|
Chris PeBenito |
020cbef |
|
|
Chris PeBenito |
d46cfe4 |
policy_module(logwatch,1.5.1)
|
|
Chris PeBenito |
020cbef |
|
|
Chris PeBenito |
020cbef |
#################################
|
|
Chris PeBenito |
020cbef |
#
|
|
Chris PeBenito |
020cbef |
# Declarations
|
|
Chris PeBenito |
020cbef |
#
|
|
Chris PeBenito |
020cbef |
|
|
Chris PeBenito |
020cbef |
type logwatch_t;
|
|
Chris PeBenito |
020cbef |
type logwatch_exec_t;
|
|
Chris PeBenito |
d46cfe4 |
application_domain(logwatch_t,logwatch_exec_t)
|
|
Chris PeBenito |
020cbef |
role system_r types logwatch_t;
|
|
Chris PeBenito |
020cbef |
|
|
Chris PeBenito |
020cbef |
type logwatch_cache_t;
|
|
Chris PeBenito |
020cbef |
files_type(logwatch_cache_t)
|
|
Chris PeBenito |
020cbef |
|
|
Chris PeBenito |
73ca55d |
type logwatch_lock_t;
|
|
Chris PeBenito |
73ca55d |
files_lock_file(logwatch_lock_t)
|
|
Chris PeBenito |
73ca55d |
|
|
Chris PeBenito |
020cbef |
type logwatch_tmp_t;
|
|
Chris PeBenito |
020cbef |
files_tmp_file(logwatch_tmp_t)
|
|
Chris PeBenito |
020cbef |
|
|
Chris PeBenito |
020cbef |
########################################
|
|
Chris PeBenito |
020cbef |
#
|
|
Chris PeBenito |
020cbef |
# Local policy
|
|
Chris PeBenito |
020cbef |
#
|
|
Chris PeBenito |
020cbef |
|
|
Chris PeBenito |
123a990 |
allow logwatch_t self:capability { dac_override dac_read_search setgid };
|
|
Chris PeBenito |
73ca55d |
allow logwatch_t self:process signal;
|
|
Chris PeBenito |
020cbef |
allow logwatch_t self:fifo_file rw_file_perms;
|
|
Chris PeBenito |
020cbef |
allow logwatch_t self:unix_stream_socket create_stream_socket_perms;
|
|
Chris PeBenito |
9af48ee |
allow logwatch_t self:netlink_route_socket r_netlink_socket_perms;
|
|
Chris PeBenito |
020cbef |
|
|
Chris PeBenito |
c0868a7 |
manage_dirs_pattern(logwatch_t,logwatch_cache_t,logwatch_cache_t)
|
|
Chris PeBenito |
c0868a7 |
manage_files_pattern(logwatch_t,logwatch_cache_t,logwatch_cache_t)
|
|
Chris PeBenito |
020cbef |
|
|
Chris PeBenito |
73ca55d |
allow logwatch_t logwatch_lock_t:file manage_file_perms;
|
|
Chris PeBenito |
73ca55d |
files_lock_filetrans(logwatch_t,logwatch_lock_t,file)
|
|
Chris PeBenito |
73ca55d |
|
|
Chris PeBenito |
c0868a7 |
manage_dirs_pattern(logwatch_t,logwatch_tmp_t,logwatch_tmp_t)
|
|
Chris PeBenito |
c0868a7 |
manage_files_pattern(logwatch_t,logwatch_tmp_t,logwatch_tmp_t)
|
|
Chris PeBenito |
103fe28 |
files_tmp_filetrans(logwatch_t, logwatch_tmp_t, { file dir })
|
|
Chris PeBenito |
020cbef |
|
|
Chris PeBenito |
445522d |
kernel_read_fs_sysctls(logwatch_t)
|
|
Chris PeBenito |
445522d |
kernel_read_kernel_sysctls(logwatch_t)
|
|
Chris PeBenito |
020cbef |
kernel_read_system_state(logwatch_t)
|
|
Chris PeBenito |
020cbef |
|
|
Chris PeBenito |
020cbef |
corecmd_exec_bin(logwatch_t)
|
|
Chris PeBenito |
020cbef |
corecmd_exec_shell(logwatch_t)
|
|
Chris PeBenito |
020cbef |
|
|
Chris PeBenito |
020cbef |
dev_read_urand(logwatch_t)
|
|
Chris PeBenito |
d6d16b9 |
dev_search_sysfs(logwatch_t)
|
|
Chris PeBenito |
020cbef |
|
|
Chris PeBenito |
020cbef |
# Read /proc/PID directories for all domains.
|
|
Chris PeBenito |
020cbef |
domain_read_all_domains_state(logwatch_t)
|
|
Chris PeBenito |
020cbef |
|
|
Chris PeBenito |
6b19be3 |
files_list_var(logwatch_t)
|
|
Chris PeBenito |
020cbef |
files_read_etc_files(logwatch_t)
|
|
Chris PeBenito |
020cbef |
files_read_etc_runtime_files(logwatch_t)
|
|
Chris PeBenito |
020cbef |
files_read_usr_files(logwatch_t)
|
|
Chris PeBenito |
020cbef |
files_search_spool(logwatch_t)
|
|
Chris PeBenito |
7249255 |
files_search_mnt(logwatch_t)
|
|
Chris PeBenito |
020cbef |
files_dontaudit_search_home(logwatch_t)
|
|
Chris PeBenito |
8708d9b |
files_dontaudit_search_boot(logwatch_t)
|
|
Chris PeBenito |
6649aec |
# Execs df and if file system mounted with a context avc raised
|
|
Chris PeBenito |
6649aec |
files_dontaudit_search_all_dirs(logwatch_t)
|
|
Chris PeBenito |
020cbef |
|
|
Chris PeBenito |
020cbef |
fs_getattr_all_fs(logwatch_t)
|
|
Chris PeBenito |
8708d9b |
fs_dontaudit_list_auto_mountpoints(logwatch_t)
|
|
Chris PeBenito |
020cbef |
|
|
Chris PeBenito |
1815bad |
term_dontaudit_getattr_pty_dirs(logwatch_t)
|
|
Chris PeBenito |
020cbef |
term_dontaudit_list_ptys(logwatch_t)
|
|
Chris PeBenito |
020cbef |
|
|
Chris PeBenito |
020cbef |
auth_dontaudit_read_shadow(logwatch_t)
|
|
Chris PeBenito |
020cbef |
|
|
Chris PeBenito |
020cbef |
libs_use_ld_so(logwatch_t)
|
|
Chris PeBenito |
020cbef |
libs_use_shared_libs(logwatch_t)
|
|
Chris PeBenito |
1815bad |
libs_read_lib_files(logwatch_t)
|
|
Chris PeBenito |
020cbef |
|
|
Chris PeBenito |
020cbef |
logging_read_all_logs(logwatch_t)
|
|
Chris PeBenito |
9af48ee |
logging_send_syslog_msg(logwatch_t)
|
|
Chris PeBenito |
020cbef |
|
|
Chris PeBenito |
020cbef |
miscfiles_read_localization(logwatch_t)
|
|
Chris PeBenito |
020cbef |
|
|
Chris PeBenito |
a225f98 |
selinux_dontaudit_getattr_dir(logwatch_t)
|
|
Chris PeBenito |
a225f98 |
|
|
Chris PeBenito |
0f27d98 |
sysnet_dns_name_resolve(logwatch_t)
|
|
Chris PeBenito |
0f27d98 |
|
|
Chris PeBenito |
103fe28 |
userdom_dontaudit_search_sysadm_home_dirs(logwatch_t)
|
|
Chris PeBenito |
1815bad |
userdom_dontaudit_getattr_sysadm_home_dirs(logwatch_t)
|
|
Chris PeBenito |
020cbef |
|
|
Chris PeBenito |
020cbef |
mta_send_mail(logwatch_t)
|
|
Chris PeBenito |
020cbef |
|
|
Chris PeBenito |
bb7170f |
optional_policy(`
|
|
Chris PeBenito |
020cbef |
apache_read_log(logwatch_t)
|
|
Chris PeBenito |
020cbef |
')
|
|
Chris PeBenito |
020cbef |
|
|
Chris PeBenito |
bb7170f |
optional_policy(`
|
|
Chris PeBenito |
517618f |
avahi_dontaudit_search_pid(logwatch_t)
|
|
Chris PeBenito |
517618f |
')
|
|
Chris PeBenito |
517618f |
|
|
Chris PeBenito |
517618f |
optional_policy(`
|
|
Chris PeBenito |
020cbef |
bind_read_config(logwatch_t)
|
|
Chris PeBenito |
020cbef |
bind_read_zone(logwatch_t)
|
|
Chris PeBenito |
020cbef |
')
|
|
Chris PeBenito |
020cbef |
|
|
Chris PeBenito |
bb7170f |
optional_policy(`
|
|
Chris PeBenito |
020cbef |
cron_system_entry(logwatch_t, logwatch_exec_t)
|
|
Chris PeBenito |
020cbef |
')
|
|
Chris PeBenito |
020cbef |
|
|
Chris PeBenito |
bb7170f |
optional_policy(`
|
|
Chris PeBenito |
73ca55d |
hostname_exec(logwatch_t)
|
|
Chris PeBenito |
73ca55d |
')
|
|
Chris PeBenito |
73ca55d |
|
|
Chris PeBenito |
73ca55d |
optional_policy(`
|
|
Chris PeBenito |
020cbef |
mta_getattr_spool(logwatch_t)
|
|
Chris PeBenito |
020cbef |
')
|
|
Chris PeBenito |
020cbef |
|
|
Chris PeBenito |
bb7170f |
optional_policy(`
|
|
Chris PeBenito |
6b19be3 |
nis_use_ypbind(logwatch_t)
|
|
Chris PeBenito |
6b19be3 |
')
|
|
Chris PeBenito |
6b19be3 |
|
|
Chris PeBenito |
6b19be3 |
optional_policy(`
|
|
Chris PeBenito |
1815bad |
nscd_socket_use(logwatch_t)
|
|
Chris PeBenito |
020cbef |
')
|
|
Chris PeBenito |
020cbef |
|
|
Chris PeBenito |
bb7170f |
optional_policy(`
|
|
Chris PeBenito |
a225f98 |
ntp_domtrans(logwatch_t)
|
|
Chris PeBenito |
a225f98 |
')
|
|
Chris PeBenito |
a225f98 |
|
|
Chris PeBenito |
bb7170f |
optional_policy(`
|
|
Chris PeBenito |
020cbef |
rpc_search_nfs_state_data(logwatch_t)
|
|
Chris PeBenito |
020cbef |
')
|
|
Chris PeBenito |
020cbef |
|
|
Chris PeBenito |
bb7170f |
optional_policy(`
|
|
Chris PeBenito |
020cbef |
samba_read_log(logwatch_t)
|
|
Chris PeBenito |
020cbef |
')
|