82 lines
2.0 KiB
Plaintext
82 lines
2.0 KiB
Plaintext
attribute logfile;
|
|
|
|
type devlog_t;
|
|
files_make_file(devlog_t)
|
|
|
|
type klogd_t;
|
|
domain_make_domain(klogd_t)
|
|
role system_r types klogd_t;
|
|
|
|
type klogd_exec_t;
|
|
domain_make_entrypoint_file(klogd_t,klogd_exec_t)
|
|
|
|
type klogd_tmp_t;
|
|
files_make_file(klogd_tmp_t)
|
|
|
|
type klogd_var_run_t;
|
|
files_make_file(klogd_var_run_t)
|
|
|
|
type syslogd_t;
|
|
domain_make_domain(syslogd_t)
|
|
role system_r types syslogd_t;
|
|
|
|
type syslogd_exec_t;
|
|
domain_make_entrypoint_file(syslogd_t,syslogd_exec_t)
|
|
|
|
type syslogd_tmp_t;
|
|
files_make_file(syslogd_tmp_t)
|
|
|
|
type syslogd_var_run_t;
|
|
files_make_file(syslogd_var_run_t)
|
|
|
|
type var_log_t, logfile;
|
|
files_make_file(var_log_t)
|
|
|
|
########################################
|
|
#
|
|
# klogd local policy
|
|
#
|
|
|
|
allow klogd_t klogd_tmp_t:file { getattr create read write append setattr unlink };
|
|
allow klogd_t klogd_var_run_t:file { getattr create read write append setattr unlink };
|
|
|
|
allow klogd_t self:capability sys_admin;
|
|
dontaudit klogd_t self:capability sys_resource;
|
|
|
|
kernel_read_system_state(klogd_t)
|
|
|
|
libraries_use_dynamic_loader(klogd_t)
|
|
libraries_read_shared_libraries(klogd_t)
|
|
|
|
files_create_daemon_runtime_data(klogd_t,klogd_var_run_t)
|
|
files_create_private_tmp_data(klogd_t,klogd_tmp_t)
|
|
|
|
# read /etc/nsswitch.conf
|
|
files_read_general_system_config(klogd_t)
|
|
|
|
files_read_runtime_system_config(klogd_t)
|
|
miscfiles_read_localization(klogd_t)
|
|
|
|
logging_send_system_log_message(klogd_t)
|
|
|
|
# Read /proc/kmsg and /dev/mem.
|
|
kernel_read_kernel_messages(klogd_t)
|
|
devices_raw_read_memory(klogd_t)
|
|
|
|
# Control syslog and console logging
|
|
kernel_clear_ring_buffer(klogd_t)
|
|
kernel_change_ring_buffer_level(klogd_t)
|
|
|
|
bootloader_read_kernel_symbol_table(klogd_t)
|
|
|
|
########################################
|
|
#
|
|
# syslogd local policy
|
|
#
|
|
files_create_daemon_runtime_data(syslogd_t,syslogd_var_run_t)
|
|
files_create_private_tmp_data(syslogd_t,syslogd_tmp_t)
|
|
devices_create_dev_entry(syslogd_t,devlog_t,sock_file)
|
|
|
|
allow syslogd_t syslogd_tmp_t:file { getattr create read write append setattr unlink };
|
|
allow syslogd_t syslogd_var_run_t:file { getattr create read write append setattr unlink };
|