policy_module(logrotate, 1.14.0)

########################################

#

# Declarations

#

type logrotate_t;

domain_type(logrotate_t)

domain_obj_id_change_exemption(logrotate_t)

domain_system_change_exemption(logrotate_t)

role system_r types logrotate_t;

type logrotate_exec_t;

domain_entry_file(logrotate_t, logrotate_exec_t)

type logrotate_lock_t;

files_lock_file(logrotate_lock_t)

type logrotate_tmp_t;

files_tmp_file(logrotate_tmp_t)

type logrotate_var_lib_t;

files_type(logrotate_var_lib_t)

########################################

#

# Local policy

#

# Change ownership on log files.

allow logrotate_t self:capability { chown dac_override dac_read_search kill fsetid fowner setuid setgid sys_resource sys_nice sys_ptrace };

dontaudit logrotate_t self:capability sys_resource;

allow logrotate_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };

# Set a context other than the default one for newly created files.

allow logrotate_t self:process setfscreate;

allow logrotate_t self:fd use;

allow logrotate_t self:key manage_key_perms;

allow logrotate_t self:fifo_file rw_fifo_file_perms;

allow logrotate_t self:unix_dgram_socket create_socket_perms;

allow logrotate_t self:unix_stream_socket create_stream_socket_perms;

allow logrotate_t self:unix_dgram_socket sendto;

allow logrotate_t self:unix_stream_socket connectto;

allow logrotate_t self:shm create_shm_perms;

allow logrotate_t self:sem create_sem_perms;

allow logrotate_t self:msgq create_msgq_perms;

allow logrotate_t self:msg { send receive };

allow logrotate_t logrotate_lock_t:file manage_file_perms;

files_lock_filetrans(logrotate_t, logrotate_lock_t, file)

can_exec(logrotate_t, logrotate_tmp_t)

manage_dirs_pattern(logrotate_t, logrotate_tmp_t, logrotate_tmp_t)

manage_files_pattern(logrotate_t, logrotate_tmp_t, logrotate_tmp_t)

files_tmp_filetrans(logrotate_t, logrotate_tmp_t, { file dir })

# for /var/lib/logrotate.status and /var/lib/logcheck

create_dirs_pattern(logrotate_t, logrotate_var_lib_t, logrotate_var_lib_t)

manage_files_pattern(logrotate_t, logrotate_var_lib_t, logrotate_var_lib_t)

read_lnk_files_pattern(logrotate_t, logrotate_var_lib_t, logrotate_var_lib_t)

files_var_lib_filetrans(logrotate_t, logrotate_var_lib_t, file)

kernel_read_system_state(logrotate_t)

kernel_read_kernel_sysctls(logrotate_t)

dev_read_urand(logrotate_t)

fs_search_auto_mountpoints(logrotate_t)

fs_getattr_xattr_fs(logrotate_t)

fs_list_inotifyfs(logrotate_t)

mls_file_read_all_levels(logrotate_t)

mls_file_write_all_levels(logrotate_t)

mls_file_upgrade(logrotate_t)

mls_process_write_to_clearance(logrotate_t)

selinux_get_fs_mount(logrotate_t)

selinux_get_enforce_mode(logrotate_t)

auth_manage_login_records(logrotate_t)

auth_use_nsswitch(logrotate_t)

# Run helper programs.

corecmd_exec_bin(logrotate_t)

corecmd_exec_shell(logrotate_t)

corecmd_getattr_all_executables(logrotate_t)

domain_signal_all_domains(logrotate_t)

domain_use_interactive_fds(logrotate_t)

domain_getattr_all_entry_files(logrotate_t)

# Read /proc/PID directories for all domains.

domain_read_all_domains_state(logrotate_t)

files_read_etc_runtime_files(logrotate_t)

files_read_all_pids(logrotate_t)

files_search_all(logrotate_t)

files_read_var_lib_files(logrotate_t)

# Write to /var/spool/slrnpull - should be moved into its own type.

files_manage_generic_spool(logrotate_t)

files_manage_generic_spool_dirs(logrotate_t)

files_getattr_generic_locks(logrotate_t)

files_dontaudit_list_mnt(logrotate_t)

# cjp: why is this needed?

init_domtrans_script(logrotate_t)

logging_manage_all_logs(logrotate_t)

logging_send_syslog_msg(logrotate_t)

logging_send_audit_msgs(logrotate_t)

# cjp: why is this needed?

logging_exec_all_logs(logrotate_t)

systemd_exec_systemctl(logrotate_t)

systemd_getattr_unit_files(logrotate_t)

systemd_start_all_unit_files(logrotate_t)

systemd_reload_all_services(logrotate_t)

systemd_status_all_unit_files(logrotate_t)

init_stream_connect(logrotate_t)

userdom_use_inherited_user_terminals(logrotate_t)

userdom_list_user_home_dirs(logrotate_t)

userdom_use_unpriv_users_fds(logrotate_t)

userdom_list_admin_dir(logrotate_t)

userdom_dontaudit_getattr_user_home_content(logrotate_t)

ifdef(`distro_debian', `

	allow logrotate_t logrotate_tmp_t:file relabel_file_perms;

	# for savelog

	can_exec(logrotate_t, logrotate_exec_t)

	# for syslogd-listfiles

	logging_read_syslog_config(logrotate_t)

	# for "test -x /sbin/syslogd"

	logging_check_exec_syslog(logrotate_t)

')

optional_policy(`

	abrt_manage_cache(logrotate_t)

')

optional_policy(`

	acct_domtrans(logrotate_t)

	acct_manage_data(logrotate_t)

	acct_exec_data(logrotate_t)

')

optional_policy(`

	apache_read_config(logrotate_t)

	apache_domtrans(logrotate_t)

	apache_signull(logrotate_t)

')

optional_policy(`

	awstats_domtrans(logrotate_t)

')

optional_policy(`

	asterisk_domtrans(logrotate_t)

')

optional_policy(`

	bind_manage_cache(logrotate_t)

')

optional_policy(`

	callweaver_exec(logrotate_t)

	callweaver_stream_connect(logrotate_t)

')

optional_policy(`

	consoletype_exec(logrotate_t)

')

optional_policy(`

	cron_system_entry(logrotate_t, logrotate_exec_t)

	cron_search_spool(logrotate_t)

')

optional_policy(`

	cups_domtrans(logrotate_t)

')

optional_policy(`

	fail2ban_stream_connect(logrotate_t)

')

optional_policy(`

	hostname_exec(logrotate_t)

')

optional_policy(`

	chronyd_read_keys(logrotate_t)

')

optional_policy(`

	icecast_signal(logrotate_t)

')

optional_policy(`

	mailman_domtrans(logrotate_t)

	mailman_search_data(logrotate_t)

	mailman_manage_log(logrotate_t)

')

optional_policy(`

	munin_read_config(logrotate_t)

	munin_stream_connect(logrotate_t)

	munin_search_lib(logrotate_t)

')

optional_policy(`

	mysql_read_home_content(logrotate_t)

	mysql_read_config(logrotate_t)

	mysql_search_db(logrotate_t)

	mysql_stream_connect(logrotate_t)

')

optional_policy(`

	polipo_named_filetrans_log_files(logrotate_t)

')

optional_policy(`

	psad_domtrans(logrotate_t)

')

optional_policy(`

	samba_exec_log(logrotate_t)

')

optional_policy(`

	sssd_domtrans(logrotate_t)

')

optional_policy(`

	slrnpull_manage_spool(logrotate_t)

')

optional_policy(`

	openvswitch_read_pid_files(logrotate_t)

	openvswitch_domtrans(logrotate_t)

')

optional_policy(`

	squid_domtrans(logrotate_t)

')

optional_policy(`

	#Red Hat bug 564565

	su_exec(logrotate_t)

')

optional_policy(`

	varnishd_manage_log(logrotate_t)

')

#######################################

#

# logrotate_mail local policy

#

mta_base_mail_template(logrotate)

mta_sendmail_domtrans(logrotate_t, logrotate_mail_t)

role system_r types logrotate_mail_t;

logging_read_all_logs(logrotate_mail_t)

manage_files_pattern(logrotate_mail_t, logrotate_tmp_t, logrotate_tmp_t)