add logrotate, more low-hanging fruit

refpolicy/policy/constraints

@@ -37,9 +37,10 @@ constrain process transition
 ifdef(`crond.te', `
          or (t1 == crond_t and (t2 == user_crond_domain or u2 == system_u))
 ')
-ifdef(`TODO',`
 ifdef(`userhelper.te', 
-	`or (t1 == userhelperdomain)')
+	`or (t1 == userhelperdomain)
+')
+ifdef(`TODO',`
 	 or (t1 == priv_system_role and u2 == system_u )
 ') dnl end TODO
         );
@@ -52,13 +53,15 @@ constrain process transition
 ifdef(`crond.te', `
          or (t1 == crond_t and t2 == user_crond_domain)
 ')
-ifdef(`TODO',`
 ifdef(`userhelper.te', 
-	`or (t1 == userhelperdomain)')
+	`or (t1 == userhelperdomain)
+')
 ifdef(`postfix.te', `
 ifdef(`direct_sysadm_daemon',
-	`or (t1 == sysadm_mail_t and t2 == system_mail_t and r2 == system_r )')
+	`or (t1 == sysadm_mail_t and t2 == system_mail_t and r2 == system_r )
 ')
+')
+ifdef(`TODO',`
 	 or (t1 == priv_system_role and r2 == system_r )
 ') dnl end TODO
         );

refpolicy/policy/modules/admin/consoletype.te

@@ -59,6 +59,10 @@ optional_policy(`authlogin.te', `
 	auth_read_pam_pid(consoletype_t)
 ')
 
+optional_policy(`logrotate.te',`
+	logrotate_dontaudit_use_fd(consoletype_t)
+')
+
 optional_policy(`nis.te',`
 	nis_use_ypbind(consoletype_t)
 ')

refpolicy/policy/modules/admin/logrotate.fc

@@ -0,0 +1,16 @@
+/etc/cron\.(daily|weekly)/sysklogd -- system_u:object_r:logrotate_exec_t
+
+/usr/sbin/logcheck	--	system_u:object_r:logrotate_exec_t
+/usr/sbin/logrotate	--	system_u:object_r:logrotate_exec_t
+
+/var/lib/logcheck(/.*)?		system_u:object_r:logrotate_var_lib_t
+
+# using a hard-coded name under /var/tmp is a bug - new version fixes it
+/var/tmp/logcheck	-d	system_u:object_r:logrotate_tmp_t
+
+ifdef(`distro_debian', `
+/usr/bin/savelog	--	system_u:object_r:logrotate_exec_t
+/var/lib/logrotate(/.*)?	system_u:object_r:logrotate_var_lib_t
+', `
+/var/lib/logrotate\.status --	system_u:object_r:logrotate_var_lib_t
+')

refpolicy/policy/modules/admin/logrotate.if

@@ -0,0 +1,84 @@
+## <summary>Rotate and archive system logs</summary>
+
+########################################
+## <summary>
+##	Execute logrotate in the logrotate domain.
+## </summary>
+## <param name="domain">
+##	The type of the process performing this action.
+## </param>
+#
+interface(`logrotate_domtrans',`
+	gen_require(`
+		type logrotate_t, logrotate_exec_t;
+		class process sigchld;
+		class fd use;
+		class fifo_file rw_file_perms;
+	')
+
+	domain_auto_trans($1,logrotate_exec_t,logrotate_t)
+
+	allow $1 logrotate_t:fd use;
+	allow logrotate_t $1:fd use;
+	allow logrotate_t $1:fifo_file rw_file_perms;
+	allow logrotate_t $1:process sigchld;
+')
+
+########################################
+## <summary>
+##	Execute logrotate in the logrotate domain, and
+##	allow the specified role the logrotate domain.
+## </summary>
+## <param name="domain">
+##	The type of the process performing this action.
+## </param>
+## <param name="role">
+##	The role to be allowed the logrotate domain.
+## </param>
+## <param name="terminal">
+##	The type of the terminal allow the logrotate domain to use.
+## </param>
+#
+interface(`logrotate_run',`
+	gen_require(`
+		type logrotate_t;
+		class chr_file rw_term_perms;
+	')
+
+	logrotate_domtrans($1)
+	role $2 types logrotate_t;
+	allow logrotate_t $3:chr_file rw_term_perms;
+')
+
+########################################
+## <summary>
+##	Execute logrotate in the caller domain.
+## </summary>
+## <param name="domain">
+##	The type of the process performing this action.
+## </param>
+#
+interface(`logrotate_exec',`
+	gen_require(`
+		type logrotate_exec_t;
+	')
+
+	can_exec($1,logrotate_exec_t)
+')
+
+########################################
+## <summary>
+##	Do not audit attempts to inherit logrotate file descriptors.
+## </summary>
+## <param name="domain">
+##	The type of the process to not audit.
+## </param>
+#
+interface(`logrotate_dontaudit_use_fd',`
+	gen_require(`
+		type logrotate_t;
+		class fd;
+	')
+
+	dontaudit $1 logrotate_t:fd use;
+')

refpolicy/policy/modules/admin/logrotate.te

@@ -0,0 +1,163 @@
+
+policy_module(logrotate,1.0)
+
+########################################
+#
+# Declarations
+#
+
+type logrotate_t; #, priv_system_role, nscd_client_domain;
+domain_type(logrotate_t)
+domain_obj_id_change_exempt(logrotate_t)
+role system_r types logrotate_t;
+
+type logrotate_exec_t;
+files_file_type(logrotate_exec_t)
+
+type logrotate_tmp_t;
+files_tmp_file(logrotate_tmp_t)
+
+type logrotate_var_lib_t;
+files_file_type(logrotate_var_lib_t)
+
+########################################
+#
+# Local policy
+#
+
+# Change ownership on log files.
+allow logrotate_t self:capability { chown dac_override dac_read_search kill fsetid fowner sys_resource sys_nice };
+# for mailx
+dontaudit logrotate_t self:capability { setuid setgid };
+
+allow logrotate_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem dyntransition };
+
+# Set a context other than the default one for newly created files.
+allow logrotate_t self:process setfscreate;
+
+allow logrotate_t self:fd use;
+allow logrotate_t self:fifo_file rw_file_perms;
+allow logrotate_t self:unix_dgram_socket create_socket_perms;
+allow logrotate_t self:unix_stream_socket create_stream_socket_perms;
+allow logrotate_t self:unix_dgram_socket sendto;
+allow logrotate_t self:unix_stream_socket connectto;
+allow logrotate_t self:shm create_shm_perms;
+allow logrotate_t self:sem create_sem_perms;
+allow logrotate_t self:msgq create_msgq_perms;
+allow logrotate_t self:msg { send receive };
+
+can_exec(logrotate_t, logrotate_tmp_t)
+
+allow logrotate_t logrotate_tmp_t:dir create_dir_perms;
+allow logrotate_t logrotate_tmp_t:file create_file_perms;
+files_create_tmp_files(logrotate_t, logrotate_tmp_t, { file dir })
+
+allow logrotate_t logrotate_var_lib_t:dir { create rw_dir_perms };
+
+kernel_read_system_state(logrotate_t)
+kernel_read_kernel_sysctl(logrotate_t)
+
+dev_read_urand(logrotate_t)
+
+fs_search_auto_mountpoints(logrotate_t)
+fs_getattr_xattr_fs(logrotate_t)
+
+selinux_get_fs_mount(logrotate_t)
+
+auth_manage_login_records(logrotate_t)
+
+# Run helper programs.
+corecmd_exec_bin(logrotate_t)
+corecmd_exec_sbin(logrotate_t)
+corecmd_exec_shell(logrotate_t)
+corecmd_exec_ls(logrotate_t)
+
+domain_signal_all_domains(logrotate_t)
+domain_use_wide_inherit_fd(logrotate_t)
+
+files_read_usr_files(logrotate_t)
+files_read_generic_etc_files(logrotate_t)
+files_read_etc_runtime_files(logrotate_t)
+files_manage_generic_lock_files(logrotate_t)
+files_read_all_pids(logrotate_t)
+# Write to /var/spool/slrnpull - should be moved into its own type.
+files_manage_spools(logrotate_t)
+files_manage_spool_dirs(logrotate_t)
+
+hostname_exec(logrotate_t)
+
+# cjp: why is this needed?
+init_domtrans_script(logrotate_t)
+
+logging_manage_all_logs(logrotate_t)
+# cjp: why is this needed?
+logging_exec_all_logs(logrotate_t)
+
+libs_use_ld_so(logrotate_t)
+libs_use_shared_libs(logrotate_t)
+
+miscfiles_read_localization(logrotate_t)
+
+sysnet_read_config(logrotate_t)
+
+userdom_use_unpriv_users_fd(logrotate_t)
+
+cron_system_entry(logrotate_t, logrotate_exec_t)
+cron_search_spool(logrotate_t)
+
+mta_send_mail(logrotate_t)
+
+ifdef(`distro_debian', `
+	allow logrotate_t logrotate_tmp_t:file { relabelfrom relabelto };
+	# for savelog
+	can_exec(logrotate_t, logrotate_exec_t)
+')
+
+optional_policy(`consoletype.te',`
+	consoletype_exec(logrotate_t)
+
+')
+
+optional_policy(`nis.te',`
+	nis_use_ypbind(logrotate_t)
+')
+
+ifdef(`TODO',`
+
+#from privmail this needs more work:
+allow mta_user_agent logrotate_t:fd use;
+allow mta_user_agent logrotate_t:process sigchld;
+allow mta_user_agent logrotate_t:fifo_file { read write };
+
+ifdef(`gnome-pty-helper.te', `allow logrotate_t sysadm_gph_t:fd use;')
+
+# it should not require this
+allow logrotate_t {staff_home_dir_t sysadm_home_dir_t}:dir { getattr read search };
+
+# Read /proc/PID directories for all domains.
+allow logrotate_t domain:notdevfile_class_set r_file_perms;
+allow logrotate_t domain:dir r_dir_perms;
+allow logrotate_t exec_type:file getattr;
+
+#this should go to squid:
+ifdef(`squid.te', `
+allow squid_t { system_crond_t crond_t }:fd use;
+allow squid_t crond_t:fifo_file { read write };
+allow squid_t system_crond_t:fifo_file write;
+allow squid_t self:capability kill;
+')
+
+# for /var/lib/logrotate.status and /var/lib/logcheck
+file_type_auto_trans(logrotate_t, var_lib_t, logrotate_var_lib_t, file)
+
+allow crond_t logrotate_var_lib_t:dir search;
+
+# for /var/backups on Debian
+ifdef(`backup.te', `
+rw_dir_create_file(logrotate_t, backup_store_t)
+')
+
+allow logrotate_t syslogd_t:unix_dgram_socket sendto;
+
+dontaudit logrotate_t selinux_config_t:dir search;
+') dnl end TODO

refpolicy/policy/modules/services/cron.if

@@ -309,6 +309,7 @@ interface(`cron_system_entry',`
 ## <param name="domain">
 ##	The type of the process to performing this action.
 ## </param>
+#
 interface(`cron_rw_log',`
 	gen_require(`
 		type crond_log_t;
@@ -318,3 +319,21 @@ interface(`cron_rw_log',`
 	logging_search_logs($1)
 	allow $1 crond_log_t:file rw_file_perms;
 ')
+
+########################################
+## <summary>
+##	Search the directory containing user cron tables.
+## </summary>
+## <param name="domain">
+##	The type of the process to performing this action.
+## </param>
+#
+interface(`cron_search_spool',`
+	gen_require(`
+		type cron_spool_t;
+		class dir search;
+	')
+
+	files_search_spool($1)
+	allow $1 cron_spool_t:dir search;
+')

refpolicy/policy/modules/services/mta.te

@@ -222,4 +222,8 @@ allow system_mail_t system_crond_tmp_t:file r_file_perms;
 allow mta_user_agent system_crond_tmp_t:file r_file_perms;
 ')
 
+optional_policy(`logrotate.te', `
+	allow { system_mail_t mta_user_agent } logrotate_tmp_t:file r_file_perms;
+')
+
 ') dnl end TODO

refpolicy/policy/modules/system/authlogin.if

@@ -640,3 +640,16 @@ interface(`auth_rw_login_records',`
 	logging_search_logs($1)
 ')
 
+#######################################
+#
+# auth_manage_login_records(domain)
+#
+interface(`auth_manage_login_records',`
+	gen_require(`
+		type wtmp_t;
+		class file create_file_perms;
+	')
+
+	logging_rw_log_dir($1)
+	allow $1 wtmp_t:file create_file_perms;
+')

refpolicy/policy/modules/system/files.if

@@ -1244,6 +1244,20 @@ interface(`files_list_spool',`
 	allow $1 var_spool_t:dir r_dir_perms;
 ')
 
+########################################
+#
+# files_manage_spool_dirs(domain)
+#
+interface(`files_manage_spool_dirs',`
+	gen_require(`
+		type var_t, var_spool_t;
+		class dir create_dir_perms;
+	')
+
+	allow $1 var_t:dir search;
+	allow $1 var_spool_t:dir create_dir_perms;
+')
+
 ########################################
 #
 # files_read_spools(domain)
@@ -1275,4 +1289,3 @@ interface(`files_manage_spools',`
 	allow $1 var_spool_t:dir rw_dir_perms;
 	allow $1 var_spool_t:file create_file_perms;
 ')
-

refpolicy/policy/modules/system/logging.if

@@ -78,6 +78,24 @@ interface(`logging_search_logs',`
 	allow $1 var_log_t:dir search;
 ')
 
+#######################################
+## <summary>
+##	Read and write the generic log directory (/var/log).
+## </summary>
+## <param name="domain">
+##	The type of the process performing this action.
+## </param>
+#
+interface(`logging_rw_log_dir',`
+	gen_require(`
+		type var_log_t;
+		class dir rw_dir_perms;
+	')
+
+	files_search_var($1)
+	allow $1 var_log_t:dir rw_dir_perms;
+')
+
 #######################################
 #
 # logging_dontaudit_getattr_all_logs(domain)
@@ -125,6 +143,38 @@ interface(`logging_read_all_logs',`
 	allow $1 logfile:file r_file_perms;
 ')
 
+#######################################
+#
+# logging_exec_all_logs(domain)
+#
+interface(`logging_exec_all_logs',`
+	gen_require(`
+		attribute logfile;
+		class dir r_dir_perms;
+	')
+
+	files_search_var($1)
+	allow $1 logfile:dir r_dir_perms;
+	can_exec($1,logfile)
+')
+
+#######################################
+#
+# logging_manage_all_logs(domain)
+#
+interface(`logging_manage_all_logs',`
+	gen_require(`
+		attribute logfile;
+		class dir rw_dir_perms;
+		class file create_file_perms;
+	')
+
+	files_search_var($1)
+	allow $1 logfile:dir rw_dir_perms;
+	allow $1 logfile:lnk_file read;
+	allow $1 logfile:file create_file_perms;
+')
+
 #######################################
 #
 # logging_read_generic_logs(domain)
@@ -172,4 +222,3 @@ interface(`logging_rw_generic_logs',`
 	allow $1 var_log_t:dir r_dir_perms;
 	allow $1 var_log_t:file rw_file_perms;
 ')
-

refpolicy/policy/modules/system/userdomain.te

@@ -110,6 +110,10 @@ optional_policy(`modutils.te',`
 	modutils_run_update_mods(sysadm_t,sysadm_r,admin_terminal)
 ')
 
+optional_policy(`logrotate.te',`
+	logrotate_run(sysadm_t,sysadm_r,admin_terminal)
+')
+
 optional_policy(`mount.te',`
 	mount_run(sysadm_t,sysadm_r,admin_terminal)
 ')