block_template(filesystem_read_ram_filesystem_attributes_depend,$2)
+define(`filesystem_get_ram_filesystem_attributes',`
+requires_block_template(filesystem_get_ram_filesystem_attributes_depend,$2)
 allow $1 ramfs_t:filesystem getattr;
 ')
 
-define(`filesystem_read_ram_filesystem_attributes_depend',`
+define(`filesystem_get_ram_filesystem_attributes_depend',`
 type ramfs_t;
 class filesystem getattr;
 ')
@@ -569,14 +569,14 @@ class filesystem unmount;
 
 ########################################
 #
-# filesystem_read_rom_filesystem_attributes(domain,[`optional'])
+# filesystem_get_rom_filesystem_attributes(domain,[`optional'])
 #
-define(`filesystem_read_rom_filesystem_attributes',`
-requires_block_template(filesystem_read_rom_filesystem_attributes_depend,$2)
+define(`filesystem_get_rom_filesystem_attributes',`
+requires_block_template(filesystem_get_rom_filesystem_attributes_depend,$2)
 allow $1 romfs_t:filesystem getattr;
 ')
 
-define(`filesystem_read_rom_filesystem_attributes_depend',`
+define(`filesystem_get_rom_filesystem_attributes_depend',`
 type romfs_t;
 class filesystem getattr;
 ')
@@ -625,14 +625,14 @@ class filesystem unmount;
 
 ########################################
 #
-# filesystem_read_rpc_pipefs_filesystem_attributes(domain,[`optional'])
+# filesystem_get_rpc_pipefs_filesystem_attributes(domain,[`optional'])
 #
-define(`filesystem_read_rpc_pipefs_filesystem_attributes',`
-requires_block_template(filesystem_read_rpc_pipefs_filesystem_attributes_depend,$2)
+define(`filesystem_get_rpc_pipefs_filesystem_attributes',`
+requires_block_template(filesystem_get_rpc_pipefs_filesystem_attributes_depend,$2)
 allow $1 rpc_pipefs_t:filesystem getattr;
 ')
 
-define(`filesystem_read_rpc_pipefs_filesystem_attributes_depend',`
+define(`filesystem_get_rpc_pipefs_filesystem_attributes_depend',`
 type rpc_pipefs_t;
 class filesystem getattr;
 ')
@@ -681,14 +681,14 @@ class filesystem unmount;
 
 ########################################
 #
-# filesystem_read_tmpfs_filesystem_attributes(domain,[`optional'])
+# filesystem_get_tmpfs_filesystem_attributes(domain,[`optional'])
 #
-define(`filesystem_read_tmpfs_filesystem_attributes',`
-requires_block_template(filesystem_read_tmpfs_filesystem_attributes_depend,$2)
+define(`filesystem_get_tmpfs_filesystem_attributes',`
+requires_block_template(filesystem_get_tmpfs_filesystem_attributes_depend,$2)
 allow $1 tmpfs_t:filesystem getattr;
 ')
 
-define(`filesystem_read_tmpfs_filesystem_attributes_depend',`
+define(`filesystem_get_tmpfs_filesystem_attributes_depend',`
 type tmpfs_t;
 class filesystem getattr;
 ')
@@ -767,3 +767,17 @@ define(`filesystem_mount_all_filesystems_depend',`
 attribute fs_type;
 class filesystem unmount;
 ')
+
+########################################
+#
+# filesystem_get_all_filesystems_attributes(type,[`optional'])
+#
+define(`filesystem_get_all_filesystems_attributes',`
+requires_block_template(filesystem_get_all_filesystems_attributes_depend,$2)
+allow $1 fs_type:filesystem getattr;
+')
+
+define(`filesystem_get_all_filesystems_attributes_depend',`
+attribute fs_type;
+class filesystem getattr;
+')

refpolicy/policy/modules/system/authlogin.if

@@ -26,7 +26,7 @@ libraries_read_shared_libraries($1_chkpwd_t)
 files_read_general_system_config($1_chkpwd_t)
 miscfiles_read_localization($1_chkpwd_t)
 selinux_read_config($1_chkpwd_t)
-filesystem_ignore_read_persistent_filesystem_attributes($1_chkpwd_t)
+filesystem_ignore_get_persistent_filesystem_attributes($1_chkpwd_t)
 
 # is_selinux_enabled
 kernel_read_system_state($1_chkpwd_t)

refpolicy/policy/modules/system/domain.if

@@ -59,6 +59,46 @@ define(`domain_make_entrypoint_file_depend',`
 class file entrypoint;
 ')
 
+########################################
+#
+# domain_make_init_domain(domain,entrypointfile,[`optional'])
+#
+define(`domain_make_init_domain',`
+requires_block_template(domain_make_init_domain_depend,$3)
+domain_make_domain($1,optional)
+domain_make_entrypoint_file($1,$2,optional)
+typeattribute $1 init_domain;
+typeattribute $2 init_domain_entry;
+role system_r types $1;
+')
+
+define(`domain_make_init_domain_depend',`
+attribute init_domain, init_domain_entry;
+role system_r;
+domain_make_domain_depend
+domain_make_entrypoint_file_depend
+')
+
+########################################
+#
+# domain_make_daemon_domain(domain,entrypointfile,[`optional'])
+#
+define(`domain_make_daemon_domain',`
+requires_block_template(domain_make_daemon_domain_depend,$3)
+domain_make_domain($1,optional)
+domain_make_entrypoint_file($1,$2,optional)
+typeattribute $1 daemon_domain;
+typeattribute $2 daemon_domain_entry;
+role system_r types $1;
+')
+
+define(`domain_make_daemon_domain_depend',`
+attribute init_domain, init_domain_entry;
+role system_r;
+domain_make_domain_depend
+domain_make_entrypoint_file_depend
+')
+
 ########################################
 #
 # domain_make_file_descriptors_widely_inheritable(domain,[`optional'])
@@ -72,6 +112,38 @@ define(`domain_make_file_descriptors_widely_inheritable_depend',`
 attribute privfd;
 ')
 
+########################################
+#
+# domain_all_init_domains_transition(domain,[`optional'])
+#
+define(`domain_all_init_domains_transition',`
+requires_block_template(domain_all_init_domains_transition_depend,$3)
+allow $1 init_domain:process transition;
+allow $1 init_domain_entry:file { getattr read execute };
+')
+
+define(`domain_all_init_domains_transition_depend',`
+attribute init_domain, init_domain_entry;
+class process transition;
+class file { getattr read execute };
+')
+
+########################################
+#
+# domain_all_daemon_domains_transition(domain,[`optional'])
+#
+define(`domain_all_daemon_domains_transition',`
+requires_block_template(domain_all_daemon_domains_transition_depend,$3)
+allow $1 daemon_domain:process transition;
+allow $1 daemon_domain_entry:file { getattr read execute };
+')
+
+define(`domain_all_daemon_domains_transition_depend',`
+attribute daemon_domain, daemon_domain_entry;
+class process transition;
+class file { getattr read execute };
+')
+
 ########################################
 #
 # domain_signal_all_domains(domain,[`optional'])

refpolicy/policy/modules/system/domain.te

@@ -3,6 +3,14 @@
 # Mark process types as domains
 attribute domain;
 
+# processes started by init itself
+attribute init_domain;
+attribute init_domain_entry;
+
+# processes started by init scripts
+attribute daemon_domain;
+attribute daemon_domain_entry;
+
 # widely-inheritable file descriptors
 attribute privfd;
 

refpolicy/policy/modules/system/files.te

@@ -70,6 +70,18 @@ type mnt_t, file_type;
 filesystem_associate(mnt_t)
 filesystem_noxattr_associate(mnt_t)
 
+type no_access_t, file_type;
+filesystem_associate(no_access_t)
+filesystem_noxattr_associate(no_access_t)
+
+type poly_t, file_type;
+filesystem_associate(poly_t)
+filesystem_noxattr_associate(poly_t)
+
+type readable_t, file_type;
+filesystem_associate(readable_t)
+filesystem_noxattr_associate(readable_t)
+
 #
 # src_t is the type of files in the system src directories.
 #

refpolicy/policy/modules/system/getty.te

@@ -1,10 +1,8 @@
 # Copyright (C) 2005 Tresys Technology, LLC
 
 type getty_t; #, privfd
-domain_make_domain(getty_t)
-
 type getty_exec_t;
-domain_make_entrypoint_file(getty_t,getty_exec_t)
+domain_make_init_domain(getty_t,getty_exec_t)
 
 type getty_etc_t;
 typealias getty_etc_t alias etc_getty_t;
@@ -51,7 +49,7 @@ files_read_general_system_config(getty_t)
 miscfiles_read_localization(getty_t)
 
 # for error condition handling
-filesystem_read_persistent_filesystem_attributes(getty_t)
+filesystem_get_persistent_filesystem_attributes(getty_t)
 
 # Chown, chmod, read and write ttys.
 terminal_use_all_terminals(getty_t)
@@ -74,6 +72,3 @@ terminal_use_all_terminals(getty_t)
 
 # TODO: There is no interface for this in init.if yet.
 #allow getty_t initrc_devpts_t:chr_file { read write };
-
-# TODO: This needs to go into the init module. Allow init module to transition into getty domain.
-#getty_transition(init_t)

refpolicy/policy/modules/system/init.te

@@ -38,6 +38,8 @@ type initrc_exec_t;
 domain_make_entrypoint_file(initrc_t,initrc_exec_t)
 
 type initrc_devpts_t;
+filesystem_associate(initrc_devpts_t)
+filesystem_noxattr_associate(initrc_devpts_t)
 terminal_make_pseudoterminal(initrc_t,initrc_devpts_t)
 
 type initrc_var_run_t;
@@ -93,6 +95,7 @@ terminal_use_all_terminals(init_t)
 
 domain_signal_all_domains(init_t)
 domain_kill_all_domains(init_t)
+domain_all_init_domains_transition(init_t)
 
 files_modify_system_runtime_data(init_t)
 
@@ -201,6 +204,8 @@ filesystem_register_binary_executable_type(initrc_t)
 # cjp: not sure why these are here; should use mount policy
 filesystem_mount_all_filesystems(initrc_t)
 filesystem_unmount_all_filesystems(initrc_t)
+filesystem_remount_all_filesystems(initrc_t)
+filesystem_get_all_filesystems_attributes(initrc_t)
 
 # can_network(initrc_t):
 allow initrc_t self:tcp_socket { connect listen accept create ioctl read getattr write setattr append bind getopt setopt shutdown };
@@ -220,6 +225,7 @@ corenetwork_bind_udp_on_all_nodes(initrc_t)
 
 domain_kill_all_domains(initrc_t)
 domain_read_all_domains_process_state(initrc_t)
+domain_all_daemon_domains_transition(initrc_t)
 
 devices_get_random_data(initrc_t)
 devices_get_pseudorandom_data(initrc_t)
@@ -257,6 +263,7 @@ files_manage_pseudorandom_saved_seed(initrc_t)
 
 corecommands_execute_general_programs(initrc_t)
 corecommands_execute_system_programs(initrc_t)
+corecommands_execute_shell(initrc_t)
 
 logging_send_system_log_message(initrc_t)
 
@@ -376,7 +383,7 @@ ifdef(`targeted_policy',`
 corecommands_execute_general_programs(run_init_t)
 corecommands_execute_shell(run_init_t)
 
-filesystem_read_persistent_filesystem_attributes(run_init_t)
+filesystem_get_persistent_filesystem_attributes(run_init_t)
 
 files_read_general_system_config(run_init_t)
 

refpolicy/policy/modules/system/libraries.if

@@ -8,6 +8,7 @@ define(`libraries_use_dynamic_loader',`
 requires_block_template(libraries_use_dynamic_loader_depend,$2)
 allow $1 lib_t:dir { getattr read search };
 allow $1 lib_t:lnk_file { getattr read };
+allow $1 ld_so_t:lnk_file { getattr read };
 allow $1 ld_so_t:file { getattr read execute };
 allow $1 ld_so_cache_t:file { getattr read };
 ')
@@ -41,6 +42,7 @@ define(`libraries_read_shared_libraries',`
 requires_block_template(libraries_read_shared_libraries_depend,$2)
 allow $1 lib_t:dir { getattr read search };
 allow $1 lib_t:lnk_file { getattr read };
+allow $1 { shlib_t texrel_shlib_t }:lnk_file { getattr read };
 allow $1 { shlib_t texrel_shlib_t }:file { getattr read execute };
 ')
 

refpolicy/policy/modules/system/logging.te

@@ -6,11 +6,8 @@ type devlog_t;
 files_make_file(devlog_t)
 
 type klogd_t;
-domain_make_domain(klogd_t)
-role system_r types klogd_t;
-
 type klogd_exec_t;
-domain_make_entrypoint_file(klogd_t,klogd_exec_t)
+domain_make_daemon_domain(klogd_t,klogd_exec_t)
 
 type klogd_tmp_t;
 files_make_file(klogd_tmp_t)
@@ -19,11 +16,8 @@ type klogd_var_run_t;
 files_make_file(klogd_var_run_t)
 
 type syslogd_t;
-domain_make_domain(syslogd_t)
-role system_r types syslogd_t;
-
 type syslogd_exec_t;
-domain_make_entrypoint_file(syslogd_t,syslogd_exec_t)
+domain_make_daemon_domain(syslogd_t,syslogd_exec_t)
 
 type syslogd_tmp_t;
 files_make_file(syslogd_tmp_t)
@@ -46,6 +40,15 @@ allow klogd_t self:capability sys_admin;
 dontaudit klogd_t self:capability sys_resource;
 
 kernel_read_system_state(klogd_t)
+kernel_read_messages(klogd_t)
+# Control syslog and console logging
+kernel_clear_ring_buffer(klogd_t)
+kernel_change_ring_buffer_level(klogd_t)
+devices_raw_read_memory(klogd_t)
+
+filesystem_get_all_filesystems_attributes(klogd_t)
+
+bootloader_read_kernel_symbol_table(klogd_t)
 
 libraries_use_dynamic_loader(klogd_t)
 libraries_read_shared_libraries(klogd_t)
@@ -61,22 +64,107 @@ miscfiles_read_localization(klogd_t)
 
 logging_send_system_log_message(klogd_t)
 
-kernel_read_messages(klogd_t)
-devices_raw_read_memory(klogd_t)
-
-# Control syslog and console logging
-kernel_clear_ring_buffer(klogd_t)
-kernel_change_ring_buffer_level(klogd_t)
-
-bootloader_read_kernel_symbol_table(klogd_t)
-
 ########################################
 #
 # syslogd local policy
 #
-files_create_daemon_runtime_data(syslogd_t,syslogd_var_run_t)
-files_create_private_tmp_data(syslogd_t,syslogd_tmp_t)
-devices_create_dev_entry(syslogd_t,devlog_t,sock_file)
+
+# Use capabilities.
+allow syslogd_t self:capability { dac_override net_bind_service sys_resource sys_tty_config };
+
+# Modify/create log files.
+allow syslogd_t var_log_t:dir { read getattr search add_name write };
+allow syslogd_t var_log_t:file { create ioctl getattr setattr append link };
 
 allow syslogd_t syslogd_tmp_t:file { getattr create read write append setattr unlink };
 allow syslogd_t syslogd_var_run_t:file { getattr create read write append setattr unlink };
+
+allow syslogd_t devlog_t:unix_stream_socket name_bind;
+allow syslogd_t devlog_t:unix_dgram_socket name_bind;
+
+allow syslogd_t self:unix_dgram_socket { create read getattr write setattr append bind connect getopt setopt shutdown };
+allow syslogd_t self:unix_stream_socket { create read getattr write setattr append bind connect getopt setopt shutdown listen accept };
+allow syslogd_t self:unix_dgram_socket sendto;
+allow syslogd_t self:fifo_file { getattr read write ioctl lock };
+
+# Create and bind to /dev/log or /var/run/log.
+allow syslogd_t devlog_t:sock_file { create ioctl read getattr lock write setattr append link unlink rename };
+
+kernel_read_hardware_state(syslogd_t)
+
+devices_create_dev_entry(syslogd_t,devlog_t,sock_file)
+
+corenetwork_network_raw_on_all_interfaces(syslogd_t)
+corenetwork_network_udp_on_all_interfaces(syslogd_t)
+corenetwork_network_raw_on_all_nodes(syslogd_t)
+corenetwork_network_udp_on_all_nodes(syslogd_t)
+corenetwork_network_udp_on_all_ports(syslogd_t)
+corenetwork_bind_udp_on_all_nodes(syslogd_t)
+corenetwork_bind_udp_on_syslogd_port(syslogd_t)
+
+filesystem_get_all_filesystems_attributes(syslogd_t)
+
+files_read_general_system_config(syslogd_t)
+files_create_daemon_runtime_data(syslogd_t,syslogd_var_run_t,file)
+files_create_daemon_runtime_data(syslogd_t,devlog_t,sock_file)
+files_create_private_tmp_data(syslogd_t,syslogd_tmp_t)
+ifdef(`distro_suse', `
+# suse creates a /dev/log under /var/lib/stunnel for chrooted stunnel
+file_type_auto_trans(syslogd_t, var_lib_t, devlog_t, sock_file)
+')
+
+libraries_use_dynamic_loader(syslogd_t)
+libraries_read_shared_libraries(syslogd_t)
+
+miscfiles_read_localization(syslogd_t)
+
+#
+# /initrd is not umounted before minilog starts
+#
+#dontaudit syslogd_t file_t:dir search;
+#allow syslogd_t { tmpfs_t devpts_t }:dir search;
+#dontaudit syslogd_t unlabeled_t:file read;
+#dontaudit syslogd_t { userpty_type devpts_t }:chr_file getattr;
+allow syslogd_t self:capability net_admin;
+allow syslogd_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read };
+
+ifdef(`klogd.te', `', `
+# Allow access to /proc/kmsg for syslog-ng
+kernel_read_messages(syslogd_t)
+kernel_clear_ring_buffer(syslogd_t)
+kernel_change_ring_buffer_level(syslogd_t)
+')
+
+ifdef(`TODO',`
+daemon_domain(syslogd)
+
+# can_network is for the UDP socket
+can_ypbind(syslogd_t)
+
+# log to the xconsole
+allow syslogd_t xconsole_device_t:fifo_file { ioctl read write };
+
+ifdef(`crond.te', `
+# Write to the cron log.
+allow syslogd_t crond_log_t:file rw_file_perms;
+# for daemon re-start
+allow system_crond_t syslogd_t:lnk_file read;
+')
+
+ifdef(`logrotate.te', `
+allow logrotate_t syslogd_exec_t:file r_file_perms;
+')
+
+# for sending messages to logged in users
+allow syslogd_t initrc_var_run_t:file { read lock };
+dontaudit syslogd_t initrc_var_run_t:file write;
+allow syslogd_t ttyfile:chr_file { getattr write };
+
+#
+# Special case to handle crashes
+#
+allow syslogd_t { device_t file_t }:sock_file unlink;
+
+# Allow syslog to a terminal
+allow syslogd_t tty_device_t:chr_file { getattr write ioctl append };
+') dnl end TODO

refpolicy/policy/modules/system/modutils.te

@@ -75,7 +75,7 @@ devices_get_pseudorandom_data(insmod_t)
 devices_direct_agp_access(insmod_t)
 devices_get_zeros(insmod_t)
 
-filesystem_read_persistent_filesystem_attributes(insmod_t)
+filesystem_get_persistent_filesystem_attributes(insmod_t)
 
 files_read_runtime_system_config(insmod_t)
 files_read_general_system_config(insmod_t)
@@ -171,7 +171,7 @@ type_transition depmod_t modules_object_t:file modules_dep_t;
 
 kernel_read_system_state(depmod_t)
 
-filesystem_read_persistent_filesystem_attributes(depmod_t)
+filesystem_get_persistent_filesystem_attributes(depmod_t)
 
 terminal_use_console(depmod_t)
 
@@ -230,7 +230,7 @@ kernel_read_system_state(update_modules_t)
 
 devices_get_pseudorandom_data(update_modules_t)
 
-filesystem_read_persistent_filesystem_attributes(update_modules_t)
+filesystem_get_persistent_filesystem_attributes(update_modules_t)
 
 terminal_use_console(update_modules_t)
 terminal_use_controlling_terminal(update_modules_t)