## Policy for the kernel message logger and system logging daemon. ######################################## ## ## Make the specified type usable for log files ## in a filesystem. ## ## ##

## Make the specified type usable for log files in a filesystem. ## This will also make the type usable for files, making ## calls to files_type() redundant. Failure to use this interface ## for a log file type may result in problems with log ## rotation, log analysis, and log monitoring programs. ##

##

## Related interfaces: ##

## ##

## Example usage with a domain that can create ## and append to a private log file stored in the ## general directories (e.g., /var/log): ##

##

## type mylogfile_t; ## logging_log_file(mylogfile_t) ## allow mydomain_t mylogfile_t:file { create_file_perms append_file_perms }; ## logging_log_filetrans(mydomain_t, mylogfile_t, file) ##

##
## ## ## Type to be used for files. ## ## ## # interface(`logging_log_file',` gen_require(` attribute logfile; ') files_type($1) files_associate_tmp($1) fs_associate_tmpfs($1) typeattribute $1 logfile; ') ####################################### ## ## Send audit messages. ## ## ## ## Domain allowed access. ## ## # interface(`logging_send_audit_msgs',` allow $1 self:capability audit_write; allow $1 self:netlink_audit_socket { r_netlink_socket_perms nlmsg_relay }; ') ####################################### ## ## dontaudit attempts to send audit messages. ## ## ## ## Domain to not audit. ## ## # interface(`logging_dontaudit_send_audit_msgs',` dontaudit $1 self:capability audit_write; dontaudit $1 self:netlink_audit_socket { r_netlink_socket_perms nlmsg_relay }; ') ######################################## ## ## Set login uid ## ## ## ## Domain allowed access. ## ## # interface(`logging_set_loginuid',` allow $1 self:capability audit_control; allow $1 self:netlink_audit_socket { r_netlink_socket_perms nlmsg_relay }; ') ######################################## ## ## Set tty auditing ## ## ## ## Domain allowed access. ## ## # interface(`logging_set_tty_audit',` allow $1 self:netlink_audit_socket { r_netlink_socket_perms nlmsg_tty_audit }; ') ######################################## ## ## Set up audit ## ## ## ## Domain allowed access. ## ## # interface(`logging_set_audit_parameters',` allow $1 self:capability { audit_write audit_control }; allow $1 self:netlink_audit_socket { create_netlink_socket_perms nlmsg_relay }; ') ######################################## ## ## Read the audit log. ## ## ## ## Domain allowed access. ## ## ## # interface(`logging_read_audit_log',` gen_require(` type auditd_log_t; ') files_search_var($1) read_files_pattern($1, auditd_log_t, auditd_log_t) allow $1 auditd_log_t:dir list_dir_perms; ') ######################################## ## ## Execute auditctl in the auditctl domain. ## ## ## ## Domain allowed to transition. ## ## # interface(`logging_domtrans_auditctl',` gen_require(` type auditctl_t, auditctl_exec_t; ') domtrans_pattern($1, auditctl_exec_t, auditctl_t) ') ######################################## ## ## Execute auditctl in the auditctl domain, and ## allow the specified role the auditctl domain. ## ## ## ## Domain allowed to transition. ## ## ## ## ## Role allowed access. ## ## ## # interface(`logging_run_auditctl',` gen_require(` type auditctl_t; ') logging_domtrans_auditctl($1) role $2 types auditctl_t; ') ######################################## ## ## Execute auditd in the auditd domain. ## ## ## ## Domain allowed to transition. ## ## # interface(`logging_domtrans_auditd',` gen_require(` type auditd_t, auditd_exec_t; ') domtrans_pattern($1, auditd_exec_t, auditd_t) ') ######################################## ## ## Execute auditd in the auditd domain, and ## allow the specified role the auditd domain. ## ## ## ## Domain allowed to transition. ## ## ## ## ## Role allowed access. ## ## # interface(`logging_run_auditd',` gen_require(` type auditd_t; ') logging_domtrans_auditd($1) role $2 types auditd_t; ') ######################################## ## ## Connect to auditdstored over an unix stream socket. ## ## ## ## Domain allowed access. ## ## # interface(`logging_stream_connect_auditd',` refpolicywarn(`$0($*) has been deprecated, logging_stream_connect_dispatcher() should be used instead.') logging_stream_connect_dispatcher($1) ') ######################################## ## ## Execute a domain transition to run the audit dispatcher. ## ## ## ## Domain allowed to transition. ## ## # interface(`logging_domtrans_dispatcher',` gen_require(` type audisp_t, audisp_exec_t; ') domtrans_pattern($1, audisp_exec_t, audisp_t) ') ######################################## ## ## Signal the audit dispatcher. ## ## ## ## Domain allowed access. ## ## # interface(`logging_signal_dispatcher',` gen_require(` type audisp_t; ') allow $1 audisp_t:process signal; ') ######################################## ## ## Create a domain for processes ## which can be started by the system audit dispatcher ## ## ## ## Type to be used as a domain. ## ## ## ## ## Type of the program to be used as an entry point to this domain. ## ## # interface(`logging_dispatcher_domain',` gen_require(` type audisp_t; role system_r; ') domain_type($1) domain_entry_file($1, $2) role system_r types $1; domtrans_pattern(audisp_t, $2, $1) allow audisp_t $1:process { sigkill sigstop signull signal }; allow audisp_t $2:file getattr; allow $1 audisp_t:unix_stream_socket rw_socket_perms; ') ######################################## ## ## Connect to the audit dispatcher over an unix stream socket. ## ## ## ## Domain allowed access. ## ## # interface(`logging_stream_connect_dispatcher',` gen_require(` type audisp_t, audisp_var_run_t; ') files_search_pids($1) stream_connect_pattern($1, audisp_var_run_t, audisp_var_run_t, audisp_t) ') ######################################## ## ## Manage the auditd configuration files. ## ## ## ## Domain allowed access. ## ## ## # interface(`logging_manage_audit_config',` gen_require(` type auditd_etc_t; ') files_search_etc($1) manage_files_pattern($1, auditd_etc_t, auditd_etc_t) ') ######################################## ## ## Manage the audit log. ## ## ## ## Domain allowed access. ## ## ## # interface(`logging_manage_audit_log',` gen_require(` type auditd_log_t; ') files_search_var($1) manage_dirs_pattern($1, auditd_log_t, auditd_log_t) manage_files_pattern($1, auditd_log_t, auditd_log_t) ') ######################################## ## ## Execute klogd in the klog domain. ## ## ## ## Domain allowed to transition. ## ## # interface(`logging_domtrans_klog',` gen_require(` type klogd_t, klogd_exec_t; ') corecmd_search_bin($1) domtrans_pattern($1, klogd_exec_t, klogd_t) ') ######################################## ## ## Check if syslogd is executable. ## ## ## ## Domain allowed access. ## ## # interface(`logging_check_exec_syslog',` gen_require(` type syslogd_exec_t; ') corecmd_list_bin($1) corecmd_read_bin_symlinks($1) allow $1 syslogd_exec_t:file execute; ') ######################################## ## ## Execute syslogd in the syslog domain. ## ## ## ## Domain allowed to transition. ## ## # interface(`logging_domtrans_syslog',` gen_require(` type syslogd_t, syslogd_exec_t; ') corecmd_search_bin($1) domtrans_pattern($1, syslogd_exec_t, syslogd_t) ') ######################################## ## ## Create an object in the log directory, with a private type. ## ## ##

## Allow the specified domain to create an object ## in the general system log directories (e.g., /var/log) ## with a private type. Typically this is used for creating ## private log files in /var/log with the private type instead ## of the general system log type. To accomplish this goal, ## either the program must be SELinux-aware, or use this interface. ##

##

## Related interfaces: ##

##
    ##
  • logging_log_file()
  • ##
##

## Example usage with a domain that can create ## and append to a private log file stored in the ## general directories (e.g., /var/log): ##

##

## type mylogfile_t; ## logging_log_file(mylogfile_t) ## allow mydomain_t mylogfile_t:file { create_file_perms append_file_perms }; ## logging_log_filetrans(mydomain_t, mylogfile_t, file) ##

##
## ## ## Domain allowed access. ## ## ## ## ## The type of the object to be created. ## ## ## ## ## The object class of the object being created. ## ## ## # interface(`logging_log_filetrans',` gen_require(` type var_log_t; ') files_search_var($1) filetrans_pattern($1, var_log_t, $2, $3) ') ######################################## ## ## Send system log messages. ## ## ##

## Allow the specified domain to connect to the ## system log service (syslog), to send messages be added to ## the system logs. Typically this is used by services ## that do not have their own log file in /var/log. ##

##

## This does not allow messages to be sent to ## the auditing system. ##

##

## Programs which use the libc function syslog() will ## require this access. ##

##

## Related interfaces: ##

##
    ##
  • logging_send_audit_msgs()
  • ##
##
## ## ## Domain allowed access. ## ## # interface(`logging_send_syslog_msg',` gen_require(` type syslogd_t, devlog_t; ') allow $1 devlog_t:lnk_file read_lnk_file_perms; allow $1 devlog_t:sock_file write_sock_file_perms; # the type of socket depends on the syslog daemon allow $1 syslogd_t:unix_dgram_socket sendto; allow $1 syslogd_t:unix_stream_socket connectto; allow $1 self:unix_dgram_socket create_socket_perms; allow $1 self:unix_stream_socket create_socket_perms; # If syslog is down, the glibc syslog() function # will write to the console. term_write_console($1) term_dontaudit_read_console($1) ') ######################################## ## ## Read the auditd configuration files. ## ## ## ## Domain allowed access. ## ## ## # interface(`logging_read_audit_config',` gen_require(` type auditd_etc_t; ') files_search_etc($1) read_files_pattern($1, auditd_etc_t, auditd_etc_t) allow $1 auditd_etc_t:dir list_dir_perms; ') ######################################## ## ## dontaudit search of auditd configuration files. ## ## ## ## Domain to not audit. ## ## ## # interface(`logging_dontaudit_search_audit_config',` gen_require(` type auditd_etc_t; ') dontaudit $1 auditd_etc_t:dir search_dir_perms; ') ######################################## ## ## Read syslog configuration files. ## ## ## ## Domain allowed access. ## ## ## # interface(`logging_read_syslog_config',` gen_require(` type syslog_conf_t; ') allow $1 syslog_conf_t:file read_file_perms; ') ######################################## ## ## Allows the domain to open a file in the ## log directory, but does not allow the listing ## of the contents of the log directory. ## ## ## ## Domain allowed access. ## ## # interface(`logging_search_logs',` gen_require(` type var_log_t; ') files_search_var($1) allow $1 var_log_t:dir search_dir_perms; ') ####################################### ## ## Do not audit attempts to search the var log directory. ## ## ## ## Domain not to audit. ## ## # interface(`logging_dontaudit_search_logs',` gen_require(` type var_log_t; ') dontaudit $1 var_log_t:dir search_dir_perms; ') ####################################### ## ## List the contents of the generic log directory (/var/log). ## ## ## ## Domain allowed access. ## ## # interface(`logging_list_logs',` gen_require(` type var_log_t; ') files_search_var($1) allow $1 var_log_t:dir list_dir_perms; ') ####################################### ## ## Read and write the generic log directory (/var/log). ## ## ## ## Domain allowed access. ## ## # interface(`logging_rw_generic_log_dirs',` gen_require(` type var_log_t; ') files_search_var($1) allow $1 var_log_t:dir rw_dir_perms; ') ######################################## ## ## Do not audit attempts to get the atttributes ## of any log files. ## ## ## ## Domain to not audit. ## ## # interface(`logging_dontaudit_getattr_all_logs',` gen_require(` attribute logfile; ') dontaudit $1 logfile:file getattr; ') ######################################## ## ## Append to all log files. ## ## ## ## Domain allowed access. ## ## # interface(`logging_append_all_logs',` gen_require(` attribute logfile; type var_log_t; ') files_search_var($1) append_files_pattern($1, var_log_t, logfile) ') ######################################## ## ## Read all log files. ## ## ## ## Domain allowed access. ## ## ## # interface(`logging_read_all_logs',` gen_require(` attribute logfile; ') files_search_var($1) allow $1 logfile:dir list_dir_perms; read_files_pattern($1, logfile, logfile) ') ######################################## ## ## Execute all log files in the caller domain. ## ## ## ## Domain allowed access. ## ## # # cjp: not sure why this is needed. This was added # because of logrotate. interface(`logging_exec_all_logs',` gen_require(` attribute logfile; ') files_search_var($1) allow $1 logfile:dir list_dir_perms; can_exec($1, logfile) ') ######################################## ## ## read/write to all log files. ## ## ## ## Domain allowed access. ## ## # interface(`logging_rw_all_logs',` gen_require(` attribute logfile; ') files_search_var($1) rw_files_pattern($1, logfile, logfile) ') ######################################## ## ## Create, read, write, and delete all log files. ## ## ## ## Domain allowed access. ## ## ## # interface(`logging_manage_all_logs',` gen_require(` attribute logfile; ') files_search_var($1) manage_files_pattern($1, logfile, logfile) read_lnk_files_pattern($1, logfile, logfile) ') ######################################## ## ## Read generic log files. ## ## ## ## Domain allowed access. ## ## ## # interface(`logging_read_generic_logs',` gen_require(` type var_log_t; ') files_search_var($1) allow $1 var_log_t:dir list_dir_perms; read_files_pattern($1, var_log_t, var_log_t) ') ######################################## ## ## Write generic log files. ## ## ## ## Domain allowed access. ## ## # interface(`logging_write_generic_logs',` gen_require(` type var_log_t; ') files_search_var($1) allow $1 var_log_t:dir list_dir_perms; write_files_pattern($1, var_log_t, var_log_t) ') ######################################## ## ## Dontaudit Write generic log files. ## ## ## ## Domain to not audit. ## ## # interface(`logging_dontaudit_write_generic_logs',` gen_require(` type var_log_t; ') dontaudit $1 var_log_t:file write; ') ######################################## ## ## Read and write generic log files. ## ## ## ## Domain allowed access. ## ## # interface(`logging_rw_generic_logs',` gen_require(` type var_log_t; ') files_search_var($1) allow $1 var_log_t:dir list_dir_perms; rw_files_pattern($1, var_log_t, var_log_t) ') ######################################## ## ## Create, read, write, and delete ## generic log files. ## ## ## ## Domain allowed access. ## ## ## # interface(`logging_manage_generic_logs',` gen_require(` type var_log_t; ') files_search_var($1) manage_files_pattern($1, var_log_t, var_log_t) ') ######################################## ## ## All of the rules required to administrate ## the audit environment ## ## ## ## Domain allowed access. ## ## ## ## ## User role allowed access. ## ## ## # interface(`logging_admin_audit',` gen_require(` type auditd_t, auditd_etc_t, auditd_log_t; type auditd_var_run_t; type auditd_initrc_exec_t; ') allow $1 auditd_t:process { ptrace signal_perms }; ps_process_pattern($1, auditd_t) manage_dirs_pattern($1, auditd_etc_t, auditd_etc_t) manage_files_pattern($1, auditd_etc_t, auditd_etc_t) manage_dirs_pattern($1, auditd_log_t, auditd_log_t) manage_files_pattern($1, auditd_log_t, auditd_log_t) manage_dirs_pattern($1, auditd_var_run_t, auditd_var_run_t) manage_files_pattern($1, auditd_var_run_t, auditd_var_run_t) logging_run_auditctl($1, $2) init_labeled_script_domtrans($1, auditd_initrc_exec_t) domain_system_change_exemption($1) role_transition $2 auditd_initrc_exec_t system_r; allow $2 system_r; ') ######################################## ## ## All of the rules required to administrate ## the syslog environment ## ## ## ## Domain allowed access. ## ## ## ## ## User role allowed access. ## ## ## # interface(`logging_admin_syslog',` gen_require(` type syslogd_t, klogd_t, syslog_conf_t; type syslogd_tmp_t, syslogd_var_lib_t; type syslogd_var_run_t, klogd_var_run_t; type klogd_tmp_t, var_log_t; type syslogd_initrc_exec_t; ') allow $1 syslogd_t:process { ptrace signal_perms }; allow $1 klogd_t:process { ptrace signal_perms }; ps_process_pattern($1, syslogd_t) ps_process_pattern($1, klogd_t) manage_dirs_pattern($1, klogd_var_run_t, klogd_var_run_t) manage_files_pattern($1, klogd_var_run_t, klogd_var_run_t) manage_dirs_pattern($1, klogd_tmp_t, klogd_tmp_t) manage_files_pattern($1, klogd_tmp_t, klogd_tmp_t) manage_dirs_pattern($1, syslogd_tmp_t, syslogd_tmp_t) manage_files_pattern($1, syslogd_tmp_t, syslogd_tmp_t) manage_dirs_pattern($1, syslog_conf_t, syslog_conf_t) manage_files_pattern($1, syslog_conf_t, syslog_conf_t) files_etc_filetrans($1, syslog_conf_t, file) manage_dirs_pattern($1, syslogd_var_lib_t, syslogd_var_lib_t) manage_files_pattern($1, syslogd_var_lib_t, syslogd_var_lib_t) manage_dirs_pattern($1, syslogd_var_run_t, syslogd_var_run_t) manage_files_pattern($1, syslogd_var_run_t, syslogd_var_run_t) logging_manage_all_logs($1) init_labeled_script_domtrans($1, syslogd_initrc_exec_t) domain_system_change_exemption($1) role_transition $2 syslogd_initrc_exec_t system_r; allow $2 system_r; ') ######################################## ## ## All of the rules required to administrate ## the logging environment ## ## ## ## Domain allowed access. ## ## ## ## ## User role allowed access. ## ## ## # interface(`logging_admin',` logging_admin_audit($1, $2) logging_admin_syslog($1, $2) ')