rpms/selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Remove excessive permissions in logging_send_syslog_msg(). Ticket #14.

Browse Source
This commit is contained in:
Chris PeBenito 2009-08-26 10:05:36 -04:00
parent e27827b86c
commit fef5dcf3af
2 changed files with 6 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
policy/modules/system/logging.if
View File

@ -438,8 +438,8 @@ interface(`logging_send_syslog_msg',`
type syslogd_t, devlog_t;
')
allow $1 devlog_t:lnk_file read;
allow $1 devlog_t:sock_file rw_sock_file_perms;
allow $1 devlog_t:lnk_file read_lnk_file_perms;
allow $1 devlog_t:sock_file write_sock_file_perms;
# the type of socket depends on the syslog daemon
allow $1 syslogd_t:unix_dgram_socket sendto;
@ -447,8 +447,9 @@ interface(`logging_send_syslog_msg',`
allow $1 self:unix_dgram_socket create_socket_perms;
allow $1 self:unix_stream_socket create_socket_perms;
# cjp: this should most likely be removed:
term_use_console($1)
# If syslog is down, the glibc syslog() function
# will write to the console.
term_write_console($1)
')
########################################

2
policy/modules/system/logging.te
View File

@ -1,5 +1,5 @@
policy_module(logging, 1.14.0)
policy_module(logging, 1.14.1)
########################################
#