Re: [RFC 2] logging.te: systemd-journald: loose ends
Dominick Grift <[email protected]>
| Newsgroups | org.kernel.vger.selinux-refpolicy |
|---|---|
| Message-ID | <[email protected]> |
Russell Coker <[email protected]> writes: > On Sunday, 9 August 2026 18:08:46 AEST Dominick Grift wrote: >> rfc because i was unable to (build)test it. >> >> add missing file type transition rules so that systemd-journald >> creates these sockets as per the corresponding fc specs for consistency. >> >> the previous rfc did not take the existing fc specs into account >> >> Signed-off-by: Dominick Grift <[email protected]> >> --- >> policy/modules/system/logging.te | 6 ++++++ >> 1 file changed, 6 insertions(+) >> >> diff --git a/policy/modules/system/logging.te >> b/policy/modules/system/logging.te index 314b2559b..b58dda6d3 100644 >> --- a/policy/modules/system/logging.te >> +++ b/policy/modules/system/logging.te >> @@ -518,6 +518,12 @@ ifdef(`init_systemd',` >> allow syslogd_t self:cap_userns sys_ptrace; >> allow syslogd_t self:netlink_audit_socket { getattr getopt > nlmsg_write >> read setopt write }; >> >> + # /run/systemd/journal: for consistency with corresponding fc specs >> + filetrans_pattern(syslogd_t, syslogd_runtime_t, "dev-log", > sock_file, >> devlog_t) + filetrans_pattern(syslogd_t, syslogd_runtime_t, "socket", >> sock_file, devlog_t) + filetrans_pattern(syslogd_t, syslogd_runtime_t, >> "stdout", sock_file, devlog_t) + filetrans_pattern(syslogd_t, >> syslogd_runtime_t, "syslog", sock_file, devlog_t) + >> # remove /run/log/journal when switching to permanent storage >> allow syslogd_t var_log_t:dir rmdir; > > I have the following in the Debian policy. You seem to have the order wrong. > > filetrans_pattern(syslogd_t, syslogd_runtime_t, devlog_t, sock_file, > "io.systemd.journal") Interesting. On IRC a gentoo user ran into labeling issues of the dev-log sock file where it was labeled syslogd_runtime_t instead of devlog_t Looks like I also have the filetrans_pattern arg ordering wrong. > > The others don't seem to be needed: Do you have any type transition rules for those at all? sesearch -T -s syslogd_t -t syslogd_runtime_t -c sock_file > > # ls -laZ /run/systemd/journal/ > total 8 > drwxr-xr-x. 3 root root system_u:object_r:syslogd_runtime_t:s0 220 Aug 9 > 10:33 . > drwxr-xr-x. 26 root root system_u:object_r:init_runtime_t:s0 880 Aug 9 > 20:27 .. > srw-rw-rw-. 1 root root system_u:object_r:devlog_t:s0 0 Aug 9 > 10:33 dev-log > -rw-r--r--. 1 root root system_u:object_r:syslogd_runtime_t:s0 0 Aug 9 > 10:33 flushed > srw-rw-rw-. 1 root root system_u:object_r:devlog_t:s0 0 Aug 9 > 10:33 io.systemd.journal > -rw-r--r--. 1 root root system_u:object_r:syslogd_runtime_t:s0 8 Aug 9 > 10:33 kernel-seqnum > -rw-r--r--. 1 root root system_u:object_r:syslogd_runtime_t:s0 24 Aug 9 > 10:33 seqnum > srw-rw-rw-. 1 root root system_u:object_r:devlog_t:s0 0 Aug 9 > 10:33 socket > srw-rw-rw-. 1 root root system_u:object_r:devlog_t:s0 0 Aug 9 > 10:33 stdout > drwxr-xr-x. 2 root root system_u:object_r:syslogd_runtime_t:s0 1520 Aug 9 > 20:50 streams > srw-rw-rw-. 1 root root system_u:object_r:devlog_t:s0 0 Aug 9 > 10:33 syslog -- gpg --auto-key-locate clear,nodefault,wkd --locate-external-keys [email protected] Key fingerprint = FCD2 3660 5D6B 9D27 7FC6 E0FF DA7E 521F 10F6 4098 Dominick Grift Mastodon: @[email protected]