audit/logging changes

[Daniel J Walsh <dwalsh@redhat.com>]

[-- Attachment #1: Type: text/plain, Size: 157 bytes --]

audit needs fsetid

syslog needs to be able to create a tcp_socket for off machine logging.

ssh transitioning dirrectly to auditctl needs additional privs.

[-- Attachment #2: nsaserefpolicy_policy_modules_system_logging.patch --]
[-- Type: text/x-patch, Size: 1343 bytes --]

--- nsaserefpolicy/policy/modules/system/logging.te	2007-02-19 11:32:53.000000000 -0500
+++ serefpolicy-2.5.4/policy/modules/system/logging.te	2007-02-19 16:09:35.000000000 -0500
@@ -104,7 +104,7 @@
 # Auditd local policy
 #
 
-allow auditd_t self:capability { audit_write audit_control sys_nice sys_resource };
+allow auditd_t self:capability { audit_write audit_control fsetid sys_nice sys_resource };
 dontaudit auditd_t self:capability sys_tty_config;
 allow auditd_t self:process { signal_perms setpgid setsched };
 allow auditd_t self:file { getattr read write };
@@ -271,6 +271,7 @@
 allow syslogd_t self:unix_dgram_socket sendto;
 allow syslogd_t self:fifo_file rw_file_perms;
 allow syslogd_t self:udp_socket create_socket_perms;
+allow syslogd_t self:tcp_socket create_stream_socket_perms;
 
 # Create and bind to /dev/log or /var/run/log.
 allow syslogd_t devlog_t:sock_file manage_sock_file_perms;
@@ -324,6 +325,7 @@
 corenet_tcp_sendrecv_all_if(syslogd_t)
 corenet_tcp_sendrecv_all_nodes(syslogd_t)
 corenet_tcp_sendrecv_all_ports(syslogd_t)
+corenet_tcp_bind_all_nodes(syslogd_t)
 corenet_tcp_bind_rsh_port(syslogd_t)
 corenet_tcp_connect_rsh_port(syslogd_t)
 
@@ -399,3 +401,8 @@
 	# log to the xconsole
 	xserver_rw_console(syslogd_t)
 ')
+
+optional_policy(`
+	ssh_sigchld(auditctl_t)
+	ssh_rw_stream_sockets(auditctl_t)
+')