[RFC] logging: tidy loose end related to systemd-journald

[RFC] logging: tidy loose end related to systemd-journald

[Dominick Grift]

RFC because I was unable to test this.

Signed-off-by: Dominick Grift <dominick.grift@defensec.nl>
---
 policy/modules/system/logging.if | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/policy/modules/system/logging.if b/policy/modules/system/logging.if
index 3dd2c06c2..6222fed4b 100644
--- a/policy/modules/system/logging.if
+++ b/policy/modules/system/logging.if
@@ -684,8 +684,8 @@ interface(`logging_send_syslog_msg',`
 	allow $1 devlog_t:sock_file write_sock_file_perms;
 
 	# systemd journal socket is in /run/systemd/journal/dev-log
+	write_sock_files_pattern($1, syslogd_runtime_t, syslogd_runtime_t)
 	init_search_run($1)
-	allow $1 syslogd_runtime_t:dir search_dir_perms;
 
 	# the type of socket depends on the syslog daemon
 	allow $1 syslogd_t:unix_dgram_socket sendto;
-- 
2.53.0

Re: [RFC] logging: tidy loose end related to systemd-journald

[Dominick Grift]

Dominick Grift <dominick.grift@defensec.nl> writes:

> RFC because I was unable to test this.

Turns out that this is atleast incomplete because there are fc specs
that conflict remaining [1] and they indicate that the labeling is
intended to be different. I don't see why according to the fc spec that
content should be devlog_t and how that transition is supposed to
happen.

[1] https://github.com/SELinuxProject/refpolicy/blob/main/policy/modules/system/logging.fc#L78C1-L82C97

>
> Signed-off-by: Dominick Grift <dominick.grift@defensec.nl>
> ---
>  policy/modules/system/logging.if | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/policy/modules/system/logging.if b/policy/modules/system/logging.if
> index 3dd2c06c2..6222fed4b 100644
> --- a/policy/modules/system/logging.if
> +++ b/policy/modules/system/logging.if
> @@ -684,8 +684,8 @@ interface(`logging_send_syslog_msg',`
>  	allow $1 devlog_t:sock_file write_sock_file_perms;
>  
>  	# systemd journal socket is in /run/systemd/journal/dev-log
> +	write_sock_files_pattern($1, syslogd_runtime_t, syslogd_runtime_t)
>  	init_search_run($1)
> -	allow $1 syslogd_runtime_t:dir search_dir_perms;
>  
>  	# the type of socket depends on the syslog daemon
>  	allow $1 syslogd_t:unix_dgram_socket sendto;

-- 
gpg --auto-key-locate clear,nodefault,wkd --locate-external-keys dominick.grift@defensec.nl
Key fingerprint = FCD2 3660 5D6B 9D27 7FC6  E0FF DA7E 521F 10F6 4098
Dominick Grift
Mastodon: @kcinimod@defensec.nl

[RFC 2] logging.te: systemd-journald: loose ends

[Dominick Grift]

rfc because i was unable to (build)test it.

add missing file type transition rules so that systemd-journald
creates these sockets as per the corresponding fc specs for consistency.

the previous rfc did not take the existing fc specs into account

Signed-off-by: Dominick Grift <dominick.grift@defensec.nl>
---
 policy/modules/system/logging.te | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te
index 314b2559b..b58dda6d3 100644
--- a/policy/modules/system/logging.te
+++ b/policy/modules/system/logging.te
@@ -518,6 +518,12 @@ ifdef(`init_systemd',`
 	allow syslogd_t self:cap_userns sys_ptrace;
 	allow syslogd_t self:netlink_audit_socket { getattr getopt nlmsg_write read setopt write };
 
+	# /run/systemd/journal: for consistency with corresponding fc specs
+	filetrans_pattern(syslogd_t, syslogd_runtime_t, "dev-log", sock_file, devlog_t)
+	filetrans_pattern(syslogd_t, syslogd_runtime_t, "socket", sock_file, devlog_t)
+	filetrans_pattern(syslogd_t, syslogd_runtime_t, "stdout", sock_file, devlog_t)
+	filetrans_pattern(syslogd_t, syslogd_runtime_t, "syslog", sock_file, devlog_t)
+
 	# remove /run/log/journal when switching to permanent storage
 	allow syslogd_t var_log_t:dir rmdir;
 
-- 
2.53.0

Re: [RFC 2] logging.te: systemd-journald: loose ends

[Russell Coker]

On Sunday, 9 August 2026 18:08:46 AEST Dominick Grift wrote:
> rfc because i was unable to (build)test it.
> 
> add missing file type transition rules so that systemd-journald
> creates these sockets as per the corresponding fc specs for consistency.
> 
> the previous rfc did not take the existing fc specs into account
> 
> Signed-off-by: Dominick Grift <dominick.grift@defensec.nl>
> ---
>  policy/modules/system/logging.te | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/policy/modules/system/logging.te
> b/policy/modules/system/logging.te index 314b2559b..b58dda6d3 100644
> --- a/policy/modules/system/logging.te
> +++ b/policy/modules/system/logging.te
> @@ -518,6 +518,12 @@ ifdef(`init_systemd',`
>  	allow syslogd_t self:cap_userns sys_ptrace;
>  	allow syslogd_t self:netlink_audit_socket { getattr getopt 
nlmsg_write
> read setopt write };
> 
> +	# /run/systemd/journal: for consistency with corresponding fc specs
> +	filetrans_pattern(syslogd_t, syslogd_runtime_t, "dev-log", 
sock_file,
> devlog_t) +	filetrans_pattern(syslogd_t, syslogd_runtime_t, "socket",
> sock_file, devlog_t) +	filetrans_pattern(syslogd_t, syslogd_runtime_t,
> "stdout", sock_file, devlog_t) +	filetrans_pattern(syslogd_t,
> syslogd_runtime_t, "syslog", sock_file, devlog_t) +
>  	# remove /run/log/journal when switching to permanent storage
>  	allow syslogd_t var_log_t:dir rmdir;

I have the following in the Debian policy.  You seem to have the order wrong.

filetrans_pattern(syslogd_t, syslogd_runtime_t, devlog_t, sock_file, 
"io.systemd.journal")

The others don't seem to be needed:

# ls -laZ /run/systemd/journal/
total 8
drwxr-xr-x.  3 root root system_u:object_r:syslogd_runtime_t:s0  220 Aug  9 
10:33 .
drwxr-xr-x. 26 root root system_u:object_r:init_runtime_t:s0     880 Aug  9 
20:27 ..
srw-rw-rw-.  1 root root system_u:object_r:devlog_t:s0             0 Aug  9 
10:33 dev-log
-rw-r--r--.  1 root root system_u:object_r:syslogd_runtime_t:s0    0 Aug  9 
10:33 flushed
srw-rw-rw-.  1 root root system_u:object_r:devlog_t:s0             0 Aug  9 
10:33 io.systemd.journal
-rw-r--r--.  1 root root system_u:object_r:syslogd_runtime_t:s0    8 Aug  9 
10:33 kernel-seqnum
-rw-r--r--.  1 root root system_u:object_r:syslogd_runtime_t:s0   24 Aug  9 
10:33 seqnum
srw-rw-rw-.  1 root root system_u:object_r:devlog_t:s0             0 Aug  9 
10:33 socket
srw-rw-rw-.  1 root root system_u:object_r:devlog_t:s0             0 Aug  9 
10:33 stdout
drwxr-xr-x.  2 root root system_u:object_r:syslogd_runtime_t:s0 1520 Aug  9 
20:50 streams
srw-rw-rw-.  1 root root system_u:object_r:devlog_t:s0             0 Aug  9 
10:33 syslog

-- 
My Main Blog         http://etbe.coker.com.au/
My Documents Blog    http://doc.coker.com.au/

Re: [RFC 2] logging.te: systemd-journald: loose ends

[Dominick Grift]

Russell Coker <russell@coker.com.au> writes:

> On Sunday, 9 August 2026 18:08:46 AEST Dominick Grift wrote:
>> rfc because i was unable to (build)test it.
>> 
>> add missing file type transition rules so that systemd-journald
>> creates these sockets as per the corresponding fc specs for consistency.
>> 
>> the previous rfc did not take the existing fc specs into account
>> 
>> Signed-off-by: Dominick Grift <dominick.grift@defensec.nl>
>> ---
>>  policy/modules/system/logging.te | 6 ++++++
>>  1 file changed, 6 insertions(+)
>> 
>> diff --git a/policy/modules/system/logging.te
>> b/policy/modules/system/logging.te index 314b2559b..b58dda6d3 100644
>> --- a/policy/modules/system/logging.te
>> +++ b/policy/modules/system/logging.te
>> @@ -518,6 +518,12 @@ ifdef(`init_systemd',`
>>  	allow syslogd_t self:cap_userns sys_ptrace;
>>  	allow syslogd_t self:netlink_audit_socket { getattr getopt 
> nlmsg_write
>> read setopt write };
>> 
>> +	# /run/systemd/journal: for consistency with corresponding fc specs
>> +	filetrans_pattern(syslogd_t, syslogd_runtime_t, "dev-log", 
> sock_file,
>> devlog_t) +	filetrans_pattern(syslogd_t, syslogd_runtime_t, "socket",
>> sock_file, devlog_t) +	filetrans_pattern(syslogd_t, syslogd_runtime_t,
>> "stdout", sock_file, devlog_t) +	filetrans_pattern(syslogd_t,
>> syslogd_runtime_t, "syslog", sock_file, devlog_t) +
>>  	# remove /run/log/journal when switching to permanent storage
>>  	allow syslogd_t var_log_t:dir rmdir;
>
> I have the following in the Debian policy.  You seem to have the order wrong.
>
> filetrans_pattern(syslogd_t, syslogd_runtime_t, devlog_t, sock_file, 
> "io.systemd.journal")

Interesting. On IRC a gentoo user ran into labeling issues of the
dev-log sock file where it was labeled syslogd_runtime_t instead of
devlog_t

Looks like I also have the filetrans_pattern arg ordering wrong.

>
> The others don't seem to be needed:

Do you have any type transition rules for those at all?

sesearch -T -s syslogd_t -t syslogd_runtime_t -c sock_file

>
> # ls -laZ /run/systemd/journal/
> total 8
> drwxr-xr-x.  3 root root system_u:object_r:syslogd_runtime_t:s0  220 Aug  9 
> 10:33 .
> drwxr-xr-x. 26 root root system_u:object_r:init_runtime_t:s0     880 Aug  9 
> 20:27 ..
> srw-rw-rw-.  1 root root system_u:object_r:devlog_t:s0             0 Aug  9 
> 10:33 dev-log
> -rw-r--r--.  1 root root system_u:object_r:syslogd_runtime_t:s0    0 Aug  9 
> 10:33 flushed
> srw-rw-rw-.  1 root root system_u:object_r:devlog_t:s0             0 Aug  9 
> 10:33 io.systemd.journal
> -rw-r--r--.  1 root root system_u:object_r:syslogd_runtime_t:s0    8 Aug  9 
> 10:33 kernel-seqnum
> -rw-r--r--.  1 root root system_u:object_r:syslogd_runtime_t:s0   24 Aug  9 
> 10:33 seqnum
> srw-rw-rw-.  1 root root system_u:object_r:devlog_t:s0             0 Aug  9 
> 10:33 socket
> srw-rw-rw-.  1 root root system_u:object_r:devlog_t:s0             0 Aug  9 
> 10:33 stdout
> drwxr-xr-x.  2 root root system_u:object_r:syslogd_runtime_t:s0 1520 Aug  9 
> 20:50 streams
> srw-rw-rw-.  1 root root system_u:object_r:devlog_t:s0             0 Aug  9 
> 10:33 syslog

-- 
gpg --auto-key-locate clear,nodefault,wkd --locate-external-keys dominick.grift@defensec.nl
Key fingerprint = FCD2 3660 5D6B 9D27 7FC6  E0FF DA7E 521F 10F6 4098
Dominick Grift
Mastodon: @kcinimod@defensec.nl

Re: [RFC 2] logging.te: systemd-journald: loose ends

[Russell Coker]

On Sunday, 9 August 2026 21:05:27 AEST Dominick Grift wrote:
> Do you have any type transition rules for those at all?
> 
> sesearch -T -s syslogd_t -t syslogd_runtime_t -c sock_file

# sesearch -T -s syslogd_t -t syslogd_runtime_t -c sock_file
type_transition syslogd_t syslogd_runtime_t:sock_file devlog_t 
io.systemd.journal;

No I only have one rule.

# systemctl status syslog.socket
● syslog.socket - Syslog Socket
     Loaded: loaded (/usr/lib/systemd/system/syslog.socket; static)
     Active: active (running) since Sun 2026-08-09 10:33:04 AEST; 10h ago
 Invocation: d0566e3b35b44b7098fe98ca38d88c7e
   Triggers: ● rsyslog.service
       Docs: man:systemd.special(7)
             https://systemd.io/SYSLOG
     Listen: /run/systemd/journal/syslog (Datagram)

# systemctl status systemd-journald-dev-log.socket
● systemd-journald-dev-log.socket - Journal Socket (/dev/log)
     Loaded: loaded (/usr/lib/systemd/system/systemd-journald-dev-log.socket; 
static)
     Active: active (running) since Sun 2026-08-09 10:33:05 AEST; 10h ago
 Invocation: 2e3a2be5a6d24b62b841c92bdd4f3119
   Triggers: ● systemd-journald.service
       Docs: man:systemd-journald.service(8)
             man:journald.conf(5)
     Listen: /run/systemd/journal/dev-log (Datagram)

# systemctl status systemd-journald.socket
● systemd-journald.socket - Journal Sockets
     Loaded: loaded (/usr/lib/systemd/system/systemd-journald.socket; static)
     Active: active (running) since Sun 2026-08-09 10:33:05 AEST; 10h ago
 Invocation: d43d3185e3534a1c881c31bbacc851ec
   Triggers: ● systemd-journald.service
       Docs: man:systemd-journald.service(8)
             man:journald.conf(5)
     Listen: /run/systemd/journal/socket (Datagram)
             /run/systemd/journal/stdout (Stream)

Notice: journal has been rotated since unit was started, output may be 
incomplete.

The syslog socket seems covered by systemd, but that doesn't need a 
transition:

# sesearch -T -t syslogd_runtime_t -c sock_file
type_transition syslogd_t syslogd_runtime_t:sock_file devlog_t 
io.systemd.journal;

-- 
My Main Blog         http://etbe.coker.com.au/
My Documents Blog    http://doc.coker.com.au/

Re: [RFC 2] logging.te: systemd-journald: loose ends

[Dominick Grift]

Russell Coker <russell@coker.com.au> writes:

> On Sunday, 9 August 2026 21:05:27 AEST Dominick Grift wrote:
>> Do you have any type transition rules for those at all?
>> 
>> sesearch -T -s syslogd_t -t syslogd_runtime_t -c sock_file
>
> # sesearch -T -s syslogd_t -t syslogd_runtime_t -c sock_file
> type_transition syslogd_t syslogd_runtime_t:sock_file devlog_t 
> io.systemd.journal;
>
> No I only have one rule.

Thanks. I think the user may not have these sockets activated and that
therefore they get created by systemd-journald instead in his
scenario. systemd-journald itself does not seems to use
get/setfscreatecon as it needs a type transition for io.systemd.journal
too.

I suppose the question becomes whether refpolicy wants to support the
scenario where the syslog socket unit is not enabled.

>
> # systemctl status syslog.socket
> ● syslog.socket - Syslog Socket
>      Loaded: loaded (/usr/lib/systemd/system/syslog.socket; static)
>      Active: active (running) since Sun 2026-08-09 10:33:04 AEST; 10h ago
>  Invocation: d0566e3b35b44b7098fe98ca38d88c7e
>    Triggers: ● rsyslog.service
>        Docs: man:systemd.special(7)
>              https://systemd.io/SYSLOG
>      Listen: /run/systemd/journal/syslog (Datagram)
>
> # systemctl status systemd-journald-dev-log.socket
> ● systemd-journald-dev-log.socket - Journal Socket (/dev/log)
>      Loaded: loaded (/usr/lib/systemd/system/systemd-journald-dev-log.socket; 
> static)
>      Active: active (running) since Sun 2026-08-09 10:33:05 AEST; 10h ago
>  Invocation: 2e3a2be5a6d24b62b841c92bdd4f3119
>    Triggers: ● systemd-journald.service
>        Docs: man:systemd-journald.service(8)
>              man:journald.conf(5)
>      Listen: /run/systemd/journal/dev-log (Datagram)
>
> # systemctl status systemd-journald.socket
> ● systemd-journald.socket - Journal Sockets
>      Loaded: loaded (/usr/lib/systemd/system/systemd-journald.socket; static)
>      Active: active (running) since Sun 2026-08-09 10:33:05 AEST; 10h ago
>  Invocation: d43d3185e3534a1c881c31bbacc851ec
>    Triggers: ● systemd-journald.service
>        Docs: man:systemd-journald.service(8)
>              man:journald.conf(5)
>      Listen: /run/systemd/journal/socket (Datagram)
>              /run/systemd/journal/stdout (Stream)
>
> Notice: journal has been rotated since unit was started, output may be 
> incomplete.
>
> The syslog socket seems covered by systemd, but that doesn't need a 
> transition:
>
> # sesearch -T -t syslogd_runtime_t -c sock_file
> type_transition syslogd_t syslogd_runtime_t:sock_file devlog_t 
> io.systemd.journal;

-- 
gpg --auto-key-locate clear,nodefault,wkd --locate-external-keys dominick.grift@defensec.nl
Key fingerprint = FCD2 3660 5D6B 9D27 7FC6  E0FF DA7E 521F 10F6 4098
Dominick Grift
Mastodon: @kcinimod@defensec.nl

Re: [RFC 2] logging.te: systemd-journald: loose ends

[Russell Coker]

On Sunday, 9 August 2026 21:35:54 AEST Dominick Grift wrote:
> Thanks. I think the user may not have these sockets activated and that
> therefore they get created by systemd-journald instead in his
> scenario. systemd-journald itself does not seems to use
> get/setfscreatecon as it needs a type transition for io.systemd.journal
> too.
> 
> I suppose the question becomes whether refpolicy wants to support the
> scenario where the syslog socket unit is not enabled.

What is Gentoo planing to do regarding defaults for this?

It seems to me that if you are going systemd then do it properly and use the 
socket units.  Then you can restart systemd-journald without affecting 
connections.

-- 
My Main Blog         http://etbe.coker.com.au/
My Documents Blog    http://doc.coker.com.au/

Re: [RFC 2] logging.te: systemd-journald: loose ends

[Christopher J. PeBenito]

On 8/9/26 7:35 AM, Dominick Grift wrote:
> Russell Coker <russell@coker.com.au> writes:
>
>> On Sunday, 9 August 2026 21:05:27 AEST Dominick Grift wrote:
>>> Do you have any type transition rules for those at all?
>>>
>>> sesearch -T -s syslogd_t -t syslogd_runtime_t -c sock_file
>> # sesearch -T -s syslogd_t -t syslogd_runtime_t -c sock_file
>> type_transition syslogd_t syslogd_runtime_t:sock_file devlog_t
>> io.systemd.journal;
>>
>> No I only have one rule.
> Thanks. I think the user may not have these sockets activated and that
> therefore they get created by systemd-journald instead in his
> scenario. systemd-journald itself does not seems to use
> get/setfscreatecon as it needs a type transition for io.systemd.journal
> too.
>
> I suppose the question becomes whether refpolicy wants to support the
> scenario where the syslog socket unit is not enabled.

Yes, this should be corrected.


-- 
Chris PeBenito