[selinux-policy: 1876/3172] trunk: Patch for debian logrotate to handle syslogd-listfiles, from Vaclav Ovsik.

[Daniel J Walsh]

commit 1abafe3707cd3cec6ef2b3747da4696b15527f2e
Author: Chris PeBenito <cpebenito at tresys.com>
Date:   Wed Dec 12 16:18:50 2007 +0000

    trunk: Patch for debian logrotate to handle syslogd-listfiles, from Vaclav Ovsik.

 Changelog                         |    1 +
 policy/modules/admin/logrotate.te |    5 ++++-
 policy/modules/system/logging.if  |   19 +++++++++++++++++++
 policy/modules/system/logging.te  |    2 +-
 4 files changed, 25 insertions(+), 2 deletions(-)
---
diff --git a/Changelog b/Changelog
index a892416..df6aad6 100644
--- a/Changelog
+++ b/Changelog
@@ -1,3 +1,4 @@
+- Patch for debian logrotate to handle syslogd-listfiles, from Vaclav Ovsik.
 - Improve several tunables descriptions from Dan Walsh.
 - Patch to clean up ns switch usage in the policy from Dan Walsh.
 - More complete labeled networking infrastructure from KaiGai Kohei.
diff --git a/policy/modules/admin/logrotate.te b/policy/modules/admin/logrotate.te
index 271e1a3..31999fe 100644
--- a/policy/modules/admin/logrotate.te
+++ b/policy/modules/admin/logrotate.te
@@ -1,5 +1,5 @@
 
-policy_module(logrotate,1.6.0)
+policy_module(logrotate,1.6.1)
 
 ########################################
 #
@@ -127,6 +127,9 @@ ifdef(`distro_debian', `
 	allow logrotate_t logrotate_tmp_t:file { relabelfrom relabelto };
 	# for savelog
 	can_exec(logrotate_t, logrotate_exec_t)
+
+	# for syslogd-listfiles
+	logging_read_syslog_config(logrotate_t)
 ')
 
 optional_policy(`
diff --git a/policy/modules/system/logging.if b/policy/modules/system/logging.if
index 4b702fb..e566ab1 100644
--- a/policy/modules/system/logging.if
+++ b/policy/modules/system/logging.if
@@ -400,6 +400,25 @@ interface(`logging_dontaudit_search_audit_config',`
 
 ########################################
 ## <summary>
+##	Read syslog configuration files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`logging_read_syslog_config',`
+	gen_require(`
+		type syslog_conf_t;
+	')
+
+	allow $1 syslog_conf_t:file read_file_perms;
+')
+
+########################################
+## <summary>
 ##	Allows the domain to open a file in the
 ##	log directory, but does not allow the listing
 ##	of the contents of the log directory.
diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te
index 8f7bc86..f6619dc 100644
--- a/policy/modules/system/logging.te
+++ b/policy/modules/system/logging.te
@@ -1,5 +1,5 @@
 
-policy_module(logging,1.8.3)
+policy_module(logging,1.8.4)
 
 ########################################
 #