[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/, policy/modules/system/

["Sven Vermeulen" <sven.vermeulen@siphos.be>]

commit:     d049175602c7f2b6650030039276b6bb99d10757
Author:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
AuthorDate: Mon Nov 12 21:26:26 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Mon Nov 12 21:26:26 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=d0491756

Introduce syslogmanaged attribute

The syslogmanaged attribute is assigned to types that are used as target system
log managed log files. When assigned, the system logger has manage privileges on
the type. The privileges are both on file and directory level.

Modules can enable this by marking their filetype with
"logging_syslog_managed_log_file" or "logging_syslog_managed_log_dir". The first
option is the type, the second one is an (optional) name to use for the file or
directory for a proper file transition.

For instance, for cron (also part of this commit):

type cron_log_t;
logging_syslog_managed_log_file(cron_log_t, "cron.log")

This will create the following transition:
type_transition syslogd_t var_log_t : file cron_log_t "cron.log";

Using logging_syslog_managed_log_dir will do the same, but on directory level.

See also https://bugs.gentoo.org/show_bug.cgi?id=440128

---
 policy/modules/contrib/cron.te   |    2 +
 policy/modules/system/logging.if |   69 ++++++++++++++++++++++++++++++++++++++
 policy/modules/system/logging.te |    6 +++
 3 files changed, 77 insertions(+), 0 deletions(-)

diff --git a/policy/modules/contrib/cron.te b/policy/modules/contrib/cron.te
index d6af321..5460980 100644
--- a/policy/modules/contrib/cron.te
+++ b/policy/modules/contrib/cron.te
@@ -124,6 +124,8 @@ mta_system_content(user_cron_spool_t)
 ifdef(`distro_gentoo',`
 	domain_interactive_fd(cronjob_t)
 	domain_interactive_fd(system_cronjob_t)
+
+	logging_syslog_managed_log_file(cron_log_t, "cron.log")
 ')
 
 ifdef(`enable_mcs',`

diff --git a/policy/modules/system/logging.if b/policy/modules/system/logging.if
index 857e07d..6bd6586 100644
--- a/policy/modules/system/logging.if
+++ b/policy/modules/system/logging.if
@@ -1104,3 +1104,72 @@ interface(`logging_admin',`
 	logging_admin_audit($1, $2)
 	logging_admin_syslog($1, $2)
 ')
+
+########################################
+## <summary>
+##	Mark the type as a syslog managed log file
+##	and introduce the proper file transition when
+##	created by the system logger in the generic
+##	log directory
+## </summary>
+## <param name="type">
+##	<summary>
+##	Type to mark as a syslog managed log file
+##	</summary>
+## </param>
+## <param name="filename" optional="true">
+##	<summary>
+##	Name to use for the file
+##	</summary>
+## </param>
+#
+interface(`logging_syslog_managed_log_file',`
+	gen_require(`
+		attribute syslogmanaged;
+		type syslogd_t;
+	')
+
+	typeattribute $1 syslogmanaged;
+
+	logging_log_file($1)
+	logging_log_filetrans(syslogd_t, $1, file, $2)
+')
+
+########################################
+## <summary>
+##	Mark the type as a syslog managed log dir
+##	and introduce the proper file transition when
+##	created by the system logger in the generic
+##	log directory
+## </summary>
+## <desc>
+##	<p>
+##	Once set, the system logger is able to fully
+##	manage files and directory of the given type.
+##	You do not need to use logging_syslog_managed_file
+##	anymore (unless a file name transition is needed
+##	for that as well).
+##	</p>
+## </desc>
+## <param name="type">
+##	<summary>
+##	Type to mark as a syslog managed log dir
+##	</summary>
+## </param>
+## <param name="filename" optional="true">
+##	<summary>
+##	Name to use for the directory
+##	</summary>
+## </param>
+#
+interface(`logging_syslog_managed_log_dir',`
+	gen_require(`
+		attribute syslogmanaged;
+		type syslogd_t;
+	')
+
+	typeattribute $1 syslogmanaged;
+
+	logging_log_file($1)
+	logging_log_filetrans(syslogd_t, $1, dir, $2)
+')

diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te
index 7a4250e..08f66fb 100644
--- a/policy/modules/system/logging.te
+++ b/policy/modules/system/logging.te
@@ -86,6 +86,10 @@ ifdef(`enable_mls',`
 	init_ranged_daemon_domain(syslogd_t, syslogd_exec_t, mls_systemhigh)
 ')
 
+ifdef(`distro_gentoo',`
+	attribute syslogmanaged;
+')
+
 ########################################
 #
 # Auditctl local policy
@@ -470,6 +474,8 @@ userdom_dontaudit_use_unpriv_user_fds(syslogd_t)
 userdom_dontaudit_search_user_home_dirs(syslogd_t)
 
 ifdef(`distro_gentoo',`
+	manage_dirs_pattern(syslogd_t, syslogmanaged, syslogmanaged)
+	manage_files_pattern(syslogd_t, syslogmanaged, syslogmanaged)
 	# default gentoo syslog-ng config appends kernel
 	# and high priority messages to /dev/tty12
 	term_append_unallocated_ttys(syslogd_t)