* [PATCH] logging
@ 2019-01-08 8:55 Russell Coker
2019-01-10 0:25 ` Chris PeBenito
0 siblings, 1 reply; 2+ messages in thread
From: Russell Coker @ 2019-01-08 8:55 UTC (permalink / raw)
To: selinux-refpolicy
Prosody and ntpd don't just need append access to their log files.
Index: refpolicy-2.20180701/policy/modules/services/jabber.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/services/jabber.te
+++ refpolicy-2.20180701/policy/modules/services/jabber.te
@@ -80,9 +80,8 @@ allow jabberd_t self:netlink_route_socke
manage_files_pattern(jabberd_t, jabberd_lock_t, jabberd_lock_t)
allow jabberd_t jabberd_log_t:dir setattr_dir_perms;
-append_files_pattern(jabberd_t, jabberd_log_t, jabberd_log_t)
-create_files_pattern(jabberd_t, jabberd_log_t, jabberd_log_t)
-setattr_files_pattern(jabberd_t, jabberd_log_t, jabberd_log_t)
+manage_files_pattern(jabberd_t, jabberd_log_t, jabberd_log_t)
+
logging_log_filetrans(jabberd_t, jabberd_log_t, { file dir })
manage_files_pattern(jabberd_domain, jabberd_spool_t, jabberd_spool_t)
Index: refpolicy-2.20180701/policy/modules/services/ntp.te
===================================================================
--- refpolicy-2.20180701.orig/policy/modules/services/ntp.te
+++ refpolicy-2.20180701/policy/modules/services/ntp.te
@@ -73,9 +73,8 @@ read_lnk_files_pattern(ntpd_t, ntpd_key_
allow ntpd_t ntpd_lock_t:file rw_file_perms;
allow ntpd_t ntpd_log_t:dir setattr_dir_perms;
-append_files_pattern(ntpd_t, ntpd_log_t, ntpd_log_t)
-create_files_pattern(ntpd_t, ntpd_log_t, ntpd_log_t)
-setattr_files_pattern(ntpd_t, ntpd_log_t, ntpd_log_t)
+manage_dirs_pattern(ntpd_t, ntpd_log_t, ntpd_log_t)
+manage_files_pattern(ntpd_t, ntpd_log_t, ntpd_log_t)
logging_log_filetrans(ntpd_t, ntpd_log_t, { file dir })
manage_files_pattern(ntpd_t, ntpd_pid_t, ntpd_pid_t)
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: [PATCH] logging
2019-01-08 8:55 [PATCH] logging Russell Coker
@ 2019-01-10 0:25 ` Chris PeBenito
0 siblings, 0 replies; 2+ messages in thread
From: Chris PeBenito @ 2019-01-10 0:25 UTC (permalink / raw)
To: Russell Coker, selinux-refpolicy
On 1/8/19 3:55 AM, Russell Coker wrote:
> Prosody and ntpd don't just need append access to their log files.
>
> Index: refpolicy-2.20180701/policy/modules/services/jabber.te
> ===================================================================
> --- refpolicy-2.20180701.orig/policy/modules/services/jabber.te
> +++ refpolicy-2.20180701/policy/modules/services/jabber.te
> @@ -80,9 +80,8 @@ allow jabberd_t self:netlink_route_socke
> manage_files_pattern(jabberd_t, jabberd_lock_t, jabberd_lock_t)
>
> allow jabberd_t jabberd_log_t:dir setattr_dir_perms;
> -append_files_pattern(jabberd_t, jabberd_log_t, jabberd_log_t)
> -create_files_pattern(jabberd_t, jabberd_log_t, jabberd_log_t)
> -setattr_files_pattern(jabberd_t, jabberd_log_t, jabberd_log_t)
> +manage_files_pattern(jabberd_t, jabberd_log_t, jabberd_log_t)
> +
> logging_log_filetrans(jabberd_t, jabberd_log_t, { file dir })
>
> manage_files_pattern(jabberd_domain, jabberd_spool_t, jabberd_spool_t)
> Index: refpolicy-2.20180701/policy/modules/services/ntp.te
> ===================================================================
> --- refpolicy-2.20180701.orig/policy/modules/services/ntp.te
> +++ refpolicy-2.20180701/policy/modules/services/ntp.te
> @@ -73,9 +73,8 @@ read_lnk_files_pattern(ntpd_t, ntpd_key_
> allow ntpd_t ntpd_lock_t:file rw_file_perms;
>
> allow ntpd_t ntpd_log_t:dir setattr_dir_perms;
> -append_files_pattern(ntpd_t, ntpd_log_t, ntpd_log_t)
> -create_files_pattern(ntpd_t, ntpd_log_t, ntpd_log_t)
> -setattr_files_pattern(ntpd_t, ntpd_log_t, ntpd_log_t)
> +manage_dirs_pattern(ntpd_t, ntpd_log_t, ntpd_log_t)
> +manage_files_pattern(ntpd_t, ntpd_log_t, ntpd_log_t)
> logging_log_filetrans(ntpd_t, ntpd_log_t, { file dir })
>
> manage_files_pattern(ntpd_t, ntpd_pid_t, ntpd_pid_t)
Merged.
--
Chris PeBenito
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2019-01-10 0:37 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2019-01-08 8:55 [PATCH] logging Russell Coker
2019-01-10 0:25 ` Chris PeBenito
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.