Chris PeBenito e181fe
Chris PeBenito 0e1c46
policy_module(logging,1.3.4)
Chris PeBenito 960373
Chris PeBenito eb7f9a
########################################
Chris PeBenito eb7f9a
#
Chris PeBenito eb7f9a
# Declarations
Chris PeBenito eb7f9a
#
Chris PeBenito eb7f9a
Chris PeBenito b4cd15
attribute logfile;
Chris PeBenito b4cd15
Chris PeBenito c3cf66
type auditctl_t;
Chris PeBenito 605ba2
type auditctl_exec_t;
Chris PeBenito 605ba2
init_system_domain(auditctl_t,auditctl_exec_t)
Chris PeBenito 605ba2
role system_r types auditctl_t;
Chris PeBenito 605ba2
Chris PeBenito a2868f
type auditd_etc_t;
Chris PeBenito a2868f
files_security_file(auditd_etc_t)
Chris PeBenito 605ba2
Chris PeBenito a2868f
type auditd_log_t;
Chris PeBenito a2868f
files_security_file(auditd_log_t)
Chris PeBenito eb7f9a
Chris PeBenito eb7f9a
type auditd_t;
Chris PeBenito 93727e
# real declaration moved to mls until
Chris PeBenito 93727e
# range_transition works in loadable modules
Chris PeBenito 93727e
gen_require(`
Chris PeBenito 93727e
	type auditd_exec_t;
Chris PeBenito 93727e
')
Chris PeBenito c9428d
init_daemon_domain(auditd_t,auditd_exec_t)
Chris PeBenito eb7f9a
Chris PeBenito eb7f9a
type auditd_var_run_t;
Chris PeBenito c9428d
files_pid_file(auditd_var_run_t)
Chris PeBenito eb7f9a
Chris PeBenito f0574f
type devlog_t;
Chris PeBenito 8fd367
files_type(devlog_t)
Chris PeBenito f0574f
mls_trusted_object(devlog_t)
Chris PeBenito 4ddc1a
Chris PeBenito f0574f
type klogd_t;
Chris PeBenito 4ddc1a
type klogd_exec_t;
Chris PeBenito c9428d
init_daemon_domain(klogd_t,klogd_exec_t)
Chris PeBenito 4ddc1a
Chris PeBenito 4ddc1a
type klogd_tmp_t;
Chris PeBenito c9428d
files_tmp_file(klogd_tmp_t)
Chris PeBenito 4ddc1a
Chris PeBenito 4ddc1a
type klogd_var_run_t;
Chris PeBenito c9428d
files_pid_file(klogd_var_run_t)
Chris PeBenito 4ddc1a
Chris PeBenito 4ddc1a
type syslogd_t;
Chris PeBenito 4ddc1a
type syslogd_exec_t;
Chris PeBenito c9428d
init_daemon_domain(syslogd_t,syslogd_exec_t)
Chris PeBenito 4ddc1a
Chris PeBenito 4ddc1a
type syslogd_tmp_t;
Chris PeBenito c9428d
files_tmp_file(syslogd_tmp_t)
Chris PeBenito 4ddc1a
Chris PeBenito 4ddc1a
type syslogd_var_run_t;
Chris PeBenito c9428d
files_pid_file(syslogd_var_run_t)
Chris PeBenito 4ddc1a
Chris PeBenito 31a1c2
type var_log_t;
Chris PeBenito 31a1c2
logging_log_file(var_log_t)
Chris PeBenito 4ddc1a
Chris PeBenito 4ddc1a
########################################
Chris PeBenito 4ddc1a
#
Chris PeBenito eb7f9a
# Auditd local policy
Chris PeBenito eb7f9a
#
Chris PeBenito eb7f9a
Chris PeBenito 605ba2
allow auditctl_t self:capability { audit_write audit_control };
Chris PeBenito 605ba2
allow auditctl_t self:netlink_audit_socket { create_netlink_socket_perms nlmsg_relay nlmsg_readpriv };
Chris PeBenito 605ba2
Chris PeBenito 605ba2
libs_use_ld_so(auditctl_t)
Chris PeBenito 605ba2
libs_use_shared_libs(auditctl_t)
Chris PeBenito 605ba2
Chris PeBenito 605ba2
allow auditctl_t etc_t:file { getattr read };
Chris PeBenito 605ba2
Chris PeBenito 605ba2
allow auditctl_t auditd_etc_t:file r_file_perms;
Chris PeBenito 605ba2
Chris PeBenito 445522
kernel_read_kernel_sysctls(auditctl_t)
Chris PeBenito 3c8f6b
kernel_read_proc_symlinks(auditctl_t)
Chris PeBenito 605ba2
Chris PeBenito 3c8f6b
domain_read_all_domains_state(auditctl_t)
Chris PeBenito 15722e
domain_use_interactive_fds(auditctl_t)
Chris PeBenito 605ba2
Chris PeBenito bf080a
mls_file_read_up(auditctl_t)
Chris PeBenito bf080a
Chris PeBenito b0d224
term_use_all_terms(auditctl_t)
Chris PeBenito b0d224
Chris PeBenito 1815ba
init_use_script_ptys(auditctl_t)
Chris PeBenito 1c1ac6
init_dontaudit_use_fds(auditctl_t)
Chris PeBenito 605ba2
Chris PeBenito 1c1ac6
locallogin_dontaudit_use_fds(auditctl_t)
Chris PeBenito 605ba2
Chris PeBenito 2db2c7
logging_send_syslog_msg(auditctl_t)
Chris PeBenito 2db2c7
Chris PeBenito 33acca
ifdef(`targeted_policy',`
Chris PeBenito 1815ba
	term_use_generic_ptys(auditctl_t)
Chris PeBenito 1815ba
	term_use_unallocated_ttys(auditctl_t)
Chris PeBenito 33acca
')
Chris PeBenito 33acca
Chris PeBenito 605ba2
########################################
Chris PeBenito 605ba2
#
Chris PeBenito 605ba2
# Auditd local policy
Chris PeBenito 605ba2
#
Chris PeBenito 605ba2
Chris PeBenito a28f6d
allow auditd_t self:capability { audit_write audit_control sys_nice sys_resource };
Chris PeBenito eb7f9a
dontaudit auditd_t self:capability sys_tty_config;
Chris PeBenito b0d224
allow auditd_t self:process { signal_perms setpgid setsched };
Chris PeBenito 605ba2
allow auditd_t self:file { getattr read write };
Chris PeBenito 605ba2
allow auditd_t self:unix_dgram_socket create_socket_perms;
Chris PeBenito 605ba2
allow auditd_t self:netlink_audit_socket { create_netlink_socket_perms nlmsg_relay nlmsg_readpriv };
Chris PeBenito 7b062e
allow auditd_t self:fifo_file rw_file_perms;
Chris PeBenito 605ba2
Chris PeBenito 605ba2
allow auditd_t auditd_etc_t:file r_file_perms;
Chris PeBenito eb7f9a
Chris PeBenito 605ba2
allow auditd_t auditd_log_t:dir rw_dir_perms;
Chris PeBenito cc41a9
allow auditd_t auditd_log_t:file create_file_perms;
Chris PeBenito 7a6d42
allow auditd_t auditd_log_t:lnk_file create_lnk_perms;
Chris PeBenito 605ba2
allow auditd_t var_log_t:dir search;
Chris PeBenito eb7f9a
Chris PeBenito cc41a9
allow auditd_t auditd_var_run_t:file create_file_perms;
Chris PeBenito 2db2c7
allow auditd_t auditd_var_run_t:dir rw_dir_perms;
Chris PeBenito 1c1ac6
files_pid_filetrans(auditd_t,auditd_var_run_t,file)
Chris PeBenito eb7f9a
Chris PeBenito 445522
kernel_read_kernel_sysctls(auditd_t)
Chris PeBenito a42ca7
kernel_list_proc(auditd_t)
Chris PeBenito a42ca7
kernel_read_proc_symlinks(auditd_t)
Chris PeBenito d35c62
Chris PeBenito 8bd678
dev_read_sysfs(auditd_t)
Chris PeBenito eb7f9a
Chris PeBenito 0fd9dc
fs_getattr_all_fs(auditd_t)
Chris PeBenito ab940a
fs_search_auto_mountpoints(auditd_t)
Chris PeBenito eb7f9a
Chris PeBenito 0fd9dc
term_dontaudit_use_console(auditd_t)
Chris PeBenito eb7f9a
Chris PeBenito 77f6e2
# cjp: why?
Chris PeBenito 77f6e2
corecmd_exec_sbin(auditd_t)
Chris PeBenito eb7f9a
Chris PeBenito 15722e
domain_use_interactive_fds(auditd_t)
Chris PeBenito eb7f9a
Chris PeBenito 8fd367
files_read_etc_files(auditd_t)
Chris PeBenito 603f90
files_list_usr(auditd_t)
Chris PeBenito eb7f9a
Chris PeBenito 1c1ac6
init_use_fds(auditd_t)
Chris PeBenito 77f6e2
init_exec(auditd_t)
Chris PeBenito 77f6e2
init_write_initctl(auditd_t)
Chris PeBenito 0e1c46
init_dontaudit_use_script_ptys(auditd_t)
Chris PeBenito 77f6e2
Chris PeBenito c9428d
logging_send_syslog_msg(auditd_t)
Chris PeBenito eb7f9a
Chris PeBenito c9428d
libs_use_ld_so(auditd_t)
Chris PeBenito c9428d
libs_use_shared_libs(auditd_t)
Chris PeBenito eb7f9a
Chris PeBenito eb7f9a
miscfiles_read_localization(auditd_t)
Chris PeBenito eb7f9a
Chris PeBenito 2db2c7
mls_file_read_up(auditd_t)
Chris PeBenito bf080a
mls_rangetrans_target(auditd_t)
Chris PeBenito 2db2c7
Chris PeBenito 2db2c7
seutil_dontaudit_read_config(auditd_t)
Chris PeBenito f0574f
Chris PeBenito 15722e
userdom_dontaudit_use_unpriv_user_fds(auditd_t)
Chris PeBenito 103fe2
userdom_dontaudit_search_sysadm_home_dirs(auditd_t)
Chris PeBenito e5f806
# cjp: this is questionable
Chris PeBenito 1815ba
userdom_use_sysadm_ttys(auditd_t)
Chris PeBenito ab940a
Chris PeBenito 33acca
ifdef(`targeted_policy',`
Chris PeBenito 1815ba
	term_dontaudit_use_generic_ptys(auditd_t)
Chris PeBenito 1815ba
	term_dontaudit_use_unallocated_ttys(auditd_t)
Chris PeBenito 1815ba
	unconfined_dontaudit_read_pipes(auditd_t)
Chris PeBenito 33acca
')
Chris PeBenito 33acca
Chris PeBenito bb7170
optional_policy(`
Chris PeBenito 8fd367
	seutil_sigchld_newrole(auditd_t)
Chris PeBenito eb7f9a
')
Chris PeBenito eb7f9a
Chris PeBenito bb7170
optional_policy(`
Chris PeBenito c9428d
	udev_read_db(auditd_t)
Chris PeBenito eb7f9a
')
Chris PeBenito eb7f9a
Chris PeBenito eb7f9a
########################################
Chris PeBenito eb7f9a
#
Chris PeBenito 4ddc1a
# klogd local policy
Chris PeBenito 4ddc1a
#
Chris PeBenito 4ddc1a
Chris PeBenito 2e0a88
allow klogd_t self:capability sys_admin;
Chris PeBenito 2e0a88
dontaudit klogd_t self:capability { sys_resource sys_tty_config };
Chris PeBenito 2e0a88
allow klogd_t self:process signal_perms;
Chris PeBenito 2e0a88
Chris PeBenito 3b857e
allow klogd_t klogd_tmp_t:file create_file_perms;
Chris PeBenito 4614e8
allow klogd_t klogd_tmp_t:dir create_dir_perms;
Chris PeBenito 103fe2
files_tmp_filetrans(klogd_t,klogd_tmp_t,{ file dir })
Chris PeBenito daa0e0
Chris PeBenito 3b857e
allow klogd_t klogd_var_run_t:file create_file_perms;
Chris PeBenito 9ca7e7
allow klogd_t klogd_var_run_t:dir rw_dir_perms;
Chris PeBenito 1c1ac6
files_pid_filetrans(klogd_t,klogd_var_run_t,file)
Chris PeBenito 4ddc1a
Chris PeBenito 4ddc1a
kernel_read_system_state(klogd_t)
Chris PeBenito 219bcf
kernel_read_messages(klogd_t)
Chris PeBenito 445522
kernel_read_kernel_sysctls(klogd_t)
Chris PeBenito 219bcf
# Control syslog and console logging
Chris PeBenito 219bcf
kernel_clear_ring_buffer(klogd_t)
Chris PeBenito 219bcf
kernel_change_ring_buffer_level(klogd_t)
Chris PeBenito 219bcf
Chris PeBenito 1c1ac6
files_read_kernel_symbol_table(klogd_t)
Chris PeBenito 4ddc1a
Karl MacMillan f0c985
dev_read_raw_memory(klogd_t)
Chris PeBenito d1b9d9
dev_read_sysfs(klogd_t)
Chris PeBenito 4ddc1a
Chris PeBenito 0fd9dc
fs_getattr_all_fs(klogd_t)
Chris PeBenito d1b9d9
fs_search_auto_mountpoints(klogd_t)
Chris PeBenito 4ddc1a
Chris PeBenito 4614e8
term_dontaudit_use_console(klogd_t)
Chris PeBenito 4614e8
Chris PeBenito 15722e
domain_use_interactive_fds(klogd_t)
Chris PeBenito b7e182
Chris PeBenito c9428d
files_read_etc_runtime_files(klogd_t)
Chris PeBenito 4ddc1a
# read /etc/nsswitch.conf
Chris PeBenito 8fd367
files_read_etc_files(klogd_t)
Chris PeBenito 4ddc1a
Chris PeBenito 1c1ac6
init_use_fds(klogd_t)
Chris PeBenito 1815ba
init_use_script_ptys(klogd_t)
Chris PeBenito 3b857e
Chris PeBenito c9428d
libs_use_ld_so(klogd_t)
Chris PeBenito c9428d
libs_use_shared_libs(klogd_t)
Chris PeBenito 4ddc1a
Chris PeBenito c9428d
logging_send_syslog_msg(klogd_t)
Chris PeBenito 4ddc1a
Chris PeBenito daa0e0
miscfiles_read_localization(klogd_t)
Chris PeBenito daa0e0
Chris PeBenito bf080a
mls_file_read_up(klogd_t)
Chris PeBenito bf080a
Chris PeBenito 103fe2
userdom_dontaudit_search_sysadm_home_dirs(klogd_t)
Chris PeBenito 725926
Chris PeBenito bb7170
optional_policy(`
Chris PeBenito d1b9d9
	udev_read_db(klogd_t)
Chris PeBenito 98a8ea
')
Chris PeBenito d1b9d9
Chris PeBenito d1b9d9
ifdef(`targeted_policy',`
Chris PeBenito 1815ba
	term_dontaudit_use_generic_ptys(klogd_t)
Chris PeBenito 1815ba
	term_dontaudit_use_unallocated_ttys(klogd_t)
Chris PeBenito 98a8ea
')
Chris PeBenito 98a8ea
Chris PeBenito bb7170
optional_policy(`
Chris PeBenito 725926
	seutil_sigchld_newrole(klogd_t)
Chris PeBenito 725926
')
Chris PeBenito 725926
Chris PeBenito 4ddc1a
########################################
Chris PeBenito 4ddc1a
#
Chris PeBenito 4ddc1a
# syslogd local policy
Chris PeBenito 4ddc1a
#
Chris PeBenito 219bcf
Chris PeBenito 605ba2
# sys_admin chown fsetid for syslog-ng
Chris PeBenito 0907bd
# cjp: why net_admin!
Chris PeBenito 605ba2
allow syslogd_t self:capability { dac_override sys_resource sys_tty_config net_admin sys_admin chown fsetid };
Chris PeBenito 55f456
dontaudit syslogd_t self:capability sys_tty_config;
Chris PeBenito d115b2
allow syslogd_t self:process signal_perms;
Chris PeBenito 605ba2
allow syslogd_t self:netlink_route_socket r_netlink_socket_perms;
Chris PeBenito d115b2
# receive messages to be logged
Chris PeBenito cc41a9
allow syslogd_t self:unix_dgram_socket create_socket_perms;
Chris PeBenito cc41a9
allow syslogd_t self:unix_stream_socket create_stream_socket_perms;
Chris PeBenito d115b2
allow syslogd_t self:unix_dgram_socket sendto;
Chris PeBenito cc41a9
allow syslogd_t self:fifo_file rw_file_perms;
Chris PeBenito cc41a9
allow syslogd_t self:udp_socket { connected_socket_perms connect };
Chris PeBenito 219bcf
Chris PeBenito 605ba2
# Create and bind to /dev/log or /var/run/log.
Chris PeBenito 605ba2
allow syslogd_t devlog_t:sock_file create_file_perms;
Chris PeBenito 103fe2
files_pid_filetrans(syslogd_t,devlog_t,sock_file)
Chris PeBenito 605ba2
Chris PeBenito 55f456
# create/append log files.
Chris PeBenito 3b857e
allow syslogd_t var_log_t:dir rw_dir_perms;
Chris PeBenito 3b857e
allow syslogd_t var_log_t:file create_file_perms;
Chris PeBenito 605ba2
# Allow access for syslog-ng
Chris PeBenito 605ba2
allow syslogd_t var_log_t:dir { create setattr };
Chris PeBenito 4ddc1a
Chris PeBenito 55f456
# manage temporary files
Chris PeBenito 3b857e
allow syslogd_t syslogd_tmp_t:file create_file_perms;
Chris PeBenito d1b9d9
allow syslogd_t syslogd_tmp_t:dir create_dir_perms;
Chris PeBenito 103fe2
files_tmp_filetrans(syslogd_t,syslogd_tmp_t,{ dir file })
Chris PeBenito 3b857e
Chris PeBenito 3b857e
allow syslogd_t syslogd_var_run_t:file create_file_perms;
Chris PeBenito 103fe2
files_pid_filetrans(syslogd_t,syslogd_var_run_t,file)
Chris PeBenito 219bcf
Chris PeBenito 55f456
# manage pid file
Chris PeBenito cc41a9
allow syslogd_t syslogd_var_run_t:file create_file_perms;
Chris PeBenito b9ea0f
allow syslogd_t syslogd_var_run_t:dir rw_dir_perms;
Chris PeBenito 1c1ac6
files_pid_filetrans(syslogd_t,syslogd_var_run_t,file)
Chris PeBenito 55f456
Chris PeBenito 445522
kernel_read_kernel_sysctls(syslogd_t)
Chris PeBenito a42ca7
kernel_read_proc_symlinks(syslogd_t)
Chris PeBenito 605ba2
# Allow access to /proc/kmsg for syslog-ng
Chris PeBenito d3f715
kernel_read_messages(syslogd_t)
Chris PeBenito d3f715
kernel_clear_ring_buffer(syslogd_t)
Chris PeBenito d3f715
kernel_change_ring_buffer_level(syslogd_t)
Chris PeBenito 219bcf
Chris PeBenito 103fe2
dev_filetrans(syslogd_t,devlog_t,sock_file)
Chris PeBenito d35c62
dev_read_sysfs(syslogd_t)
Chris PeBenito 55f456
Chris PeBenito ab940a
fs_search_auto_mountpoints(syslogd_t)
Chris PeBenito ab940a
Chris PeBenito 0e1c46
term_write_console(syslogd_t)
Chris PeBenito daa0e0
# Allow syslog to a terminal
Chris PeBenito 0fd9dc
term_write_unallocated_ttys(syslogd_t)
Chris PeBenito daa0e0
Chris PeBenito daa0e0
# for sending messages to logged in users
Chris PeBenito 68228b
init_read_utmp(syslogd_t)
Chris PeBenito 68228b
init_dontaudit_write_utmp(syslogd_t)
Chris PeBenito 0fd9dc
term_write_all_user_ttys(syslogd_t)
Chris PeBenito 219bcf
Chris PeBenito 0fd9dc
corenet_raw_sendrecv_all_if(syslogd_t)
Chris PeBenito 0fd9dc
corenet_udp_sendrecv_all_if(syslogd_t)
Chris PeBenito 0fd9dc
corenet_raw_sendrecv_all_nodes(syslogd_t)
Chris PeBenito 0fd9dc
corenet_udp_sendrecv_all_nodes(syslogd_t)
Chris PeBenito 0fd9dc
corenet_udp_sendrecv_all_ports(syslogd_t)
Chris PeBenito bd7037
corenet_non_ipsec_sendrecv(syslogd_t)
Chris PeBenito 0fd9dc
corenet_udp_bind_all_nodes(syslogd_t)
Chris PeBenito 605ba2
corenet_tcp_bind_syslogd_port(syslogd_t)
Chris PeBenito a52492
corenet_udp_bind_syslogd_port(syslogd_t)
Chris PeBenito 219bcf
Chris PeBenito 0fd9dc
fs_getattr_all_fs(syslogd_t)
Chris PeBenito 219bcf
Chris PeBenito 1c1ac6
init_use_fds(syslogd_t)
Chris PeBenito 1815ba
init_use_script_ptys(syslogd_t)
Chris PeBenito 55f456
Chris PeBenito 15722e
domain_use_interactive_fds(syslogd_t)
Chris PeBenito 25baab
Chris PeBenito 8fd367
files_read_etc_files(syslogd_t)
Chris PeBenito 77f6e2
files_read_etc_runtime_files(syslogd_t)
Chris PeBenito 605ba2
# /initrd is not umounted before minilog starts
Chris PeBenito 9e04f5
files_dontaudit_search_isid_type_dirs(syslogd_t)
Chris PeBenito 219bcf
Chris PeBenito c9428d
libs_use_ld_so(syslogd_t)
Chris PeBenito c9428d
libs_use_shared_libs(syslogd_t)
Chris PeBenito 219bcf
Chris PeBenito b0bdeb
# cjp: this doesnt make sense
Chris PeBenito b0bdeb
logging_send_syslog_msg(syslogd_t)
Chris PeBenito b0bdeb
Chris PeBenito c9428d
sysnet_read_config(syslogd_t)
Chris PeBenito 91a7ab
Chris PeBenito 219bcf
miscfiles_read_localization(syslogd_t)
Chris PeBenito 219bcf
Chris PeBenito 15722e
userdom_dontaudit_use_unpriv_user_fds(syslogd_t)
Chris PeBenito 103fe2
userdom_dontaudit_search_sysadm_home_dirs(syslogd_t)
Chris PeBenito daa0e0
Chris PeBenito 605ba2
ifdef(`distro_suse',`
Chris PeBenito a5f339
	# suse creates a /dev/log under /var/lib/stunnel for chrooted stunnel
Chris PeBenito 103fe2
	files_var_lib_filetrans(syslogd_t,devlog_t,sock_file)
Chris PeBenito a5f339
')
Chris PeBenito a5f339
Chris PeBenito 605ba2
ifdef(`targeted_policy',`
Chris PeBenito 605ba2
	allow syslogd_t var_run_t:fifo_file { ioctl read write };
Chris PeBenito 1815ba
	term_dontaudit_use_unallocated_ttys(syslogd_t)
Chris PeBenito 1815ba
	term_dontaudit_use_generic_ptys(syslogd_t)
Chris PeBenito 9e04f5
	files_dontaudit_read_root_files(syslogd_t)
Chris PeBenito 3b857e
')
Chris PeBenito 3b857e
Chris PeBenito bb7170
optional_policy(`
Chris PeBenito 9b0640
	inn_manage_log(syslogd_t)
Chris PeBenito 9b0640
')
Chris PeBenito 9b0640
Chris PeBenito bb7170
optional_policy(`
Chris PeBenito ab940a
	nis_use_ypbind(syslogd_t)
Chris PeBenito ab940a
')
Chris PeBenito ab940a
Chris PeBenito bb7170
optional_policy(`
Chris PeBenito 1815ba
	nscd_socket_use(syslogd_t)
Chris PeBenito 77f6e2
')
Chris PeBenito 77f6e2
Chris PeBenito bb7170
optional_policy(`
Chris PeBenito 8fd367
	seutil_sigchld_newrole(syslogd_t)
Chris PeBenito 25baab
')
Chris PeBenito 25baab
Chris PeBenito bb7170
optional_policy(`
Chris PeBenito c9428d
	udev_read_db(syslogd_t)
Chris PeBenito 25baab
')
Chris PeBenito 25baab
Chris PeBenito 413982
optional_policy(`
Chris PeBenito 413982
	# log to the xconsole
Chris PeBenito 413982
	xserver_rw_console(syslogd_t)
Chris PeBenito 413982
')