Re: [RFC] logging: tidy loose end related to systemd-journald

[Dominick Grift <dominick.grift@defensec.nl>]

Dominick Grift <dominick.grift@defensec.nl> writes:

> RFC because I was unable to test this.

Turns out that this is atleast incomplete because there are fc specs
that conflict remaining [1] and they indicate that the labeling is
intended to be different. I don't see why according to the fc spec that
content should be devlog_t and how that transition is supposed to
happen.

[1] https://github.com/SELinuxProject/refpolicy/blob/main/policy/modules/system/logging.fc#L78C1-L82C97

>
> Signed-off-by: Dominick Grift <dominick.grift@defensec.nl>
> ---
>  policy/modules/system/logging.if | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/policy/modules/system/logging.if b/policy/modules/system/logging.if
> index 3dd2c06c2..6222fed4b 100644
> --- a/policy/modules/system/logging.if
> +++ b/policy/modules/system/logging.if
> @@ -684,8 +684,8 @@ interface(`logging_send_syslog_msg',`
>  	allow $1 devlog_t:sock_file write_sock_file_perms;
>  
>  	# systemd journal socket is in /run/systemd/journal/dev-log
> +	write_sock_files_pattern($1, syslogd_runtime_t, syslogd_runtime_t)
>  	init_search_run($1)
> -	allow $1 syslogd_runtime_t:dir search_dir_perms;
>  
>  	# the type of socket depends on the syslog daemon
>  	allow $1 syslogd_t:unix_dgram_socket sendto;

-- 
gpg --auto-key-locate clear,nodefault,wkd --locate-external-keys dominick.grift@defensec.nl
Key fingerprint = FCD2 3660 5D6B 9D27 7FC6  E0FF DA7E 521F 10F6 4098
Dominick Grift
Mastodon: @kcinimod@defensec.nl