diff options
Diffstat (limited to 'recipes-security/refpolicy/refpolicy-2.20170204')
2 files changed, 6 insertions, 21 deletions
diff --git a/recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-update-alternatives_sysklogd.patch b/recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-update-alternatives_sysklogd.patch index e9a0464..aa928c6 100644 --- a/recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-update-alternatives_sysklogd.patch +++ b/recipes-security/refpolicy/refpolicy-2.20170204/poky-fc-update-alternatives_sysklogd.patch @@ -17,8 +17,7 @@ Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com> --- a/policy/modules/system/logging.fc +++ b/policy/modules/system/logging.fc -@@ -1,9 +1,10 @@ - /dev/log -s gen_context(system_u:object_r:devlog_t,mls_systemhigh) +@@ -2,6 +2,7 @@ /etc/rsyslog.conf gen_context(system_u:object_r:syslog_conf_t,s0) /etc/syslog.conf gen_context(system_u:object_r:syslog_conf_t,s0) @@ -26,11 +25,7 @@ Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com> /etc/audit(/.*)? gen_context(system_u:object_r:auditd_etc_t,mls_systemhigh) /etc/rc\.d/init\.d/auditd -- gen_context(system_u:object_r:auditd_initrc_exec_t,s0) /etc/rc\.d/init\.d/rsyslog -- gen_context(system_u:object_r:syslogd_initrc_exec_t,s0) - - /usr/bin/audispd -- gen_context(system_u:object_r:audisp_exec_t,s0) -@@ -27,14 +28,16 @@ - /usr/sbin/audispd -- gen_context(system_u:object_r:audisp_exec_t,s0) - /usr/sbin/audisp-remote -- gen_context(system_u:object_r:audisp_remote_exec_t,s0) +@@ -27,10 +28,12 @@ /usr/sbin/auditctl -- gen_context(system_u:object_r:auditctl_exec_t,s0) /usr/sbin/auditd -- gen_context(system_u:object_r:auditd_exec_t,s0) /usr/sbin/klogd -- gen_context(system_u:object_r:klogd_exec_t,s0) @@ -43,13 +38,9 @@ Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com> /usr/sbin/syslog-ng -- gen_context(system_u:object_r:syslogd_exec_t,s0) /usr/sbin/syslogd -- gen_context(system_u:object_r:syslogd_exec_t,s0) - /var/lib/misc/syslog-ng.persist-? -- gen_context(system_u:object_r:syslogd_var_lib_t,s0) - /var/lib/syslog-ng(/.*)? gen_context(system_u:object_r:syslogd_var_lib_t,s0) --- a/policy/modules/system/logging.te +++ b/policy/modules/system/logging.te -@@ -390,10 +390,12 @@ allow syslogd_t self:unix_dgram_socket s - allow syslogd_t self:fifo_file rw_fifo_file_perms; - allow syslogd_t self:udp_socket create_socket_perms; +@@ -390,6 +390,8 @@ allow syslogd_t self:udp_socket create_s allow syslogd_t self:tcp_socket create_stream_socket_perms; allow syslogd_t syslog_conf_t:file read_file_perms; @@ -58,5 +49,3 @@ Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com> # Create and bind to /dev/log or /var/run/log. allow syslogd_t devlog_t:sock_file manage_sock_file_perms; - files_pid_filetrans(syslogd_t, devlog_t, sock_file) - init_pid_filetrans(syslogd_t, devlog_t, sock_file, "dev-log") diff --git a/recipes-security/refpolicy/refpolicy-2.20170204/poky-policy-add-rules-for-var-log-symlink-apache.patch b/recipes-security/refpolicy/refpolicy-2.20170204/poky-policy-add-rules-for-var-log-symlink-apache.patch index fb912b5..6c96e33 100644 --- a/recipes-security/refpolicy/refpolicy-2.20170204/poky-policy-add-rules-for-var-log-symlink-apache.patch +++ b/recipes-security/refpolicy/refpolicy-2.20170204/poky-policy-add-rules-for-var-log-symlink-apache.patch @@ -17,15 +17,11 @@ Signed-off-by: Joe MacDonald <joe_macdonald@mentor.com> --- a/policy/modules/contrib/apache.te +++ b/policy/modules/contrib/apache.te -@@ -407,10 +407,11 @@ allow httpd_t httpd_lock_t:file manage_f - files_lock_filetrans(httpd_t, httpd_lock_t, { file dir }) - - manage_dirs_pattern(httpd_t, httpd_log_t, httpd_log_t) - manage_files_pattern(httpd_t, httpd_log_t, httpd_log_t) +@@ -411,6 +411,7 @@ create_files_pattern(httpd_t, httpd_log_ + append_files_pattern(httpd_t, httpd_log_t, httpd_log_t) + read_files_pattern(httpd_t, httpd_log_t, httpd_log_t) read_lnk_files_pattern(httpd_t, httpd_log_t, httpd_log_t) +read_lnk_files_pattern(httpd_t, var_log_t, var_log_t) logging_log_filetrans(httpd_t, httpd_log_t, file) allow httpd_t httpd_modules_t:dir list_dir_perms; - mmap_files_pattern(httpd_t, httpd_modules_t, httpd_modules_t) - read_files_pattern(httpd_t, httpd_modules_t, httpd_modules_t) |