Fail2ban client checks state of log files before telling the server
PATCH v2 1/1 Fail2ban client checks state of log files before telling the server
When a (re)configuration occurs, fail2ban-client invokes an internal script called jailreader which will look through the configured log files and check their state before informing the server that these log files need to be "watched".
During this operation, fail2ban-client requires dac_read_search capability (in case the log file/directory isn't owned by the same user that fail2ban-client runs as, which is a very common case) as well as getattr rights on all log files (and search privileges on the directories).
Updated since previous patch with correct name for search_all_logs
--- fail2ban.te | 4 ++++ 1 files changed, 4 insertions(+), 0 deletions(-)
fail2ban.te +4 -0
@@ -124,6 +124,7 @@ optional_policy(` # Client Local policy # +allow fail2ban_client_t self:capability dac_read_search; allow fail2ban_client_t self:unix_stream_socket { create connect write read }; domtrans_pattern(fail2ban_client_t, fail2ban_exec_t, fail2ban_t)
@@ -140,6 +141,9 @@ files_read_etc_files(fail2ban_client_t) files_read_usr_files(fail2ban_client_t) files_search_pids(fail2ban_client_t) +logging_getattr_all_logs(fail2ban_client_t) +logging_search_all_logs(fail2ban_client_t) + miscfiles_read_localization(fail2ban_client_t) userdom_dontaudit_search_user_home_dirs(fail2ban_client_t)
Signature · 1 line
1.7.8.6
Dominick Grift
AppliedPATCH v2 1/1 Fail2ban client checks state of log files before telling the server
Quoted 30 lines · Sven Vermeulen
When a (re)configuration occurs, fail2ban-client invokes an internal script called jailreader which will look through the configured log files and check their state before informing the server that these log files need to be "watched".
During this operation, fail2ban-client requires
dac_read_searchcapability (in case the log file/directory isn't owned by the same user that fail2ban-client runs as, which is a very common case) as well as getattr rights on all log files (and search privileges on the directories).Updated since previous patch with correct name for
search_all_logsSigned-off-by Sven Vermeulen <[email protected]>--- fail2ban.te | 4 ++++ 1 files changed, 4 insertions(+), 0 deletions(-)fail2ban.te +1
-0@@ -124,6 +124,7 @@ optional_policy(` # Client Local policy # +allow fail2ban_client_t self:capability dac_read_search; allow fail2ban_client_t self:unix_stream_socket { create connect write read }; domtrans_pattern(fail2ban_client_t, fail2ban_exec_t, fail2ban_t)
fail2ban.te files_read_etc_files(fail2ban_client_t) · line 149
Quoted 9 lines
fail2ban.te +3
-0@@ -140,6 +141,9 @@ files_read_etc_files(fail2ban_client_t) files_read_usr_files(fail2ban_client_t) files_search_pids(fail2ban_client_t) +logging_getattr_all_logs(fail2ban_client_t) +logging_search_all_logs(fail2ban_client_t) + miscfiles_read_localization(fail2ban_client_t) userdom_dontaudit_search_user_home_dirs(fail2ban_client_t)
Merged, thanks