rpms/selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity

cleanup

Browse Source
This commit is contained in:
Chris PeBenito 2005-09-14 19:27:30 +00:00
parent 84c92239d4
commit 5a2649cefd
1 changed files with 7 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
refpolicy/policy/modules/admin/logrotate.te
View File

@ -52,7 +52,10 @@ allow logrotate_t logrotate_tmp_t:dir create_dir_perms;
allow logrotate_t logrotate_tmp_t:file create_file_perms;
files_create_tmp_files(logrotate_t, logrotate_tmp_t, { file dir })
# for /var/lib/logrotate.status and /var/lib/logcheck
allow logrotate_t logrotate_var_lib_t:dir { create rw_dir_perms };
allow logrotate_t logrotate_var_lib_t:file create_file_perms;
files_create_var_lib(logrotate_t, logrotate_var_lib_t)
kernel_read_system_state(logrotate_t)
kernel_read_kernel_sysctl(logrotate_t)
@ -74,6 +77,7 @@ corecmd_exec_ls(logrotate_t)
domain_signal_all_domains(logrotate_t)
domain_use_wide_inherit_fd(logrotate_t)
domain_getattr_all_entry_files(logrotate_t)
files_read_usr_files(logrotate_t)
files_read_etc_files(logrotate_t)
@ -88,6 +92,7 @@ files_manage_generic_spool_dirs(logrotate_t)
init_domtrans_script(logrotate_t)
logging_manage_all_logs(logrotate_t)
logging_send_syslog_msg(logrotate_t)
# cjp: why is this needed?
logging_exec_all_logs(logrotate_t)
@ -96,6 +101,8 @@ libs_use_shared_libs(logrotate_t)
miscfiles_read_localization(logrotate_t)
seutil_dontaudit_search_config(logrotate_t)
sysnet_read_config(logrotate_t)
userdom_use_unpriv_users_fd(logrotate_t)
@ -164,18 +171,11 @@ allow logrotate_t {staff_home_dir_t sysadm_home_dir_t}:dir { getattr read search
# Read /proc/PID directories for all domains.
allow logrotate_t domain:notdevfile_class_set r_file_perms;
allow logrotate_t domain:dir r_dir_perms;
allow logrotate_t exec_type:file getattr;
# for /var/lib/logrotate.status and /var/lib/logcheck
file_type_auto_trans(logrotate_t, var_lib_t, logrotate_var_lib_t, file)
# for /var/backups on Debian
ifdef(`backup.te', `
rw_dir_create_file(logrotate_t, backup_store_t)
')
allow logrotate_t syslogd_t:unix_dgram_socket sendto;
allow logrotate_t syslogd_exec_t:file r_file_perms;
dontaudit logrotate_t selinux_config_t:dir search;
') dnl end TODO