Chris PeBenito e32d52
## <summary>Policy for the kernel message logger and system logging daemon.</summary>
Chris PeBenito e181fe
Chris PeBenito b4cd15
#######################################
Chris PeBenito cff75c
## <summary>
Chris PeBenito cff75c
##	Make the specified type a file
Chris PeBenito cff75c
##	used for logs.
Chris PeBenito cff75c
## </summary>
Chris PeBenito cff75c
## <param name="file_type">
Chris PeBenito cff75c
##	Type of the file to be used as a log.
Chris PeBenito cff75c
## </param>
Chris PeBenito b4cd15
#
Chris PeBenito 199895
interface(`logging_log_file',`
Chris PeBenito 139520
	gen_require(`
Chris PeBenito 139520
		attribute logfile;
Chris PeBenito 139520
	')
Chris PeBenito 0c73cd
Chris PeBenito 8fd367
	files_type($1)
Chris PeBenito a1fcff
	files_associate_tmp($1)
Chris PeBenito cff75c
	fs_associate_tmpfs($1)
Chris PeBenito 0c73cd
	typeattribute $1 logfile;
Chris PeBenito b4cd15
')
Chris PeBenito b4cd15
Chris PeBenito fb1aee
########################################
Chris PeBenito df00b2
## <summary>
Chris PeBenito bf080a
##	Read the audit log.
Chris PeBenito bf080a
## </summary>
Chris PeBenito bf080a
## <param name="domain">
Chris PeBenito bf080a
##	Domain allowed access.
Chris PeBenito bf080a
## </param>
Chris PeBenito bf080a
#
Chris PeBenito bf080a
interface(`logging_read_audit_log',`
Chris PeBenito bf080a
	gen_require(`
Chris PeBenito bf080a
		type auditd_log_t;
Chris PeBenito bf080a
	')
Chris PeBenito bf080a
Chris PeBenito bf080a
	files_search_var($1)
Chris PeBenito bf080a
	allow $1 auditd_log_t:dir r_dir_perms;
Chris PeBenito bf080a
	allow $1 auditd_log_t:file r_file_perms;
Chris PeBenito bf080a
')
Chris PeBenito bf080a
Chris PeBenito bf080a
########################################
Chris PeBenito bf080a
## <summary>
Chris PeBenito 33acca
##	Execute auditctl in the auditctl domain.
Chris PeBenito 33acca
## </summary>
Chris PeBenito 33acca
## <param name="domain">
Chris PeBenito 33acca
##	Domain allowed access.
Chris PeBenito 33acca
## </param>
Chris PeBenito 33acca
#
Chris PeBenito 33acca
interface(`logging_domtrans_auditctl',`
Chris PeBenito 33acca
	gen_require(`
Chris PeBenito 33acca
		type auditctl_t, auditctl_exec_t;
Chris PeBenito 33acca
	')
Chris PeBenito 33acca
Chris PeBenito 33acca
	domain_auto_trans($1,auditctl_exec_t,auditctl_t)
Chris PeBenito 33acca
Chris PeBenito 33acca
	allow $1 auditctl_t:fd use;
Chris PeBenito 33acca
	allow auditctl_t $1:fd use;
Chris PeBenito 33acca
	allow auditctl_t $1:fifo_file rw_file_perms;
Chris PeBenito 33acca
	allow auditctl_t $1:process sigchld;
Chris PeBenito 33acca
')
Chris PeBenito 33acca
Chris PeBenito 33acca
########################################
Chris PeBenito 33acca
## <summary>
Chris PeBenito df00b2
##	Execute syslogd in the syslog domain.
Chris PeBenito df00b2
## </summary>
Chris PeBenito df00b2
## <param name="domain">
Chris PeBenito df00b2
##	The type of the process performing this action.
Chris PeBenito df00b2
## </param>
Chris PeBenito df00b2
#
Chris PeBenito df00b2
interface(`logging_domtrans_syslog',`
Chris PeBenito df00b2
	gen_require(`
Chris PeBenito df00b2
		type syslogd_t, syslogd_exec_t;
Chris PeBenito df00b2
	')
Chris PeBenito df00b2
Chris PeBenito df00b2
	corecmd_search_sbin($1)
Chris PeBenito df00b2
	domain_auto_trans($1,syslogd_exec_t,syslogd_t)
Chris PeBenito df00b2
Chris PeBenito df00b2
	allow $1 syslogd_t:fd use;
Chris PeBenito df00b2
	allow syslogd_t $1:fd use;
Chris PeBenito df00b2
	allow syslogd_t $1:fifo_file rw_file_perms;
Chris PeBenito df00b2
	allow syslogd_t $1:process sigchld;
Chris PeBenito df00b2
')
Chris PeBenito df00b2
Chris PeBenito df00b2
########################################
Chris PeBenito fb1aee
#
Chris PeBenito 9d5949
# logging_filetrans_log(domain,privatetype,[class(es)])
Chris PeBenito fb1aee
#
Chris PeBenito 9d5949
interface(`logging_filetrans_log',`
Chris PeBenito 139520
	gen_require(`
Chris PeBenito 139520
		type var_log_t;
Chris PeBenito 139520
	')
Chris PeBenito 0c73cd
Chris PeBenito 0c73cd
	allow $1 var_log_t:dir rw_dir_perms;
Chris PeBenito 0c73cd
Chris PeBenito 0c73cd
	ifelse(`$3',`',`
Chris PeBenito 0c73cd
		type_transition $1 var_log_t:file $2;
Chris PeBenito 0c73cd
	',`
Chris PeBenito 0c73cd
		type_transition $1 var_log_t:$3 $2;
Chris PeBenito 0c73cd
	')
Chris PeBenito fb1aee
')
Chris PeBenito fb1aee
Chris PeBenito b4cd15
#######################################
Chris PeBenito b4cd15
#
Chris PeBenito c9428d
# logging_send_syslog_msg(domain)
Chris PeBenito 8c7717
#
Chris PeBenito 199895
interface(`logging_send_syslog_msg',`
Chris PeBenito 139520
	gen_require(`
Chris PeBenito 139520
		type syslogd_t, devlog_t;
Chris PeBenito 139520
	')
Chris PeBenito 0c73cd
Chris PeBenito 0c73cd
	allow $1 devlog_t:lnk_file read;
Chris PeBenito cc41a9
	allow $1 devlog_t:sock_file rw_file_perms;
Chris PeBenito 0c73cd
Chris PeBenito 0c73cd
	# the type of socket depends on the syslog daemon
Chris PeBenito 0c73cd
	allow $1 syslogd_t:unix_dgram_socket sendto;
Chris PeBenito 0c73cd
	allow $1 syslogd_t:unix_stream_socket connectto;
Chris PeBenito cc41a9
	allow $1 self:unix_dgram_socket create_socket_perms;
Chris PeBenito cc41a9
	allow $1 self:unix_stream_socket create_socket_perms;
Chris PeBenito 0c73cd
Chris PeBenito 0c73cd
	# cjp: this should most likely be removed:
Chris PeBenito 0fd9dc
	term_use_console($1)
Chris PeBenito 8c7717
')
Chris PeBenito 8c7717
Chris PeBenito daa0e0
########################################
Chris PeBenito f7ebea
## <summary>
Chris PeBenito 605ba2
##	Read the auditd configuration files.
Chris PeBenito 605ba2
## </summary>
Chris PeBenito 605ba2
## <param name="domain">
Chris PeBenito 605ba2
##	Domain allowed access.
Chris PeBenito 605ba2
## </param>
Chris PeBenito 605ba2
#
Chris PeBenito 605ba2
interface(`logging_read_auditd_config',`
Chris PeBenito 605ba2
	gen_require(`
Chris PeBenito 605ba2
		type auditd_etc_t;
Chris PeBenito 605ba2
	')
Chris PeBenito 605ba2
Chris PeBenito 605ba2
	files_search_etc($1)
Chris PeBenito 605ba2
	allow $1 auditd_etc_t:file r_file_perms;
Chris PeBenito 605ba2
')
Chris PeBenito 605ba2
Chris PeBenito 605ba2
########################################
Chris PeBenito 605ba2
## <summary>
Chris PeBenito 414e41
##	Allows the domain to open a file in the
Chris PeBenito 414e41
##	log directory, but does not allow the listing
Chris PeBenito 414e41
##	of the contents of the log directory.
Chris PeBenito f7ebea
## </summary>
Chris PeBenito 414e41
## <param name="domain">
Chris PeBenito 414e41
##	The type of the process performing this action.
Chris PeBenito 414e41
## </param>
Chris PeBenito 3ce6cb
#
Chris PeBenito 199895
interface(`logging_search_logs',`
Chris PeBenito 139520
	gen_require(`
Chris PeBenito 139520
		type var_log_t;
Chris PeBenito 139520
	')
Chris PeBenito 0c73cd
Chris PeBenito c9428d
	files_search_var($1)
Chris PeBenito 0c73cd
	allow $1 var_log_t:dir search;
Chris PeBenito 3ce6cb
')
Chris PeBenito 3ce6cb
Chris PeBenito 3ce6cb
#######################################
Chris PeBenito 96ce00
## <summary>
Chris PeBenito f33561
##	List the contents of the generic log directory (/var/log).
Chris PeBenito f33561
## </summary>
Chris PeBenito f33561
## <param name="domain">
Chris PeBenito f33561
##	Domain allowed access.
Chris PeBenito f33561
## </param>
Chris PeBenito f33561
#
Chris PeBenito f33561
interface(`logging_list_logs',`
Chris PeBenito f33561
	gen_require(`
Chris PeBenito f33561
		type var_log_t;
Chris PeBenito f33561
	')
Chris PeBenito f33561
Chris PeBenito f33561
	files_search_var($1)
Chris PeBenito f33561
	allow $1 var_log_t:dir r_dir_perms;
Chris PeBenito f33561
')
Chris PeBenito f33561
Chris PeBenito f33561
#######################################
Chris PeBenito f33561
## <summary>
Chris PeBenito 96ce00
##	Read and write the generic log directory (/var/log).
Chris PeBenito 96ce00
## </summary>
Chris PeBenito 96ce00
## <param name="domain">
Chris PeBenito 96ce00
##	The type of the process performing this action.
Chris PeBenito 96ce00
## </param>
Chris PeBenito 96ce00
#
Chris PeBenito 96ce00
interface(`logging_rw_log_dir',`
Chris PeBenito 96ce00
	gen_require(`
Chris PeBenito 96ce00
		type var_log_t;
Chris PeBenito 96ce00
	')
Chris PeBenito 96ce00
Chris PeBenito 96ce00
	files_search_var($1)
Chris PeBenito 96ce00
	allow $1 var_log_t:dir rw_dir_perms;
Chris PeBenito 96ce00
')
Chris PeBenito 96ce00
Chris PeBenito 96ce00
#######################################
Chris PeBenito 3ce6cb
#
Chris PeBenito c9428d
# logging_dontaudit_getattr_all_logs(domain)
Chris PeBenito b16c6b
#
Chris PeBenito 199895
interface(`logging_dontaudit_getattr_all_logs',`
Chris PeBenito 139520
	gen_require(`
Chris PeBenito 139520
		attribute logfile;
Chris PeBenito 139520
	')
Chris PeBenito 0c73cd
Chris PeBenito 0c73cd
	dontaudit $1 logfile:file getattr;
Chris PeBenito b16c6b
')
Chris PeBenito b16c6b
Chris PeBenito b16c6b
#######################################
Chris PeBenito b16c6b
#
Chris PeBenito 3ce6cb
# logging_append_all_logs(domain)
Chris PeBenito b4cd15
#
Chris PeBenito 199895
interface(`logging_append_all_logs',`
Chris PeBenito 139520
	gen_require(`
Chris PeBenito 139520
		attribute logfile;
Chris PeBenito 139520
		type var_log_t;
Chris PeBenito 139520
	')
Chris PeBenito 0c73cd
Chris PeBenito c9428d
	files_search_var($1)
Chris PeBenito cc41a9
	allow $1 var_log_t:dir r_dir_perms;
Chris PeBenito 0c73cd
	allow $1 logfile:file { getattr append };
Chris PeBenito b4cd15
')
Chris PeBenito b4cd15
Chris PeBenito b4cd15
#######################################
Chris PeBenito b4cd15
#
Chris PeBenito 3ce6cb
# logging_read_all_logs(domain)
Chris PeBenito b4cd15
#
Chris PeBenito 199895
interface(`logging_read_all_logs',`
Chris PeBenito 139520
	gen_require(`
Chris PeBenito 139520
		attribute logfile;
Chris PeBenito 139520
		type var_log_t;
Chris PeBenito 139520
	')
Chris PeBenito 0c73cd
Chris PeBenito c9428d
	files_search_var($1)
Chris PeBenito cc41a9
	allow $1 var_log_t:dir r_dir_perms;
Chris PeBenito cc41a9
	allow $1 logfile:file r_file_perms;
Chris PeBenito b4cd15
')
Chris PeBenito b4cd15
Chris PeBenito 8fd367
########################################
Chris PeBenito 8fd367
## <summary>
Chris PeBenito 8fd367
##	Execute all log files in the caller domain.
Chris PeBenito 8fd367
## </summary>
Chris PeBenito 8fd367
## <param name="domain">
Chris PeBenito 8fd367
##	The type of the process performing this action.
Chris PeBenito 8fd367
## </param>
Chris PeBenito 96ce00
#
Chris PeBenito 8fd367
# cjp: not sure why this is needed.  This was added
Chris PeBenito 8fd367
# because of logrotate.
Chris PeBenito 96ce00
interface(`logging_exec_all_logs',`
Chris PeBenito 96ce00
	gen_require(`
Chris PeBenito 96ce00
		attribute logfile;
Chris PeBenito 96ce00
	')
Chris PeBenito 96ce00
Chris PeBenito 96ce00
	files_search_var($1)
Chris PeBenito 96ce00
	allow $1 logfile:dir r_dir_perms;
Chris PeBenito 96ce00
	can_exec($1,logfile)
Chris PeBenito 96ce00
')
Chris PeBenito 96ce00
Chris PeBenito 96ce00
#######################################
Chris PeBenito 96ce00
#
Chris PeBenito 96ce00
# logging_manage_all_logs(domain)
Chris PeBenito 96ce00
#
Chris PeBenito 96ce00
interface(`logging_manage_all_logs',`
Chris PeBenito 96ce00
	gen_require(`
Chris PeBenito 96ce00
		attribute logfile;
Chris PeBenito 96ce00
	')
Chris PeBenito 96ce00
Chris PeBenito 96ce00
	files_search_var($1)
Chris PeBenito 96ce00
	allow $1 logfile:dir rw_dir_perms;
Chris PeBenito 96ce00
	allow $1 logfile:lnk_file read;
Chris PeBenito 96ce00
	allow $1 logfile:file create_file_perms;
Chris PeBenito 96ce00
')
Chris PeBenito 96ce00
Chris PeBenito 96ce00
#######################################
Chris PeBenito 96ce00
#
Chris PeBenito c9428d
# logging_read_generic_logs(domain)
Chris PeBenito 24280a
#
Chris PeBenito 199895
interface(`logging_read_generic_logs',`
Chris PeBenito 139520
	gen_require(`
Chris PeBenito 139520
		type var_log_t;
Chris PeBenito 139520
	')
Chris PeBenito 0c73cd
Chris PeBenito c9428d
	files_search_var($1)
Chris PeBenito cc41a9
	allow $1 var_log_t:dir r_dir_perms;
Chris PeBenito cc41a9
	allow $1 var_log_t:file r_file_perms;
Chris PeBenito 24280a
')
Chris PeBenito 24280a
Chris PeBenito 24280a
#######################################
Chris PeBenito 24280a
#
Chris PeBenito c9428d
# logging_write_generic_logs(domain)
Chris PeBenito d490eb
#
Chris PeBenito 199895
interface(`logging_write_generic_logs',`
Chris PeBenito 139520
	gen_require(`
Chris PeBenito 139520
		type var_log_t;
Chris PeBenito 139520
	')
Chris PeBenito 0c73cd
Chris PeBenito c9428d
	files_search_var($1)
Chris PeBenito cc41a9
	allow $1 var_log_t:dir r_dir_perms;
Chris PeBenito 0c73cd
	allow $1 var_log_t:file { getattr write };
Chris PeBenito d490eb
')
Chris PeBenito d490eb
Chris PeBenito 0907bd
########################################
Chris PeBenito 0907bd
## <summary>
Chris PeBenito 0907bd
##	Read and write generic log files.
Chris PeBenito 0907bd
## </summary>
Chris PeBenito 0907bd
## <param name="domain">
Chris PeBenito 0907bd
##	Domain allowed access.
Chris PeBenito 0907bd
## </param>
Chris PeBenito b4cd15
#
Chris PeBenito 199895
interface(`logging_rw_generic_logs',`
Chris PeBenito 139520
	gen_require(`
Chris PeBenito 139520
		type var_log_t;
Chris PeBenito 139520
	')
Chris PeBenito 0c73cd
Chris PeBenito c9428d
	files_search_var($1)
Chris PeBenito cc41a9
	allow $1 var_log_t:dir r_dir_perms;
Chris PeBenito cc41a9
	allow $1 var_log_t:file rw_file_perms;
Chris PeBenito b4cd15
')
Chris PeBenito 0907bd
Chris PeBenito 0907bd
########################################
Chris PeBenito 0907bd
## <summary>
Chris PeBenito 0907bd
##	Create, read, write, and delete
Chris PeBenito 0907bd
##	generic log files.
Chris PeBenito 0907bd
## </summary>
Chris PeBenito 0907bd
## <param name="domain">
Chris PeBenito 0907bd
##	Domain allowed access.
Chris PeBenito 0907bd
## </param>
Chris PeBenito 0907bd
#
Chris PeBenito 0907bd
interface(`logging_manage_generic_logs',`
Chris PeBenito 0907bd
	gen_require(`
Chris PeBenito 0907bd
		type var_log_t;
Chris PeBenito 0907bd
	')
Chris PeBenito 0907bd
Chris PeBenito 0907bd
	files_search_var($1)
Chris PeBenito 0907bd
	allow $1 var_log_t:dir rw_dir_perms;
Chris PeBenito 0907bd
	allow $1 var_log_t:file create_file_perms;
Chris PeBenito 0907bd
')