[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/, policy/modules/system/

[Sven Vermeulen]

commit:     47e52f4053dbb7f6c1c8e87ca1281138ae9fdd50
Author:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
AuthorDate: Mon Oct 29 18:36:58 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Mon Oct 29 18:36:58 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=47e52f40

Fixing cron access

Update the system logger policy to not allow write access on all possible log
files (too many log types are marked as logfile even though many of them are not
meant to be managed by the system logger). Instead, we use specific rights - in
this case for the cron log file.

Introduce a named file transition for when the system logger creates the initial
cron.log file. Also allow the write, setattr and create rights. We don't
implement full _manage_ rights as system loggers are not meant to remove log
files (unless someone points me to a use case for that).

---
 policy/modules/contrib/cron.if   |   83 ++++++++++++++++++++++++++++++++++++++
 policy/modules/system/logging.te |    7 ++-
 2 files changed, 88 insertions(+), 2 deletions(-)

diff --git a/policy/modules/contrib/cron.if b/policy/modules/contrib/cron.if
index 2981f1f..e6259bd 100644
--- a/policy/modules/contrib/cron.if
+++ b/policy/modules/contrib/cron.if
@@ -409,6 +409,89 @@ interface(`cron_sigchld',`
 
 ########################################
 ## <summary>
+##	Set the attributes of cron log files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`cron_setattr_log_files',`
+	gen_require(`
+		type cron_log_t;
+	')
+
+	allow $1 cron_log_t:file setattr_file_perms;
+')
+
+########################################
+## <summary>
+##	Create cron log files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`cron_create_log_files',`
+	gen_require(`
+		type cron_log_t;
+	')
+
+	allow $1 cron_log_t:file create_file_perms;
+')
+
+########################################
+## <summary>
+##	Write to cron log files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`cron_write_log_files',`
+	gen_require(`
+		type cron_log_t;
+	')
+
+	allow $1 cron_log_t:file write_file_perms;
+')
+
+########################################
+## <summary>
+##	Create specified objects in generic
+##	log directories with the cron log file type.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="object_class">
+##	<summary>
+##	Class of the object being created.
+##	</summary>
+## </param>
+## <param name="name" optional="true">
+##	<summary>
+##	The name of the object being created.
+##	</summary>
+## </param>
+#
+interface(`cron_generic_log_filetrans_log',`
+	gen_require(`
+		type cron_log_t;
+	')
+
+	logging_log_filetrans($1, cron_log_t, $2, $3)
+')
+
+########################################
+## <summary>
 ##	Read cron daemon unnamed pipes.
 ## </summary>
 ## <param name="domain">

diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te
index 0e817b7..116b338 100644
--- a/policy/modules/system/logging.te
+++ b/policy/modules/system/logging.te
@@ -470,12 +470,15 @@ userdom_dontaudit_use_unpriv_user_fds(syslogd_t)
 userdom_dontaudit_search_user_home_dirs(syslogd_t)
 
 ifdef(`distro_gentoo',`
-	allow syslogd_t logfile:file { write_file_perms setattr_file_perms };
-
 	# default gentoo syslog-ng config appends kernel
 	# and high priority messages to /dev/tty12
 	term_append_unallocated_ttys(syslogd_t)
 	term_dontaudit_setattr_unallocated_ttys(syslogd_t)
+
+	cron_create_log_files(syslogd_t)
+	cron_generic_log_filetrans_log(syslogd_t, file, "cron.log")
+	cron_setattr_log_files(syslogd_t)
+	cron_write_log_files(syslogd_t)
 ')
 
 ifdef(`distro_suse',`