summaryrefslogtreecommitdiffstats
path: root/recipes-security/refpolicy/refpolicy-2.20170204
diff options
context:
space:
mode:
Diffstat (limited to 'recipes-security/refpolicy/refpolicy-2.20170204')
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-update-alternatives_sysklogd.patch44
-rw-r--r--recipes-security/refpolicy/refpolicy-2.20170204/poky-policy-add-rules-for-var-log-symlink-apache.patch10
2 files changed, 28 insertions, 26 deletions
diff --git a/recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-update-alternatives_sysklogd.patch b/recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-update-alternatives_sysklogd.patch
index 2038110..e9a0464 100644
--- a/recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-update-alternatives_sysklogd.patch
+++ b/recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-update-alternatives_sysklogd.patch
@@ -11,13 +11,13 @@ Upstream-Status: Inappropriate [only for Poky]
11Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com> 11Signed-off-by: Xin Ouyang <Xin.Ouyang@windriver.com>
12Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com> 12Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
13--- 13---
14 policy/modules/system/logging.fc | 4 ++++ 14 policy/modules/system/logging.fc | 3 +++
15 policy/modules/system/logging.te | 1 + 15 policy/modules/system/logging.te | 2 ++
16 2 files changed, 5 insertions(+) 16 2 files changed, 5 insertions(+)
17 17
18--- a/policy/modules/system/logging.fc 18--- a/policy/modules/system/logging.fc
19+++ b/policy/modules/system/logging.fc 19+++ b/policy/modules/system/logging.fc
20@@ -1,22 +1,26 @@ 20@@ -1,9 +1,10 @@
21 /dev/log -s gen_context(system_u:object_r:devlog_t,mls_systemhigh) 21 /dev/log -s gen_context(system_u:object_r:devlog_t,mls_systemhigh)
22 22
23 /etc/rsyslog.conf gen_context(system_u:object_r:syslog_conf_t,s0) 23 /etc/rsyslog.conf gen_context(system_u:object_r:syslog_conf_t,s0)
@@ -26,35 +26,37 @@ Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
26 /etc/audit(/.*)? gen_context(system_u:object_r:auditd_etc_t,mls_systemhigh) 26 /etc/audit(/.*)? gen_context(system_u:object_r:auditd_etc_t,mls_systemhigh)
27 /etc/rc\.d/init\.d/auditd -- gen_context(system_u:object_r:auditd_initrc_exec_t,s0) 27 /etc/rc\.d/init\.d/auditd -- gen_context(system_u:object_r:auditd_initrc_exec_t,s0)
28 /etc/rc\.d/init\.d/rsyslog -- gen_context(system_u:object_r:syslogd_initrc_exec_t,s0) 28 /etc/rc\.d/init\.d/rsyslog -- gen_context(system_u:object_r:syslogd_initrc_exec_t,s0)
29+/etc/rc\.d/init\.d/syslog\.sysklogd -- gen_context(system_u:object_r:syslogd_initrc_exec_t,s0)
30 29
31 /sbin/audispd -- gen_context(system_u:object_r:audisp_exec_t,s0) 30 /usr/bin/audispd -- gen_context(system_u:object_r:audisp_exec_t,s0)
32 /sbin/audisp-remote -- gen_context(system_u:object_r:audisp_remote_exec_t,s0) 31@@ -27,14 +28,16 @@
33 /sbin/auditctl -- gen_context(system_u:object_r:auditctl_exec_t,s0) 32 /usr/sbin/audispd -- gen_context(system_u:object_r:audisp_exec_t,s0)
34 /sbin/auditd -- gen_context(system_u:object_r:auditd_exec_t,s0) 33 /usr/sbin/audisp-remote -- gen_context(system_u:object_r:audisp_remote_exec_t,s0)
35 /sbin/klogd -- gen_context(system_u:object_r:klogd_exec_t,s0) 34 /usr/sbin/auditctl -- gen_context(system_u:object_r:auditctl_exec_t,s0)
36+/sbin/klogd\.sysklogd -- gen_context(system_u:object_r:klogd_exec_t,s0) 35 /usr/sbin/auditd -- gen_context(system_u:object_r:auditd_exec_t,s0)
37 /sbin/minilogd -- gen_context(system_u:object_r:syslogd_exec_t,s0) 36 /usr/sbin/klogd -- gen_context(system_u:object_r:klogd_exec_t,s0)
38 /sbin/rklogd -- gen_context(system_u:object_r:klogd_exec_t,s0) 37+/usr/sbin/klogd\.sysklogd -- gen_context(system_u:object_r:klogd_exec_t,s0)
39 /sbin/rsyslogd -- gen_context(system_u:object_r:syslogd_exec_t,s0) 38 /usr/sbin/metalog -- gen_context(system_u:object_r:syslogd_exec_t,s0)
40 /sbin/syslogd -- gen_context(system_u:object_r:syslogd_exec_t,s0) 39 /usr/sbin/minilogd -- gen_context(system_u:object_r:syslogd_exec_t,s0)
41+/sbin/syslogd\.sysklogd -- gen_context(system_u:object_r:syslogd_exec_t,s0) 40 /usr/sbin/rklogd -- gen_context(system_u:object_r:klogd_exec_t,s0)
42 /sbin/syslog-ng -- gen_context(system_u:object_r:syslogd_exec_t,s0) 41 /usr/sbin/rsyslogd -- gen_context(system_u:object_r:syslogd_exec_t,s0)
42+/usr/sbin/syslogd\.sysklogd -- gen_context(system_u:object_r:syslogd_exec_t,s0)
43 /usr/sbin/syslog-ng -- gen_context(system_u:object_r:syslogd_exec_t,s0)
44 /usr/sbin/syslogd -- gen_context(system_u:object_r:syslogd_exec_t,s0)
43 45
44 /usr/lib/systemd/system/auditd.* -- gen_context(system_u:object_r:auditd_unit_t,s0) 46 /var/lib/misc/syslog-ng.persist-? -- gen_context(system_u:object_r:syslogd_var_lib_t,s0)
45 /usr/lib/systemd/system/[^/]*systemd-journal.* -- gen_context(system_u:object_r:syslogd_unit_t,s0) 47 /var/lib/syslog-ng(/.*)? gen_context(system_u:object_r:syslogd_var_lib_t,s0)
46 /usr/lib/systemd/systemd-journald -- gen_context(system_u:object_r:syslogd_exec_t,s0)
47--- a/policy/modules/system/logging.te 48--- a/policy/modules/system/logging.te
48+++ b/policy/modules/system/logging.te 49+++ b/policy/modules/system/logging.te
49@@ -388,10 +388,11 @@ allow syslogd_t self:unix_dgram_socket s 50@@ -390,10 +390,12 @@ allow syslogd_t self:unix_dgram_socket s
50 allow syslogd_t self:fifo_file rw_fifo_file_perms; 51 allow syslogd_t self:fifo_file rw_fifo_file_perms;
51 allow syslogd_t self:udp_socket create_socket_perms; 52 allow syslogd_t self:udp_socket create_socket_perms;
52 allow syslogd_t self:tcp_socket create_stream_socket_perms; 53 allow syslogd_t self:tcp_socket create_stream_socket_perms;
53 54
54 allow syslogd_t syslog_conf_t:file read_file_perms; 55 allow syslogd_t syslog_conf_t:file read_file_perms;
55+allow syslogd_t syslog_conf_t:lnk_file read_file_perms; 56+allow syslogd_t syslog_conf_t:lnk_file read_file_perms;
57+allow syslogd_t syslog_conf_t:dir list_dir_perms;
56 58
57 # Create and bind to /dev/log or /var/run/log. 59 # Create and bind to /dev/log or /var/run/log.
58 allow syslogd_t devlog_t:sock_file manage_sock_file_perms; 60 allow syslogd_t devlog_t:sock_file manage_sock_file_perms;
59 files_pid_filetrans(syslogd_t, devlog_t, sock_file) 61 files_pid_filetrans(syslogd_t, devlog_t, sock_file)
60 62 init_pid_filetrans(syslogd_t, devlog_t, sock_file, "dev-log")
diff --git a/recipes-security/refpolicy/refpolicy-2.20170204/poky-policy-add-rules-for-var-log-symlink-apache.patch b/recipes-security/refpolicy/refpolicy-2.20170204/poky-policy-add-rules-for-var-log-symlink-apache.patch
index 8d22c21..fb912b5 100644
--- a/recipes-security/refpolicy/refpolicy-2.20170204/poky-policy-add-rules-for-var-log-symlink-apache.patch
+++ b/recipes-security/refpolicy/refpolicy-2.20170204/poky-policy-add-rules-for-var-log-symlink-apache.patch
@@ -17,11 +17,11 @@ Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com>
17 17
18--- a/policy/modules/contrib/apache.te 18--- a/policy/modules/contrib/apache.te
19+++ b/policy/modules/contrib/apache.te 19+++ b/policy/modules/contrib/apache.te
20@@ -409,10 +409,11 @@ allow httpd_t httpd_log_t:dir setattr_di 20@@ -407,10 +407,11 @@ allow httpd_t httpd_lock_t:file manage_f
21 create_dirs_pattern(httpd_t, httpd_log_t, httpd_log_t) 21 files_lock_filetrans(httpd_t, httpd_lock_t, { file dir })
22 create_files_pattern(httpd_t, httpd_log_t, httpd_log_t) 22
23 append_files_pattern(httpd_t, httpd_log_t, httpd_log_t) 23 manage_dirs_pattern(httpd_t, httpd_log_t, httpd_log_t)
24 read_files_pattern(httpd_t, httpd_log_t, httpd_log_t) 24 manage_files_pattern(httpd_t, httpd_log_t, httpd_log_t)
25 read_lnk_files_pattern(httpd_t, httpd_log_t, httpd_log_t) 25 read_lnk_files_pattern(httpd_t, httpd_log_t, httpd_log_t)
26+read_lnk_files_pattern(httpd_t, var_log_t, var_log_t) 26+read_lnk_files_pattern(httpd_t, var_log_t, var_log_t)
27 logging_log_filetrans(httpd_t, httpd_log_t, file) 27 logging_log_filetrans(httpd_t, httpd_log_t, file)
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-07-21 17:39:23 +0000