Re: [RFC 2] logging.te: systemd-journald: loose ends

Russell Coker <[email protected]> writes:

> On Sunday, 9 August 2026 21:05:27 AEST Dominick Grift wrote:
>> Do you have any type transition rules for those at all?
>> 
>> sesearch -T -s syslogd_t -t syslogd_runtime_t -c sock_file
>
> # sesearch -T -s syslogd_t -t syslogd_runtime_t -c sock_file
> type_transition syslogd_t syslogd_runtime_t:sock_file devlog_t 
> io.systemd.journal;
>
> No I only have one rule.

Thanks. I think the user may not have these sockets activated and that
therefore they get created by systemd-journald instead in his
scenario. systemd-journald itself does not seems to use
get/setfscreatecon as it needs a type transition for io.systemd.journal
too.

I suppose the question becomes whether refpolicy wants to support the
scenario where the syslog socket unit is not enabled.

>
> # systemctl status syslog.socket
> ● syslog.socket - Syslog Socket
>      Loaded: loaded (/usr/lib/systemd/system/syslog.socket; static)
>      Active: active (running) since Sun 2026-08-09 10:33:04 AEST; 10h ago
>  Invocation: d0566e3b35b44b7098fe98ca38d88c7e
>    Triggers: ● rsyslog.service
>        Docs: man:systemd.special(7)
>              https://systemd.io/SYSLOG
>      Listen: /run/systemd/journal/syslog (Datagram)
>
> # systemctl status systemd-journald-dev-log.socket
> ● systemd-journald-dev-log.socket - Journal Socket (/dev/log)
>      Loaded: loaded (/usr/lib/systemd/system/systemd-journald-dev-log.socket; 
> static)
>      Active: active (running) since Sun 2026-08-09 10:33:05 AEST; 10h ago
>  Invocation: 2e3a2be5a6d24b62b841c92bdd4f3119
>    Triggers: ● systemd-journald.service
>        Docs: man:systemd-journald.service(8)
>              man:journald.conf(5)
>      Listen: /run/systemd/journal/dev-log (Datagram)
>
> # systemctl status systemd-journald.socket
> ● systemd-journald.socket - Journal Sockets
>      Loaded: loaded (/usr/lib/systemd/system/systemd-journald.socket; static)
>      Active: active (running) since Sun 2026-08-09 10:33:05 AEST; 10h ago
>  Invocation: d43d3185e3534a1c881c31bbacc851ec
>    Triggers: ● systemd-journald.service
>        Docs: man:systemd-journald.service(8)
>              man:journald.conf(5)
>      Listen: /run/systemd/journal/socket (Datagram)
>              /run/systemd/journal/stdout (Stream)
>
> Notice: journal has been rotated since unit was started, output may be 
> incomplete.
>
> The syslog socket seems covered by systemd, but that doesn't need a 
> transition:
>
> # sesearch -T -t syslogd_runtime_t -c sock_file
> type_transition syslogd_t syslogd_runtime_t:sock_file devlog_t 
> io.systemd.journal;

-- 
gpg --auto-key-locate clear,nodefault,wkd --locate-external-keys [email protected]
Key fingerprint = FCD2 3660 5D6B 9D27 7FC6  E0FF DA7E 521F 10F6 4098
Dominick Grift
Mastodon: @[email protected]