diff --git a/Changelog b/Changelog index 9497a31..422326d 100644 --- a/Changelog +++ b/Changelog @@ -1,3 +1,4 @@ +- Logrotate and Bind updates from Vaclav Ovsik. - Init script file and domain support. - Glibc 2.7 fix from Vaclav Ovsik. - Samba/winbind update from Mike Edenfield. diff --git a/policy/modules/admin/logrotate.te b/policy/modules/admin/logrotate.te index 482bddf..2e9ce3a 100644 --- a/policy/modules/admin/logrotate.te +++ b/policy/modules/admin/logrotate.te @@ -1,5 +1,5 @@ -policy_module(logrotate, 1.9.1) +policy_module(logrotate, 1.9.2) ######################################## # @@ -133,6 +133,9 @@ ifdef(`distro_debian', ` # for syslogd-listfiles logging_read_syslog_config(logrotate_t) + + # for "test -x /sbin/syslogd" + logging_check_exec_syslog(logrotate_t) ') optional_policy(` diff --git a/policy/modules/services/bind.fc b/policy/modules/services/bind.fc index a585a8a..5680a4e 100644 --- a/policy/modules/services/bind.fc +++ b/policy/modules/services/bind.fc @@ -15,6 +15,8 @@ ifdef(`distro_debian',` /etc/bind(/.*)? gen_context(system_u:object_r:named_zone_t,s0) /etc/bind/named\.conf -- gen_context(system_u:object_r:named_conf_t,s0) +/etc/bind/named\.conf\.local -- gen_context(system_u:object_r:named_conf_t,s0) +/etc/bind/named\.conf\.options -- gen_context(system_u:object_r:named_conf_t,s0) /etc/bind/rndc\.key -- gen_context(system_u:object_r:dnssec_t,s0) /var/cache/bind(/.*)? gen_context(system_u:object_r:named_cache_t,s0) ') diff --git a/policy/modules/services/bind.te b/policy/modules/services/bind.te index 33e7dae..d3097df 100644 --- a/policy/modules/services/bind.te +++ b/policy/modules/services/bind.te @@ -1,5 +1,5 @@ -policy_module(bind, 1.7.0) +policy_module(bind, 1.7.1) ######################################## # diff --git a/policy/modules/system/logging.if b/policy/modules/system/logging.if index 19b701b..de2d558 100644 --- a/policy/modules/system/logging.if +++ b/policy/modules/system/logging.if @@ -368,6 +368,26 @@ interface(`logging_domtrans_klog',` ######################################## ## +## Check if syslogd is executable. +## +## +## +## Domain allowed access. +## +## +# +interface(`logging_check_exec_syslog',` + gen_require(` + syslogd_exec_t; + ') + + corecmd_list_bin($1) + corecmd_read_bin_symlinks($1) + allow $1 syslogd_exec_t:file execute; +') + +######################################## +## ## Execute syslogd in the syslog domain. ## ## diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te index f346c28..9474b10 100644 --- a/policy/modules/system/logging.te +++ b/policy/modules/system/logging.te @@ -1,5 +1,5 @@ -policy_module(logging, 1.11.2) +policy_module(logging, 1.11.3) ######################################## #