Chris PeBenito 29af4c
policy_module(logrotate, 1.13.0)
Chris PeBenito 96ce00
Chris PeBenito 96ce00
########################################
Chris PeBenito 96ce00
#
Chris PeBenito 96ce00
# Declarations
Chris PeBenito 96ce00
#
Chris PeBenito 96ce00
Chris PeBenito 142e9f
type logrotate_t;
Chris PeBenito 96ce00
domain_type(logrotate_t)
Chris PeBenito 1815ba
domain_obj_id_change_exemption(logrotate_t)
Chris PeBenito 1815ba
domain_system_change_exemption(logrotate_t)
Chris PeBenito 96ce00
role system_r types logrotate_t;
Chris PeBenito 96ce00
Chris PeBenito 96ce00
type logrotate_exec_t;
Chris PeBenito 0bfccd
domain_entry_file(logrotate_t, logrotate_exec_t)
Chris PeBenito 96ce00
Chris PeBenito 98a8ea
type logrotate_lock_t;
Chris PeBenito 98a8ea
files_lock_file(logrotate_lock_t)
Chris PeBenito 98a8ea
Chris PeBenito 96ce00
type logrotate_tmp_t;
Chris PeBenito 96ce00
files_tmp_file(logrotate_tmp_t)
Chris PeBenito 96ce00
Chris PeBenito 96ce00
type logrotate_var_lib_t;
Chris PeBenito 8fd367
files_type(logrotate_var_lib_t)
Chris PeBenito 96ce00
Chris PeBenito 96ce00
########################################
Chris PeBenito 96ce00
#
Chris PeBenito 96ce00
# Local policy
Chris PeBenito 96ce00
#
Chris PeBenito 96ce00
Chris PeBenito 96ce00
# Change ownership on log files.
Chris PeBenito 96ce00
allow logrotate_t self:capability { chown dac_override dac_read_search kill fsetid fowner sys_resource sys_nice };
Chris PeBenito 96ce00
# for mailx
Jeremy Solt b8c987
dontaudit logrotate_t self:capability { setuid setgid sys_ptrace };
Chris PeBenito 96ce00
Chris PeBenito 9d3bdc
allow logrotate_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
Chris PeBenito 96ce00
Chris PeBenito 96ce00
# Set a context other than the default one for newly created files.
Chris PeBenito 96ce00
allow logrotate_t self:process setfscreate;
Chris PeBenito 96ce00
Chris PeBenito 96ce00
allow logrotate_t self:fd use;
Chris PeBenito c0868a
allow logrotate_t self:fifo_file rw_fifo_file_perms;
Chris PeBenito 96ce00
allow logrotate_t self:unix_dgram_socket create_socket_perms;
Chris PeBenito 96ce00
allow logrotate_t self:unix_stream_socket create_stream_socket_perms;
Chris PeBenito 96ce00
allow logrotate_t self:unix_dgram_socket sendto;
Chris PeBenito 96ce00
allow logrotate_t self:unix_stream_socket connectto;
Chris PeBenito 96ce00
allow logrotate_t self:shm create_shm_perms;
Chris PeBenito 96ce00
allow logrotate_t self:sem create_sem_perms;
Chris PeBenito 96ce00
allow logrotate_t self:msgq create_msgq_perms;
Chris PeBenito 96ce00
allow logrotate_t self:msg { send receive };
Chris PeBenito 96ce00
Chris PeBenito c0868a
allow logrotate_t logrotate_lock_t:file manage_file_perms;
Chris PeBenito 0bfccd
files_lock_filetrans(logrotate_t, logrotate_lock_t, file)
Chris PeBenito 98a8ea
Chris PeBenito 96ce00
can_exec(logrotate_t, logrotate_tmp_t)
Chris PeBenito 96ce00
Chris PeBenito 0bfccd
manage_dirs_pattern(logrotate_t, logrotate_tmp_t, logrotate_tmp_t)
Chris PeBenito 0bfccd
manage_files_pattern(logrotate_t, logrotate_tmp_t, logrotate_tmp_t)
Chris PeBenito 103fe2
files_tmp_filetrans(logrotate_t, logrotate_tmp_t, { file dir })
Chris PeBenito 96ce00
Chris PeBenito 5a2649
# for /var/lib/logrotate.status and /var/lib/logcheck
Chris PeBenito 0bfccd
create_dirs_pattern(logrotate_t, logrotate_var_lib_t, logrotate_var_lib_t)
Chris PeBenito 0bfccd
manage_files_pattern(logrotate_t, logrotate_var_lib_t, logrotate_var_lib_t)
Chris PeBenito 1c1ac6
files_var_lib_filetrans(logrotate_t, logrotate_var_lib_t, file)
Chris PeBenito 96ce00
Chris PeBenito 96ce00
kernel_read_system_state(logrotate_t)
Chris PeBenito 445522
kernel_read_kernel_sysctls(logrotate_t)
Chris PeBenito 96ce00
Chris PeBenito 96ce00
dev_read_urand(logrotate_t)
Chris PeBenito 96ce00
Chris PeBenito 96ce00
fs_search_auto_mountpoints(logrotate_t)
Chris PeBenito 96ce00
fs_getattr_xattr_fs(logrotate_t)
Chris PeBenito d13f87
fs_list_inotifyfs(logrotate_t)
Chris PeBenito 96ce00
Chris PeBenito f8233a
mls_file_read_all_levels(logrotate_t)
Chris PeBenito f8233a
mls_file_write_all_levels(logrotate_t)
Chris PeBenito bf080a
mls_file_upgrade(logrotate_t)
Chris PeBenito bf080a
Chris PeBenito 96ce00
selinux_get_fs_mount(logrotate_t)
Chris PeBenito a08248
selinux_get_enforce_mode(logrotate_t)
Chris PeBenito 96ce00
Chris PeBenito 96ce00
auth_manage_login_records(logrotate_t)
Chris PeBenito 6dd721
auth_use_nsswitch(logrotate_t)
Chris PeBenito 96ce00
Chris PeBenito 96ce00
# Run helper programs.
Chris PeBenito 96ce00
corecmd_exec_bin(logrotate_t)
Chris PeBenito 96ce00
corecmd_exec_shell(logrotate_t)
Chris PeBenito 96ce00
Chris PeBenito 96ce00
domain_signal_all_domains(logrotate_t)
Chris PeBenito 15722e
domain_use_interactive_fds(logrotate_t)
Chris PeBenito 5a2649
domain_getattr_all_entry_files(logrotate_t)
Chris PeBenito 3774e4
# Read /proc/PID directories for all domains.
Chris PeBenito 3774e4
domain_read_all_domains_state(logrotate_t)
Chris PeBenito 96ce00
Chris PeBenito 96ce00
files_read_usr_files(logrotate_t)
Chris PeBenito 8fd367
files_read_etc_files(logrotate_t)
Chris PeBenito 96ce00
files_read_etc_runtime_files(logrotate_t)
Chris PeBenito 96ce00
files_read_all_pids(logrotate_t)
Chris PeBenito 12c61f
files_search_all(logrotate_t)
Chris PeBenito ff1cae
files_read_var_lib_files(logrotate_t)
Chris PeBenito 96ce00
# Write to /var/spool/slrnpull - should be moved into its own type.
Chris PeBenito 9e04f5
files_manage_generic_spool(logrotate_t)
Chris PeBenito 8fd367
files_manage_generic_spool_dirs(logrotate_t)
Chris PeBenito d13f87
files_getattr_generic_locks(logrotate_t)
Chris PeBenito 96ce00
Chris PeBenito 96ce00
# cjp: why is this needed?
Chris PeBenito 96ce00
init_domtrans_script(logrotate_t)
Chris PeBenito 96ce00
Chris PeBenito 96ce00
logging_manage_all_logs(logrotate_t)
Chris PeBenito 5a2649
logging_send_syslog_msg(logrotate_t)
Jeremy Solt b8c987
logging_send_audit_msgs(logrotate_t)
Chris PeBenito 96ce00
# cjp: why is this needed?
Chris PeBenito 96ce00
logging_exec_all_logs(logrotate_t)
Chris PeBenito 96ce00
Chris PeBenito 96ce00
miscfiles_read_localization(logrotate_t)
Chris PeBenito 96ce00
Chris PeBenito a08248
seutil_dontaudit_read_config(logrotate_t)
Chris PeBenito 5a2649
Chris PeBenito 296273
userdom_use_user_terminals(logrotate_t)
Jeremy Solt b8c987
userdom_list_user_home_dirs(logrotate_t)
Chris PeBenito 103fe2
userdom_use_unpriv_users_fds(logrotate_t)
Dan Walsh 3eaa99
userdom_dontaudit_list_admin_dir(logrotate_t)
Chris PeBenito 96ce00
Chris PeBenito 96ce00
cron_system_entry(logrotate_t, logrotate_exec_t)
Chris PeBenito 96ce00
cron_search_spool(logrotate_t)
Chris PeBenito 96ce00
Chris PeBenito 96ce00
mta_send_mail(logrotate_t)
Chris PeBenito 96ce00
Chris PeBenito 96ce00
ifdef(`distro_debian', `
Chris PeBenito 96ce00
	allow logrotate_t logrotate_tmp_t:file { relabelfrom relabelto };
Chris PeBenito 96ce00
	# for savelog
Chris PeBenito 96ce00
	can_exec(logrotate_t, logrotate_exec_t)
Chris PeBenito 1abafe
Chris PeBenito 1abafe
	# for syslogd-listfiles
Chris PeBenito 1abafe
	logging_read_syslog_config(logrotate_t)
Chris PeBenito e40fa6
Chris PeBenito 3f67f7
	# for "test -x /sbin/syslogd"
Chris PeBenito e40fa6
	logging_check_exec_syslog(logrotate_t)
Chris PeBenito 142e9f
')
Chris PeBenito 142e9f
Chris PeBenito bb7170
optional_policy(`
Dan Walsh 2968e0
	abrt_cache_manage(logrotate_t)
Jeremy Solt b8c987
')
Jeremy Solt b8c987
Jeremy Solt b8c987
optional_policy(`
Chris PeBenito 9a66d4
	acct_domtrans(logrotate_t)
Chris PeBenito 9a66d4
	acct_manage_data(logrotate_t)
Chris PeBenito 9a66d4
	acct_exec_data(logrotate_t)
Chris PeBenito 9a66d4
')
Chris PeBenito 9a66d4
Chris PeBenito bb7170
optional_policy(`
Chris PeBenito a996bd
	apache_read_config(logrotate_t)
Chris PeBenito a996bd
	apache_domtrans(logrotate_t)
Chris PeBenito a996bd
	apache_signull(logrotate_t)
Chris PeBenito a996bd
')
Chris PeBenito a996bd
Chris PeBenito bb7170
optional_policy(`
Jeremy Solt b8c987
	asterisk_domtrans(logrotate_t)
Jeremy Solt b8c987
')
Jeremy Solt b8c987
Jeremy Solt b8c987
optional_policy(`
Jeremy Solt b8c987
	bind_manage_cache(logrotate_t)
Jeremy Solt b8c987
')
Jeremy Solt b8c987
Jeremy Solt b8c987
optional_policy(`
Chris PeBenito 96ce00
	consoletype_exec(logrotate_t)
Chris PeBenito 96ce00
')
Chris PeBenito 96ce00
Chris PeBenito bb7170
optional_policy(`
Chris PeBenito 9fd4b8
	cups_domtrans(logrotate_t)
Chris PeBenito 9fd4b8
')
Chris PeBenito 9fd4b8
Chris PeBenito bb7170
optional_policy(`
Jeremy Solt b8c987
	fail2ban_stream_connect(logrotate_t)
Jeremy Solt b8c987
')
Jeremy Solt b8c987
Jeremy Solt b8c987
optional_policy(`
Chris PeBenito 2705f9
	hostname_exec(logrotate_t)
Chris PeBenito 2705f9
')
Chris PeBenito 2705f9
Chris PeBenito bb7170
optional_policy(`
Jeremy Solt b8c987
	icecast_signal(logrotate_t)
Chris PeBenito 84c922
')
Chris PeBenito 84c922
Chris PeBenito bb7170
optional_policy(`
Chris PeBenito 12c61f
	mailman_domtrans(logrotate_t)
Chris PeBenito 799a0b
	mailman_search_data(logrotate_t)
Chris PeBenito 799a0b
	mailman_manage_log(logrotate_t)
Chris PeBenito 799a0b
')
Chris PeBenito 799a0b
Chris PeBenito bb7170
optional_policy(`
Chris PeBenito b6d37e
	munin_read_config(logrotate_t)
Chris PeBenito b6d37e
	munin_stream_connect(logrotate_t)
Chris PeBenito b6d37e
	munin_search_lib(logrotate_t)
Chris PeBenito b6d37e
')
Chris PeBenito b6d37e
Chris PeBenito b6d37e
optional_policy(`
Chris PeBenito 42be7c
	mysql_read_config(logrotate_t)
Chris PeBenito 1815ba
	mysql_search_db(logrotate_t)
Chris PeBenito 42be7c
	mysql_stream_connect(logrotate_t)
Chris PeBenito 42be7c
')
Chris PeBenito 42be7c
Chris PeBenito bb7170
optional_policy(`
Jeremy Solt b8c987
	psad_domtrans(logrotate_t)
Jeremy Solt b8c987
')
Jeremy Solt b8c987
Jeremy Solt b8c987
Jeremy Solt b8c987
optional_policy(`
Jeremy Solt b8c987
	samba_exec_log(logrotate_t)
Jeremy Solt b8c987
')
Jeremy Solt b8c987
Jeremy Solt b8c987
optional_policy(`
Jeremy Solt b8c987
	sssd_domtrans(logrotate_t)
Jeremy Solt b8c987
')
Jeremy Solt b8c987
Jeremy Solt b8c987
optional_policy(`
Chris PeBenito 1d427a
	slrnpull_manage_spool(logrotate_t)
Chris PeBenito 1d427a
')
Chris PeBenito 1d427a
Chris PeBenito bb7170
optional_policy(`
Chris PeBenito 153fe2
	squid_domtrans(logrotate_t)
Chris PeBenito 0f707d
')
Chris PeBenito adea58
Chris PeBenito adea58
optional_policy(`
Jeremy Solt b8c987
	#Red Hat bug 564565
Jeremy Solt b8c987
	su_exec(logrotate_t)
Jeremy Solt b8c987
')
Jeremy Solt b8c987
Jeremy Solt b8c987
optional_policy(`
Chris PeBenito adea58
	varnishd_manage_log(logrotate_t)
Chris PeBenito adea58
')