[selinux-policy: 654/3172] cleanup
Daniel J Walsh
dwalsh at fedoraproject.org
Thu Oct 7 20:01:27 UTC 2010
commit 5a2649cefd2e335d32116bb6e805a77d8de3bd63
Author: Chris PeBenito <cpebenito at tresys.com>
Date: Wed Sep 14 19:27:30 2005 +0000
cleanup
refpolicy/policy/modules/admin/logrotate.te | 14 +++++++-------
1 files changed, 7 insertions(+), 7 deletions(-)
---
diff --git a/refpolicy/policy/modules/admin/logrotate.te b/refpolicy/policy/modules/admin/logrotate.te
index 0b9aeec..060908b 100644
--- a/refpolicy/policy/modules/admin/logrotate.te
+++ b/refpolicy/policy/modules/admin/logrotate.te
@@ -52,7 +52,10 @@ allow logrotate_t logrotate_tmp_t:dir create_dir_perms;
allow logrotate_t logrotate_tmp_t:file create_file_perms;
files_create_tmp_files(logrotate_t, logrotate_tmp_t, { file dir })
+# for /var/lib/logrotate.status and /var/lib/logcheck
allow logrotate_t logrotate_var_lib_t:dir { create rw_dir_perms };
+allow logrotate_t logrotate_var_lib_t:file create_file_perms;
+files_create_var_lib(logrotate_t, logrotate_var_lib_t)
kernel_read_system_state(logrotate_t)
kernel_read_kernel_sysctl(logrotate_t)
@@ -74,6 +77,7 @@ corecmd_exec_ls(logrotate_t)
domain_signal_all_domains(logrotate_t)
domain_use_wide_inherit_fd(logrotate_t)
+domain_getattr_all_entry_files(logrotate_t)
files_read_usr_files(logrotate_t)
files_read_etc_files(logrotate_t)
@@ -88,6 +92,7 @@ files_manage_generic_spool_dirs(logrotate_t)
init_domtrans_script(logrotate_t)
logging_manage_all_logs(logrotate_t)
+logging_send_syslog_msg(logrotate_t)
# cjp: why is this needed?
logging_exec_all_logs(logrotate_t)
@@ -96,6 +101,8 @@ libs_use_shared_libs(logrotate_t)
miscfiles_read_localization(logrotate_t)
+seutil_dontaudit_search_config(logrotate_t)
+
sysnet_read_config(logrotate_t)
userdom_use_unpriv_users_fd(logrotate_t)
@@ -164,18 +171,11 @@ allow logrotate_t {staff_home_dir_t sysadm_home_dir_t}:dir { getattr read search
# Read /proc/PID directories for all domains.
allow logrotate_t domain:notdevfile_class_set r_file_perms;
allow logrotate_t domain:dir r_dir_perms;
-allow logrotate_t exec_type:file getattr;
-
-# for /var/lib/logrotate.status and /var/lib/logcheck
-file_type_auto_trans(logrotate_t, var_lib_t, logrotate_var_lib_t, file)
# for /var/backups on Debian
ifdef(`backup.te', `
rw_dir_create_file(logrotate_t, backup_store_t)
')
-allow logrotate_t syslogd_t:unix_dgram_socket sendto;
allow logrotate_t syslogd_exec_t:file r_file_perms;
-
-dontaudit logrotate_t selinux_config_t:dir search;
') dnl end TODO
More information about the scm-commits
mailing list