blob: de9180a36d109fc0e1d9cfc39af8e72a0899d44b (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
|
From 3c7c492f060212bf7c854a27ffa6afa5035f4862 Mon Sep 17 00:00:00 2001
From: Shrikant Bobade <shrikant_bobade@mentor.com>
Date: Fri, 26 Aug 2016 17:54:29 +0530
Subject: [PATCH 9/9] refpolicy-minimum: systemd: fix for syslog
syslog & getty related allow rules required to fix the syslog mixup with
boot log, while using systemd as init manager.
without this change we are getting these avc denials:
audit: avc: denied { search } for pid=484 comm="syslogd" name="/"
dev="tmpfs" ino=7269 scontext=system_u:system_r:syslogd_t:s0 tcontext=
system_u:object_r:tmpfs_t:s0 tclass=dir permissive=0
audit: avc: denied { write } for pid=372 comm="syslogd" name="log" dev=
"tmpfs" ino=954 scontext=system_u:system_r:syslogd_t:s0 tcontext=system_u:
object_r:tmpfs_t:s0 tclass=dir permissive=0
audit: avc: denied { add_name } for pid=390 comm="syslogd" name=
"messages" scontext=system_u:system_r:syslogd_t:s0 tcontext=system_u:object_r
:tmpfs_t:s0 tclass=dir permissive=0
audit: avc: denied { sendto } for pid=558 comm="agetty" path="/run/systemd
/journal/dev-log" scontext=system_u:system_r:getty_t:s0 tcontext=system_u:
system_r:initrc_t:s0 tclass=unix_dgram_socket permissive=0
audit: avc: denied { create } for pid=374 comm="syslogd" name="messages"
scontext=system_u:system_r:syslogd_t:s0 tcontext=system_u:object_r:tmpfs_t:
s0 tclass=file permissive=0
audit: avc: denied { append } for pid=423 comm="syslogd" name="messages"
dev="tmpfs" ino=7995 scontext=system_u:system_r:syslogd_t:s0 tcontext=
system_u:object_r:tmpfs_t:s0 tclass=file permissive=0
audit: avc: denied { getattr } for pid=425 comm="syslogd" path="/var/
volatile/log/messages" dev="tmpfs" ino=8857 scontext=system_u:system_r:
syslogd_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=file permissive=0
Upstream-Status: Pending
Signed-off-by: Shrikant Bobade <shrikant_bobade@mentor.com>
Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
---
policy/modules/system/getty.te | 1 +
policy/modules/system/logging.te | 3 ++-
2 files changed, 3 insertions(+), 1 deletion(-)
diff --git a/policy/modules/system/getty.te b/policy/modules/system/getty.te
index 423db0cc..9ab03956 100644
--- a/policy/modules/system/getty.te
+++ b/policy/modules/system/getty.te
@@ -132,3 +132,4 @@ optional_policy(`
allow getty_t tmpfs_t:dir search;
allow getty_t tmpfs_t:file { open write lock };
+allow getty_t initrc_t:unix_dgram_socket sendto;
diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te
index 98c2bd19..6a94ac12 100644
--- a/policy/modules/system/logging.te
+++ b/policy/modules/system/logging.te
@@ -632,4 +632,5 @@ allow klogd_t initrc_t:unix_dgram_socket sendto;
allow syslogd_t self:shm create;
allow syslogd_t self:sem { create read unix_write write };
allow syslogd_t self:shm { read unix_read unix_write write };
-allow syslogd_t tmpfs_t:file { read write };
+allow syslogd_t tmpfs_t:file { read write create getattr append open };
+allow syslogd_t tmpfs_t:dir { search write add_name };
--
2.19.1
|
