[RFC 2] logging.te: systemd-journald: loose ends
Dominick Grift <[email protected]>
| Newsgroups | org.kernel.vger.selinux-refpolicy |
|---|---|
| Message-ID | <[email protected]> |
rfc because i was unable to (build)test it. add missing file type transition rules so that systemd-journald creates these sockets as per the corresponding fc specs for consistency. the previous rfc did not take the existing fc specs into account Signed-off-by: Dominick Grift <[email protected]> --- policy/modules/system/logging.te | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te index 314b2559b..b58dda6d3 100644 --- a/policy/modules/system/logging.te +++ b/policy/modules/system/logging.te @@ -518,6 +518,12 @@ ifdef(`init_systemd',` allow syslogd_t self:cap_userns sys_ptrace; allow syslogd_t self:netlink_audit_socket { getattr getopt nlmsg_write read setopt write }; + # /run/systemd/journal: for consistency with corresponding fc specs + filetrans_pattern(syslogd_t, syslogd_runtime_t, "dev-log", sock_file, devlog_t) + filetrans_pattern(syslogd_t, syslogd_runtime_t, "socket", sock_file, devlog_t) + filetrans_pattern(syslogd_t, syslogd_runtime_t, "stdout", sock_file, devlog_t) + filetrans_pattern(syslogd_t, syslogd_runtime_t, "syslog", sock_file, devlog_t) + # remove /run/log/journal when switching to permanent storage allow syslogd_t var_log_t:dir rmdir; -- 2.53.0