audit/logging changes

audit/logging changes

[Daniel J Walsh]

[-- Attachment #1: Type: text/plain, Size: 157 bytes --]

audit needs fsetid

syslog needs to be able to create a tcp_socket for off machine logging.

ssh transitioning dirrectly to auditctl needs additional privs.

[-- Attachment #2: nsaserefpolicy_policy_modules_system_logging.patch --]
[-- Type: text/x-patch, Size: 1343 bytes --]

--- nsaserefpolicy/policy/modules/system/logging.te	2007-02-19 11:32:53.000000000 -0500
+++ serefpolicy-2.5.4/policy/modules/system/logging.te	2007-02-19 16:09:35.000000000 -0500
@@ -104,7 +104,7 @@
 # Auditd local policy
 #
 
-allow auditd_t self:capability { audit_write audit_control sys_nice sys_resource };
+allow auditd_t self:capability { audit_write audit_control fsetid sys_nice sys_resource };
 dontaudit auditd_t self:capability sys_tty_config;
 allow auditd_t self:process { signal_perms setpgid setsched };
 allow auditd_t self:file { getattr read write };
@@ -271,6 +271,7 @@
 allow syslogd_t self:unix_dgram_socket sendto;
 allow syslogd_t self:fifo_file rw_file_perms;
 allow syslogd_t self:udp_socket create_socket_perms;
+allow syslogd_t self:tcp_socket create_stream_socket_perms;
 
 # Create and bind to /dev/log or /var/run/log.
 allow syslogd_t devlog_t:sock_file manage_sock_file_perms;
@@ -324,6 +325,7 @@
 corenet_tcp_sendrecv_all_if(syslogd_t)
 corenet_tcp_sendrecv_all_nodes(syslogd_t)
 corenet_tcp_sendrecv_all_ports(syslogd_t)
+corenet_tcp_bind_all_nodes(syslogd_t)
 corenet_tcp_bind_rsh_port(syslogd_t)
 corenet_tcp_connect_rsh_port(syslogd_t)
 
@@ -399,3 +401,8 @@
 	# log to the xconsole
 	xserver_rw_console(syslogd_t)
 ')
+
+optional_policy(`
+	ssh_sigchld(auditctl_t)
+	ssh_rw_stream_sockets(auditctl_t)
+')

Re: audit/logging changes

[Christopher J. PeBenito]

On Tue, 2007-02-20 at 12:28 -0500, Daniel J Walsh wrote:
> audit needs fsetid
> 
> syslog needs to be able to create a tcp_socket for off machine logging.
> 
> ssh transitioning dirrectly to auditctl needs additional privs.

Merged the first two parts.  We want the general solution for last one.

-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.