Re: [RFC 2] logging.te: systemd-journald: loose ends

On Sunday, 9 August 2026 21:05:27 AEST Dominick Grift wrote:
> Do you have any type transition rules for those at all?
> 
> sesearch -T -s syslogd_t -t syslogd_runtime_t -c sock_file

# sesearch -T -s syslogd_t -t syslogd_runtime_t -c sock_file
type_transition syslogd_t syslogd_runtime_t:sock_file devlog_t 
io.systemd.journal;

No I only have one rule.

# systemctl status syslog.socket
● syslog.socket - Syslog Socket
     Loaded: loaded (/usr/lib/systemd/system/syslog.socket; static)
     Active: active (running) since Sun 2026-08-09 10:33:04 AEST; 10h ago
 Invocation: d0566e3b35b44b7098fe98ca38d88c7e
   Triggers: ● rsyslog.service
       Docs: man:systemd.special(7)
             https://systemd.io/SYSLOG
     Listen: /run/systemd/journal/syslog (Datagram)

# systemctl status systemd-journald-dev-log.socket
● systemd-journald-dev-log.socket - Journal Socket (/dev/log)
     Loaded: loaded (/usr/lib/systemd/system/systemd-journald-dev-log.socket; 
static)
     Active: active (running) since Sun 2026-08-09 10:33:05 AEST; 10h ago
 Invocation: 2e3a2be5a6d24b62b841c92bdd4f3119
   Triggers: ● systemd-journald.service
       Docs: man:systemd-journald.service(8)
             man:journald.conf(5)
     Listen: /run/systemd/journal/dev-log (Datagram)

# systemctl status systemd-journald.socket
● systemd-journald.socket - Journal Sockets
     Loaded: loaded (/usr/lib/systemd/system/systemd-journald.socket; static)
     Active: active (running) since Sun 2026-08-09 10:33:05 AEST; 10h ago
 Invocation: d43d3185e3534a1c881c31bbacc851ec
   Triggers: ● systemd-journald.service
       Docs: man:systemd-journald.service(8)
             man:journald.conf(5)
     Listen: /run/systemd/journal/socket (Datagram)
             /run/systemd/journal/stdout (Stream)

Notice: journal has been rotated since unit was started, output may be 
incomplete.

The syslog socket seems covered by systemd, but that doesn't need a 
transition:

# sesearch -T -t syslogd_runtime_t -c sock_file
type_transition syslogd_t syslogd_runtime_t:sock_file devlog_t 
io.systemd.journal;

-- 
My Main Blog         http://etbe.coker.com.au/
My Documents Blog    http://doc.coker.com.au/