Re: [RFC 2] logging.te: systemd-journald: loose ends

On Sunday, 9 August 2026 18:08:46 AEST Dominick Grift wrote:
> rfc because i was unable to (build)test it.
> 
> add missing file type transition rules so that systemd-journald
> creates these sockets as per the corresponding fc specs for consistency.
> 
> the previous rfc did not take the existing fc specs into account
> 
> Signed-off-by: Dominick Grift <[email protected]>
> ---
>  policy/modules/system/logging.te | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/policy/modules/system/logging.te
> b/policy/modules/system/logging.te index 314b2559b..b58dda6d3 100644
> --- a/policy/modules/system/logging.te
> +++ b/policy/modules/system/logging.te
> @@ -518,6 +518,12 @@ ifdef(`init_systemd',`
>  	allow syslogd_t self:cap_userns sys_ptrace;
>  	allow syslogd_t self:netlink_audit_socket { getattr getopt 
nlmsg_write
> read setopt write };
> 
> +	# /run/systemd/journal: for consistency with corresponding fc specs
> +	filetrans_pattern(syslogd_t, syslogd_runtime_t, "dev-log", 
sock_file,
> devlog_t) +	filetrans_pattern(syslogd_t, syslogd_runtime_t, "socket",
> sock_file, devlog_t) +	filetrans_pattern(syslogd_t, syslogd_runtime_t,
> "stdout", sock_file, devlog_t) +	filetrans_pattern(syslogd_t,
> syslogd_runtime_t, "syslog", sock_file, devlog_t) +
>  	# remove /run/log/journal when switching to permanent storage
>  	allow syslogd_t var_log_t:dir rmdir;

I have the following in the Debian policy.  You seem to have the order wrong.

filetrans_pattern(syslogd_t, syslogd_runtime_t, devlog_t, sock_file, 
"io.systemd.journal")

The others don't seem to be needed:

# ls -laZ /run/systemd/journal/
total 8
drwxr-xr-x.  3 root root system_u:object_r:syslogd_runtime_t:s0  220 Aug  9 
10:33 .
drwxr-xr-x. 26 root root system_u:object_r:init_runtime_t:s0     880 Aug  9 
20:27 ..
srw-rw-rw-.  1 root root system_u:object_r:devlog_t:s0             0 Aug  9 
10:33 dev-log
-rw-r--r--.  1 root root system_u:object_r:syslogd_runtime_t:s0    0 Aug  9 
10:33 flushed
srw-rw-rw-.  1 root root system_u:object_r:devlog_t:s0             0 Aug  9 
10:33 io.systemd.journal
-rw-r--r--.  1 root root system_u:object_r:syslogd_runtime_t:s0    8 Aug  9 
10:33 kernel-seqnum
-rw-r--r--.  1 root root system_u:object_r:syslogd_runtime_t:s0   24 Aug  9 
10:33 seqnum
srw-rw-rw-.  1 root root system_u:object_r:devlog_t:s0             0 Aug  9 
10:33 socket
srw-rw-rw-.  1 root root system_u:object_r:devlog_t:s0             0 Aug  9 
10:33 stdout
drwxr-xr-x.  2 root root system_u:object_r:syslogd_runtime_t:s0 1520 Aug  9 
20:50 streams
srw-rw-rw-.  1 root root system_u:object_r:devlog_t:s0             0 Aug  9 
10:33 syslog

-- 
My Main Blog         http://etbe.coker.com.au/
My Documents Blog    http://doc.coker.com.au/