|
Chris PeBenito |
9570b28 |
policy_module(auditadm, 2.1.0)
|
|
Chris PeBenito |
e9c6cda |
|
|
Chris PeBenito |
e9c6cda |
########################################
|
|
Chris PeBenito |
e9c6cda |
#
|
|
Chris PeBenito |
e9c6cda |
# Declarations
|
|
Chris PeBenito |
e9c6cda |
#
|
|
Chris PeBenito |
e9c6cda |
|
|
Chris PeBenito |
e9c6cda |
role auditadm_r;
|
|
Chris PeBenito |
e9c6cda |
|
|
Chris PeBenito |
e9c6cda |
userdom_unpriv_user_template(auditadm)
|
|
Chris PeBenito |
e9c6cda |
|
|
Chris PeBenito |
e9c6cda |
########################################
|
|
Chris PeBenito |
e9c6cda |
#
|
|
Chris PeBenito |
e9c6cda |
# Local policy
|
|
Chris PeBenito |
e9c6cda |
#
|
|
Chris PeBenito |
e9c6cda |
|
|
Chris PeBenito |
e9c6cda |
allow auditadm_t self:capability { dac_read_search dac_override };
|
|
Chris PeBenito |
e9c6cda |
|
|
Chris PeBenito |
79a5a80 |
kernel_read_ring_buffer(auditadm_t)
|
|
Chris PeBenito |
79a5a80 |
|
|
Chris PeBenito |
e9c6cda |
corecmd_exec_shell(auditadm_t)
|
|
Chris PeBenito |
e9c6cda |
|
|
Chris PeBenito |
e9c6cda |
domain_kill_all_domains(auditadm_t)
|
|
Chris PeBenito |
e9c6cda |
|
|
Chris PeBenito |
e9c6cda |
logging_send_syslog_msg(auditadm_t)
|
|
Chris PeBenito |
e9c6cda |
logging_read_generic_logs(auditadm_t)
|
|
Chris PeBenito |
e9c6cda |
logging_manage_audit_log(auditadm_t)
|
|
Chris PeBenito |
e9c6cda |
logging_manage_audit_config(auditadm_t)
|
|
Chris PeBenito |
296273a |
logging_run_auditctl(auditadm_t, auditadm_r)
|
|
Chris PeBenito |
296273a |
logging_run_auditd(auditadm_t, auditadm_r)
|
|
|
3eaa993 |
logging_stream_connect_syslog(auditadm_t)
|
|
Chris PeBenito |
e9c6cda |
|
|
Chris PeBenito |
296273a |
seutil_run_runinit(auditadm_t, auditadm_r)
|
|
Chris PeBenito |
e9c6cda |
seutil_read_bin_policy(auditadm_t)
|
|
Chris PeBenito |
e9c6cda |
|
|
|
3eaa993 |
userdom_dontaudit_search_admin_dir(auditadm_t)
|
|
|
3eaa993 |
|
|
Chris PeBenito |
e9c6cda |
optional_policy(`
|
|
Chris PeBenito |
e9c6cda |
consoletype_exec(auditadm_t)
|
|
Chris PeBenito |
e9c6cda |
')
|
|
Chris PeBenito |
e9c6cda |
|
|
Chris PeBenito |
e9c6cda |
optional_policy(`
|
|
Chris PeBenito |
e9c6cda |
dmesg_exec(auditadm_t)
|
|
Chris PeBenito |
e9c6cda |
')
|
|
Chris PeBenito |
e9c6cda |
|
|
Chris PeBenito |
e9c6cda |
optional_policy(`
|
|
Chris PeBenito |
296273a |
screen_role_template(auditadm, auditadm_r, auditadm_t)
|
|
Chris PeBenito |
296273a |
')
|
|
Chris PeBenito |
296273a |
|
|
Chris PeBenito |
296273a |
optional_policy(`
|
|
Chris PeBenito |
296273a |
secadm_role_change(auditadm_r)
|
|
Chris PeBenito |
e9c6cda |
')
|
|
Chris PeBenito |
e9c6cda |
|
|
Chris PeBenito |
e9c6cda |
optional_policy(`
|
|
Chris PeBenito |
296273a |
su_role_template(auditadm, auditadm_r, auditadm_t)
|
|
Chris PeBenito |
e9c6cda |
')
|
|
Chris PeBenito |
e9c6cda |
|
|
Chris PeBenito |
296273a |
optional_policy(`
|
|
Chris PeBenito |
296273a |
sudo_role_template(auditadm, auditadm_r, auditadm_t)
|
|
Chris PeBenito |
296273a |
')
|
|
Chris PeBenito |
296273a |
|
|
Chris PeBenito |
296273a |
optional_policy(`
|
|
Chris PeBenito |
296273a |
sysadm_role_change(auditadm_r)
|
|
Chris PeBenito |
296273a |
')
|
|
Chris PeBenito |
296273a |
|