|
Dominick Grift |
8da8285 |
policy_module(logrotate, 1.14.4)
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
########################################
|
|
Chris PeBenito |
9401ae1 |
#
|
|
Chris PeBenito |
9401ae1 |
# Declarations
|
|
Chris PeBenito |
9401ae1 |
#
|
|
Chris PeBenito |
9401ae1 |
|
|
Dominick Grift |
7e6a262 |
attribute_role logrotate_roles;
|
|
Dominick Grift |
7e6a262 |
roleattribute system_r logrotate_roles;
|
|
Dominick Grift |
7e6a262 |
|
|
Chris PeBenito |
9401ae1 |
type logrotate_t;
|
|
Dominick Grift |
7e6a262 |
type logrotate_exec_t;
|
|
Chris PeBenito |
9401ae1 |
domain_type(logrotate_t)
|
|
Chris PeBenito |
9401ae1 |
domain_obj_id_change_exemption(logrotate_t)
|
|
Chris PeBenito |
9401ae1 |
domain_system_change_exemption(logrotate_t)
|
|
Chris PeBenito |
9401ae1 |
domain_entry_file(logrotate_t, logrotate_exec_t)
|
|
Dominick Grift |
7e6a262 |
role logrotate_roles types logrotate_t;
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
type logrotate_lock_t;
|
|
Chris PeBenito |
9401ae1 |
files_lock_file(logrotate_lock_t)
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
type logrotate_tmp_t;
|
|
Chris PeBenito |
9401ae1 |
files_tmp_file(logrotate_tmp_t)
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
type logrotate_var_lib_t;
|
|
Chris PeBenito |
9401ae1 |
files_type(logrotate_var_lib_t)
|
|
Chris PeBenito |
9401ae1 |
|
|
Dominick Grift |
7e6a262 |
mta_base_mail_template(logrotate)
|
|
Dominick Grift |
7e6a262 |
role system_r types logrotate_mail_t;
|
|
Dominick Grift |
7e6a262 |
|
|
Chris PeBenito |
9401ae1 |
########################################
|
|
Chris PeBenito |
9401ae1 |
#
|
|
Chris PeBenito |
9401ae1 |
# Local policy
|
|
Chris PeBenito |
9401ae1 |
#
|
|
Chris PeBenito |
9401ae1 |
|
|
Dominick Grift |
7e6a262 |
allow logrotate_t self:capability { chown dac_override dac_read_search kill fsetid fowner setuid setgid sys_resource sys_nice };
|
|
Dominick Grift |
7e6a262 |
allow logrotate_t self:process ~{ ptrace setcurrent setexec setrlimit execmem execstack execheap };
|
|
Chris PeBenito |
9401ae1 |
allow logrotate_t self:fd use;
|
|
Dominick Grift |
7e6a262 |
allow logrotate_t self:key manage_key_perms;
|
|
Chris PeBenito |
9401ae1 |
allow logrotate_t self:fifo_file rw_fifo_file_perms;
|
|
Chris PeBenito |
9401ae1 |
allow logrotate_t self:unix_dgram_socket sendto;
|
|
Dominick Grift |
7e6a262 |
allow logrotate_t self:unix_stream_socket { accept connectto listen };
|
|
Chris PeBenito |
9401ae1 |
allow logrotate_t self:shm create_shm_perms;
|
|
Chris PeBenito |
9401ae1 |
allow logrotate_t self:sem create_sem_perms;
|
|
Chris PeBenito |
9401ae1 |
allow logrotate_t self:msgq create_msgq_perms;
|
|
Chris PeBenito |
9401ae1 |
allow logrotate_t self:msg { send receive };
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
allow logrotate_t logrotate_lock_t:file manage_file_perms;
|
|
Chris PeBenito |
9401ae1 |
files_lock_filetrans(logrotate_t, logrotate_lock_t, file)
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
manage_dirs_pattern(logrotate_t, logrotate_tmp_t, logrotate_tmp_t)
|
|
Chris PeBenito |
9401ae1 |
manage_files_pattern(logrotate_t, logrotate_tmp_t, logrotate_tmp_t)
|
|
Chris PeBenito |
9401ae1 |
files_tmp_filetrans(logrotate_t, logrotate_tmp_t, { file dir })
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
create_dirs_pattern(logrotate_t, logrotate_var_lib_t, logrotate_var_lib_t)
|
|
Chris PeBenito |
9401ae1 |
manage_files_pattern(logrotate_t, logrotate_var_lib_t, logrotate_var_lib_t)
|
|
Dominick Grift |
7e6a262 |
read_lnk_files_pattern(logrotate_t, logrotate_var_lib_t, logrotate_var_lib_t)
|
|
Chris PeBenito |
9401ae1 |
files_var_lib_filetrans(logrotate_t, logrotate_var_lib_t, file)
|
|
Chris PeBenito |
9401ae1 |
|
|
Dominick Grift |
7e6a262 |
can_exec(logrotate_t, logrotate_tmp_t)
|
|
Dominick Grift |
7e6a262 |
|
|
Chris PeBenito |
9401ae1 |
kernel_read_system_state(logrotate_t)
|
|
Chris PeBenito |
9401ae1 |
kernel_read_kernel_sysctls(logrotate_t)
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
corecmd_exec_bin(logrotate_t)
|
|
Chris PeBenito |
9401ae1 |
corecmd_exec_shell(logrotate_t)
|
|
Dominick Grift |
7e6a262 |
corecmd_getattr_all_executables(logrotate_t)
|
|
Dominick Grift |
7e6a262 |
|
|
Dominick Grift |
7e6a262 |
dev_read_urand(logrotate_t)
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
domain_signal_all_domains(logrotate_t)
|
|
Chris PeBenito |
9401ae1 |
domain_use_interactive_fds(logrotate_t)
|
|
Chris PeBenito |
9401ae1 |
domain_getattr_all_entry_files(logrotate_t)
|
|
Chris PeBenito |
9401ae1 |
domain_read_all_domains_state(logrotate_t)
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
files_read_usr_files(logrotate_t)
|
|
Chris PeBenito |
9401ae1 |
files_read_etc_runtime_files(logrotate_t)
|
|
Chris PeBenito |
9401ae1 |
files_read_all_pids(logrotate_t)
|
|
Chris PeBenito |
9401ae1 |
files_search_all(logrotate_t)
|
|
Chris PeBenito |
9401ae1 |
files_read_var_lib_files(logrotate_t)
|
|
Chris PeBenito |
9401ae1 |
files_manage_generic_spool(logrotate_t)
|
|
Chris PeBenito |
9401ae1 |
files_manage_generic_spool_dirs(logrotate_t)
|
|
Chris PeBenito |
9401ae1 |
files_getattr_generic_locks(logrotate_t)
|
|
Dominick Grift |
7e6a262 |
files_dontaudit_list_mnt(logrotate_t)
|
|
Dominick Grift |
7e6a262 |
|
|
Dominick Grift |
7e6a262 |
fs_search_auto_mountpoints(logrotate_t)
|
|
Dominick Grift |
7e6a262 |
fs_getattr_xattr_fs(logrotate_t)
|
|
Dominick Grift |
7e6a262 |
fs_list_inotifyfs(logrotate_t)
|
|
Dominick Grift |
7e6a262 |
|
|
Dominick Grift |
7e6a262 |
mls_file_read_all_levels(logrotate_t)
|
|
Dominick Grift |
7e6a262 |
mls_file_write_all_levels(logrotate_t)
|
|
Dominick Grift |
7e6a262 |
mls_file_upgrade(logrotate_t)
|
|
Dominick Grift |
7e6a262 |
mls_process_write_to_clearance(logrotate_t)
|
|
Dominick Grift |
7e6a262 |
|
|
Dominick Grift |
7e6a262 |
selinux_get_fs_mount(logrotate_t)
|
|
Dominick Grift |
7e6a262 |
selinux_get_enforce_mode(logrotate_t)
|
|
Dominick Grift |
7e6a262 |
|
|
Dominick Grift |
7e6a262 |
auth_manage_login_records(logrotate_t)
|
|
Dominick Grift |
7e6a262 |
auth_use_nsswitch(logrotate_t)
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
init_domtrans_script(logrotate_t)
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
logging_manage_all_logs(logrotate_t)
|
|
Chris PeBenito |
9401ae1 |
logging_send_syslog_msg(logrotate_t)
|
|
Chris PeBenito |
9401ae1 |
logging_send_audit_msgs(logrotate_t)
|
|
Chris PeBenito |
9401ae1 |
logging_exec_all_logs(logrotate_t)
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
miscfiles_read_localization(logrotate_t)
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
seutil_dontaudit_read_config(logrotate_t)
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
userdom_use_user_terminals(logrotate_t)
|
|
Chris PeBenito |
9401ae1 |
userdom_list_user_home_dirs(logrotate_t)
|
|
Chris PeBenito |
9401ae1 |
userdom_use_unpriv_users_fds(logrotate_t)
|
|
Chris PeBenito |
9401ae1 |
|
|
Dominick Grift |
5b9d71f |
mta_sendmail_domtrans(logrotate_t, logrotate_mail_t)
|
|
Dominick Grift |
5b9d71f |
|
|
Dominick Grift |
7e6a262 |
ifdef(`distro_debian',`
|
|
Dominick Grift |
7e6a262 |
allow logrotate_t logrotate_tmp_t:file relabel_file_perms;
|
|
Chris PeBenito |
9401ae1 |
can_exec(logrotate_t, logrotate_exec_t)
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
logging_check_exec_syslog(logrotate_t)
|
|
Dominick Grift |
7e6a262 |
logging_read_syslog_config(logrotate_t)
|
|
Chris PeBenito |
9401ae1 |
')
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
optional_policy(`
|
|
Dominick Grift |
8da8285 |
abrt_manage_cache(logrotate_t)
|
|
Chris PeBenito |
9401ae1 |
')
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
optional_policy(`
|
|
Chris PeBenito |
9401ae1 |
acct_domtrans(logrotate_t)
|
|
Chris PeBenito |
9401ae1 |
acct_manage_data(logrotate_t)
|
|
Chris PeBenito |
9401ae1 |
acct_exec_data(logrotate_t)
|
|
Chris PeBenito |
9401ae1 |
')
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
optional_policy(`
|
|
Chris PeBenito |
9401ae1 |
apache_read_config(logrotate_t)
|
|
Chris PeBenito |
9401ae1 |
apache_domtrans(logrotate_t)
|
|
Chris PeBenito |
9401ae1 |
apache_signull(logrotate_t)
|
|
Chris PeBenito |
9401ae1 |
')
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
optional_policy(`
|
|
Chris PeBenito |
9401ae1 |
asterisk_domtrans(logrotate_t)
|
|
Chris PeBenito |
9401ae1 |
')
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
optional_policy(`
|
|
Dominick Grift |
7e6a262 |
awstats_domtrans(logrotate_t)
|
|
Dominick Grift |
7e6a262 |
')
|
|
Dominick Grift |
7e6a262 |
|
|
Dominick Grift |
7e6a262 |
optional_policy(`
|
|
Chris PeBenito |
9401ae1 |
bind_manage_cache(logrotate_t)
|
|
Chris PeBenito |
9401ae1 |
')
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
optional_policy(`
|
|
Dominick Grift |
7e6a262 |
callweaver_exec(logrotate_t)
|
|
Dominick Grift |
7e6a262 |
callweaver_stream_connect(logrotate_t)
|
|
Dominick Grift |
7e6a262 |
')
|
|
Dominick Grift |
7e6a262 |
|
|
Dominick Grift |
7e6a262 |
optional_policy(`
|
|
Chris PeBenito |
9401ae1 |
consoletype_exec(logrotate_t)
|
|
Chris PeBenito |
9401ae1 |
')
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
optional_policy(`
|
|
Dominick Grift |
7e6a262 |
cron_system_entry(logrotate_t, logrotate_exec_t)
|
|
Dominick Grift |
7e6a262 |
cron_search_spool(logrotate_t)
|
|
Dominick Grift |
7e6a262 |
')
|
|
Dominick Grift |
7e6a262 |
|
|
Dominick Grift |
7e6a262 |
optional_policy(`
|
|
Chris PeBenito |
9401ae1 |
cups_domtrans(logrotate_t)
|
|
Chris PeBenito |
9401ae1 |
')
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
optional_policy(`
|
|
Chris PeBenito |
9401ae1 |
fail2ban_stream_connect(logrotate_t)
|
|
Chris PeBenito |
9401ae1 |
')
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
optional_policy(`
|
|
Chris PeBenito |
9401ae1 |
hostname_exec(logrotate_t)
|
|
Chris PeBenito |
9401ae1 |
')
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
optional_policy(`
|
|
Dominick Grift |
7e6a262 |
chronyd_read_key_files(logrotate_t)
|
|
Dominick Grift |
7e6a262 |
')
|
|
Dominick Grift |
7e6a262 |
|
|
Dominick Grift |
7e6a262 |
optional_policy(`
|
|
Chris PeBenito |
9401ae1 |
icecast_signal(logrotate_t)
|
|
Chris PeBenito |
9401ae1 |
')
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
optional_policy(`
|
|
Chris PeBenito |
9401ae1 |
mailman_domtrans(logrotate_t)
|
|
Chris PeBenito |
9401ae1 |
mailman_search_data(logrotate_t)
|
|
Chris PeBenito |
9401ae1 |
mailman_manage_log(logrotate_t)
|
|
Chris PeBenito |
9401ae1 |
')
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
optional_policy(`
|
|
Chris PeBenito |
9401ae1 |
munin_read_config(logrotate_t)
|
|
Chris PeBenito |
9401ae1 |
munin_stream_connect(logrotate_t)
|
|
Chris PeBenito |
9401ae1 |
munin_search_lib(logrotate_t)
|
|
Chris PeBenito |
9401ae1 |
')
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
optional_policy(`
|
|
Chris PeBenito |
9401ae1 |
mysql_read_config(logrotate_t)
|
|
Chris PeBenito |
9401ae1 |
mysql_stream_connect(logrotate_t)
|
|
Chris PeBenito |
9401ae1 |
')
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
optional_policy(`
|
|
Dominick Grift |
7e6a262 |
polipo_log_filetrans_log(logrotate_t, file, "polipo")
|
|
Chris PeBenito |
9401ae1 |
')
|
|
Chris PeBenito |
9401ae1 |
|
|
Dominick Grift |
7e6a262 |
optional_policy(`
|
|
Dominick Grift |
7e6a262 |
psad_domtrans(logrotate_t)
|
|
Dominick Grift |
7e6a262 |
')
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
optional_policy(`
|
|
Chris PeBenito |
9401ae1 |
samba_exec_log(logrotate_t)
|
|
Chris PeBenito |
9401ae1 |
')
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
optional_policy(`
|
|
Chris PeBenito |
9401ae1 |
sssd_domtrans(logrotate_t)
|
|
Chris PeBenito |
9401ae1 |
')
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
optional_policy(`
|
|
Chris PeBenito |
9401ae1 |
slrnpull_manage_spool(logrotate_t)
|
|
Chris PeBenito |
9401ae1 |
')
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
optional_policy(`
|
|
Chris PeBenito |
9401ae1 |
squid_domtrans(logrotate_t)
|
|
Chris PeBenito |
9401ae1 |
')
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
optional_policy(`
|
|
Chris PeBenito |
9401ae1 |
su_exec(logrotate_t)
|
|
Chris PeBenito |
9401ae1 |
')
|
|
Chris PeBenito |
9401ae1 |
|
|
Chris PeBenito |
9401ae1 |
optional_policy(`
|
|
Chris PeBenito |
9401ae1 |
varnishd_manage_log(logrotate_t)
|
|
Chris PeBenito |
9401ae1 |
')
|
|
Dominick Grift |
7e6a262 |
|
|
Dominick Grift |
7e6a262 |
#######################################
|
|
Dominick Grift |
7e6a262 |
#
|
|
Dominick Grift |
7e6a262 |
# Mail local policy
|
|
Dominick Grift |
7e6a262 |
#
|
|
Dominick Grift |
7e6a262 |
|
|
Dominick Grift |
bf2786c |
allow logrotate_mail_t logrotate_t:fd use;
|
|
Dominick Grift |
bf2786c |
allow logrotate_mail_t logrotate_t:fifo_file rw_fifo_file_perms;
|
|
Dominick Grift |
bf2786c |
allow logrotate_mail_t logrotate_t:process sigchld;
|
|
Dominick Grift |
bf2786c |
|
|
Dominick Grift |
7e6a262 |
manage_files_pattern(logrotate_mail_t, logrotate_tmp_t, logrotate_tmp_t)
|
|
Dominick Grift |
7e6a262 |
|
|
Dominick Grift |
7e6a262 |
logging_read_all_logs(logrotate_mail_t)
|