Allow system logger to write to cron log files
PATCH 1/1 Allow system logger to write to cron log files
The system logger is responsible for writing log events in various log files. Some of these log files are not labeled as var_log_t, but have their domains' specific logging type set. One of these is cron_log_t.
Allow syslogd_t to write to the cron log files, and introduce a file transition when the file is just created.
--- policy/modules/system/logging.te | 7 +++++++ 1 files changed, 7 insertions(+), 0 deletions(-)
policy/modules/system/logging.te +7 -0
@@ -490,6 +490,13 @@ optional_policy(` ') optional_policy(` + cron_create_log_files(syslogd_t) + cron_generic_log_filetrans_log(syslogd_t, file, "cron.log") + cron_setattr_log_files(syslogd_t) + cron_write_log_files(syslogd_t) +') + +optional_policy(` inn_manage_log(syslogd_t) ')
Signature · 1 line
1.7.8.6
PATCH 1/1 Allow system logger to write to cron log files
Quoted 6 lines · Sven Vermeulen
The system logger is responsible for writing log events in various log files. Some of these log files are not labeled as
var_log_t, but have their domains' specific logging type set. One of these iscron_log_t.Allow
syslogd_tto write to the cron log files, and introduce a file transition when the file is just created.
While we already have syslogd doing this for inn logs, your patch makes me question this. Do we really want this? It seems that we would want all of the syslog logs to be var_log_t. If a service does logging itself, it would need a private log type, but if its logging to syslog, the logs should probably still come out var_log_t.
Quoted 22 lines
Signed-off-by Sven Vermeulen <[email protected]>--- policy/modules/system/logging.te | 7 +++++++ 1 files changed, 7 insertions(+), 0 deletions(-)policy/modules/system/logging.te +7
-0@@ -490,6 +490,13 @@ optional_policy(` ') optional_policy(` + cron_create_log_files(syslogd_t) + cron_generic_log_filetrans_log(syslogd_t, file, "cron.log") + cron_setattr_log_files(syslogd_t) + cron_write_log_files(syslogd_t) +') + +optional_policy(` inn_manage_log(syslogd_t) ')
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com
PATCH 1/1 Allow system logger to write to cron log files
Quoted 9 lines · Christopher J. PeBenito
Quoted 6 lines · Sven Vermeulen
The system logger is responsible for writing log events in various log files. Some of these log files are not labeled as
var_log_t, but have their domains' specific logging type set. One of these iscron_log_t.Allow
syslogd_tto write to the cron log files, and introduce a file transition when the file is just created.While we already have syslogd doing this for inn logs, your patch makes me question this. Do we really want this? It seems that we would want all of the syslog logs to be
var_log_t. If a service does logging itself, it would need a private log type, but if its logging to syslog, the logs should probably still come outvar_log_t.
Why? What is your argument for this?
I could think of one argument to use private types. This will help the administrator of the service. We can now give him access to only the service logs as opposed to all generic logs
Quoted 23 lines
Quoted 22 lines
Signed-off-by Sven Vermeulen <[email protected]>--- policy/modules/system/logging.te | 7 +++++++ 1 files changed, 7 insertions(+), 0 deletions(-)policy/modules/system/logging.te +7
-0@@ -490,6 +490,13 @@ optional_policy(` ') optional_policy(` + cron_create_log_files(syslogd_t) + cron_generic_log_filetrans_log(syslogd_t, file, "cron.log") + cron_setattr_log_files(syslogd_t) + cron_write_log_files(syslogd_t) +') + +optional_policy(` inn_manage_log(syslogd_t) ')
PATCH 1/1 Allow system logger to write to cron log files
Quoted 7 lines · Dominick Grift
Quoted 1 line
While we already have syslogd doing this for inn logs, your patch makes me question this. Do we really want this? It seems that we would want all of the syslog logs to be
var_log_t. If a service does logging itself, it would need a private log type, but if its logging to syslog, the logs should probably still come outvar_log_t.Why? What is your argument for this?
I could think of one argument to use private types. This will help the administrator of the service. We can now give him access to only the service logs as opposed to all generic logs
My first idea was to allow syslogd_t to manage all possible log files (attribute "logfile"), but grift correctly pointed out that not all log files are to be managed by the system logger, making this a bit too broad. Prime examples of this are xserver_log_t, rpm_log_t, portage_log_t, fsadm_log_t and others. Some of these are only generated by their respective daemons, others are application log files (not service/daemon, and definitely not syslog trigered).
Another possibility would be to provide interfaces like "logging_syslog_log_file" and "logging_syslog_log_dir" which takes two arguments, one being the type and one being an (optional) name to use for file name transitions.
In case of cron, this could then be something like:
type cron_log_t;logging_syslog_log_file(cron_log_t, "cron.log")
If the type is also to be used for directories, something like
type httpd_log_t;logging_syslog_log_file(httpd_log_t)logging_syslog_log_dir(httpd_log_t, "apache")
The interface would then assign an attribute "syslogfile" to the type, and introduce a file transition:
logging_syslog_log_file(`
gen_require(` attribute syslogfile; type syslogd_t; type var_log_t; ') typeattribute $1 syslogfile; filetrans_pattern(syslogd_t, var_log_t, $1, file, $2) logging_log_file($1)
')
In the logging.te, there would be something like:
manage_files_pattern(syslogd_t, syslogfile, syslogfile) manage_dirs_pattern(syslogd_t, syslogfile, syslogfile)
Is that an option to consider?
Wkr,
Sven Vermeulen