Fix the symbol required in the clamav_append_log interface.
PATCH 1/1 Fix the symbol required in the clamav_append_log interface.
The label of clamd's log files is clamd_var_log_t instead of clamav_log_t, which in fact has not been defined by clamav.pp. If such un-decleared symbol is required by the clamav_append_log interface, the whole optional block that calls this interface would not be enabled as expected.
--- clamav.if | 6 +++--- 1 files changed, 3 insertions(+), 3 deletions(-)
clamav.if +3 -3
@@ -49,12 +49,12 @@ interface(`clamav_stream_connect',` # interface(`clamav_append_log',` gen_require(` - type clamav_log_t; + type clamd_var_log_t; ') logging_search_logs($1) - allow $1 clamav_log_t:dir list_dir_perms; - append_files_pattern($1, clamav_log_t, clamav_log_t) + allow $1 clamd_var_log_t:dir list_dir_perms; + append_files_pattern($1, clamd_var_log_t, clamd_var_log_t) ') ########################################
Signature · 1 line
1.7.0.4
PATCH 1/1 Fix the symbol required in the clamav_append_log interface.
When the mta.pp is linked and expanded along with other modules, the is_id_enabled function will throw out warning that "clamav_log_t" is out-of-scoped (after I adding some printf before it returns 0). Turns out this symbol is required by the clamav_append_log interface which in turn is called by mte.pp.
clamav.te only defines one type for the log files, clamd_var_log_t, which I guess should have been required in the clamav_append_log interface. Otherwise the whole below optional block won't be properly enabled:
optional_policy(`
clamav_stream_connect(system_mail_t)
clamav_append_log(system_mail_t)
')
Which could be surprising if people were wondering why the call of clamav_stream_connect(system_mail_t) had not worked as expected.
Thanks,
Harry
Quoted 31 lines · Harry Ciao
The label of clamd's log files is
clamd_var_log_tinstead ofclamav_log_t, which in fact has not been defined by clamav.pp. If such un-decleared symbol is required by theclamav_append_loginterface, the whole optional block that calls this interface would not be enabled as expected.Signed-off-by Harry Ciao<[email protected]>--- clamav.if | 6 +++--- 1 files changed, 3 insertions(+), 3 deletions(-)clamav.if +3
-3@@ -49,12 +49,12 @@ interface(`clamav_stream_connect',` # interface(`clamav_append_log',` gen_require(` - type clamav_log_t; + type clamd_var_log_t; ') logging_search_logs($1) - allow $1 clamav_log_t:dir list_dir_perms; - append_files_pattern($1, clamav_log_t, clamav_log_t) + allow $1 clamd_var_log_t:dir list_dir_perms; + append_files_pattern($1, clamd_var_log_t, clamd_var_log_t) ') ########################################
PATCH 1/1 Fix the symbol required in the clamav_append_log interface.
In reply to Harry CiaoQuoted 5 lines · Harry Ciao
The label of clamd's log files is
clamd_var_log_tinstead ofclamav_log_t, which in fact has not been defined by clamav.pp. If such un-decleared symbol is required by theclamav_append_loginterface, the whole optional block that calls this interface would not be enabled as expected.
Merged.
Quoted 25 lines
Signed-off-by Harry Ciao <[email protected]>--- clamav.if | 6 +++--- 1 files changed, 3 insertions(+), 3 deletions(-)clamav.if +3
-3@@ -49,12 +49,12 @@ interface(`clamav_stream_connect',` # interface(`clamav_append_log',` gen_require(` - type clamav_log_t; + type clamd_var_log_t; ') logging_search_logs($1) - allow $1 clamav_log_t:dir list_dir_perms; - append_files_pattern($1, clamav_log_t, clamav_log_t) + allow $1 clamd_var_log_t:dir list_dir_perms; + append_files_pattern($1, clamd_var_log_t, clamd_var_log_t) ') ########################################
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com