1 files changed, 60 insertions, 21 deletions

diff --git a/recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-var-log-symlink.patch b/recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-var-log-symlink.patch
index b06f3ef..a9ae381 100644
--- a/recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-var-log-symlink.patch
+++ b/recipes-security/refpolicy/refpolicy-git/poky-policy-add-rules-for-var-log-symlink.patch
@@ -15,11 +15,11 @@ Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
  policy/modules/system/logging.te |    1 +
  3 files changed, 15 insertions(+), 1 deletion(-)
 
-diff --git a/policy/modules/system/logging.fc b/policy/modules/system/logging.fc
-index c005f33..9529e40 100644
 --- a/policy/modules/system/logging.fc
 +++ b/policy/modules/system/logging.fc
-@@ -41,6 +41,7 @@ ifdef(`distro_suse', `
+@@ -49,10 +49,11 @@ ifdef(`distro_suse', `
+ 
+ /var/axfrdns/log/main(/.*)?    gen_context(system_u:object_r:var_log_t,s0)
  /var/dnscache/log/main(/.*)?   gen_context(system_u:object_r:var_log_t,s0)
  
  /var/log               -d      gen_context(system_u:object_r:var_log_t,s0-mls_systemhigh)
@@ -27,11 +27,13 @@ index c005f33..9529e40 100644
  /var/log/.*                    gen_context(system_u:object_r:var_log_t,s0)
  /var/log/boot\.log     --      gen_context(system_u:object_r:var_log_t,mls_systemhigh)
  /var/log/messages[^/]*         gen_context(system_u:object_r:var_log_t,mls_systemhigh)
-diff --git a/policy/modules/system/logging.if b/policy/modules/system/logging.if
-index 4e94884..9a6f599 100644
+ /var/log/secure[^/]*           gen_context(system_u:object_r:var_log_t,mls_systemhigh)
+ /var/log/maillog[^/]*          gen_context(system_u:object_r:var_log_t,mls_systemhigh)
 --- a/policy/modules/system/logging.if
 +++ b/policy/modules/system/logging.if
-@@ -136,12 +136,13 @@ interface(`logging_set_audit_parameters',`
+@@ -134,16 +134,17 @@ interface(`logging_set_audit_parameters'
+ ## </param>
+ ## <rolecap/>
  #
  interface(`logging_read_audit_log',`
         gen_require(`
@@ -46,7 +48,11 @@ index 4e94884..9a6f599 100644
  ')
  
  ########################################
-@@ -626,6 +627,7 @@ interface(`logging_search_logs',`
+ ## <summary>
+ ##     Execute auditctl in the auditctl domain.
+@@ -665,10 +666,11 @@ interface(`logging_search_logs',`
+                type var_log_t;
+        ')
  
         files_search_var($1)
         allow $1 var_log_t:dir search_dir_perms;
@@ -54,7 +60,11 @@ index 4e94884..9a6f599 100644
  ')
  
  #######################################
-@@ -663,6 +665,7 @@ interface(`logging_list_logs',`
+ ## <summary>
+ ##     Do not audit attempts to search the var log directory.
+@@ -702,10 +704,11 @@ interface(`logging_list_logs',`
+                type var_log_t;
+        ')
  
         files_search_var($1)
         allow $1 var_log_t:dir list_dir_perms;
@@ -62,7 +72,11 @@ index 4e94884..9a6f599 100644
  ')
  
  #######################################
-@@ -682,6 +685,7 @@ interface(`logging_rw_generic_log_dirs',`
+ ## <summary>
+ ##     Read and write the generic log directory (/var/log).
+@@ -721,10 +724,11 @@ interface(`logging_rw_generic_log_dirs',
+                type var_log_t;
+        ')
  
         files_search_var($1)
         allow $1 var_log_t:dir rw_dir_perms;
@@ -70,7 +84,11 @@ index 4e94884..9a6f599 100644
  ')
  
  #######################################
-@@ -793,10 +797,12 @@ interface(`logging_append_all_logs',`
+ ## <summary>
+ ##     Search through all log dirs.
+@@ -832,14 +836,16 @@ interface(`logging_append_all_logs',`
+ ## <rolecap/>
+ #
  interface(`logging_read_all_logs',`
         gen_require(`
                 attribute logfile;
@@ -83,7 +101,11 @@ index 4e94884..9a6f599 100644
         read_files_pattern($1, logfile, logfile)
  ')
  
-@@ -815,10 +821,12 @@ interface(`logging_read_all_logs',`
+ ########################################
+ ## <summary>
+@@ -854,14 +860,16 @@ interface(`logging_read_all_logs',`
+ # cjp: not sure why this is needed.  This was added
+ # because of logrotate.
  interface(`logging_exec_all_logs',`
         gen_require(`
                 attribute logfile;
@@ -96,7 +118,11 @@ index 4e94884..9a6f599 100644
         can_exec($1, logfile)
  ')
  
-@@ -880,6 +888,7 @@ interface(`logging_read_generic_logs',`
+ ########################################
+ ## <summary>
+@@ -919,10 +927,11 @@ interface(`logging_read_generic_logs',`
+                type var_log_t;
+        ')
  
         files_search_var($1)
         allow $1 var_log_t:dir list_dir_perms;
@@ -104,7 +130,11 @@ index 4e94884..9a6f599 100644
         read_files_pattern($1, var_log_t, var_log_t)
  ')
  
-@@ -900,6 +909,7 @@ interface(`logging_write_generic_logs',`
+ ########################################
+ ## <summary>
+@@ -939,10 +948,11 @@ interface(`logging_write_generic_logs',`
+                type var_log_t;
+        ')
  
         files_search_var($1)
         allow $1 var_log_t:dir list_dir_perms;
@@ -112,7 +142,11 @@ index 4e94884..9a6f599 100644
         write_files_pattern($1, var_log_t, var_log_t)
  ')
  
-@@ -938,6 +948,7 @@ interface(`logging_rw_generic_logs',`
+ ########################################
+ ## <summary>
+@@ -977,10 +987,11 @@ interface(`logging_rw_generic_logs',`
+                type var_log_t;
+        ')
  
         files_search_var($1)
         allow $1 var_log_t:dir list_dir_perms;
@@ -120,7 +154,11 @@ index 4e94884..9a6f599 100644
         rw_files_pattern($1, var_log_t, var_log_t)
  ')
  
-@@ -960,6 +971,7 @@ interface(`logging_manage_generic_logs',`
+ ########################################
+ ## <summary>
+@@ -999,10 +1010,11 @@ interface(`logging_manage_generic_logs',
+                type var_log_t;
+        ')
  
         files_search_var($1)
         manage_files_pattern($1, var_log_t, var_log_t)
@@ -128,11 +166,13 @@ index 4e94884..9a6f599 100644
  ')
  
  ########################################
-diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te
-index 2ab0a49..2795d89 100644
+ ## <summary>
+ ##     All of the rules required to administrate
 --- a/policy/modules/system/logging.te
 +++ b/policy/modules/system/logging.te
-@@ -139,6 +139,7 @@ allow auditd_t auditd_etc_t:file read_file_perms;
+@@ -149,10 +149,11 @@ allow auditd_t auditd_etc_t:dir list_dir
+ allow auditd_t auditd_etc_t:file read_file_perms;
+ 
  manage_files_pattern(auditd_t, auditd_log_t, auditd_log_t)
  manage_lnk_files_pattern(auditd_t, auditd_log_t, auditd_log_t)
  allow auditd_t var_log_t:dir search_dir_perms;
@@ -140,6 +180,5 @@ index 2ab0a49..2795d89 100644
  
  manage_files_pattern(auditd_t, auditd_var_run_t, auditd_var_run_t)
  manage_sock_files_pattern(auditd_t, auditd_var_run_t, auditd_var_run_t)
--- 
-1.7.9.5
-
+ files_pid_filetrans(auditd_t, auditd_var_run_t, { file sock_file })
+