Smaller updates on main policy modules
cover Smaller updates on main policy modules
This patchset contains a few smaller updates on the main policy modules. The first one (syslogger managing cron log files) requires the cron_manage_log interface to be available in the cron module first (sent earlier as a patch).
Sven Vermeulen (2):
Allow syslogger to manage cron log files
Run ipset in iptables domain
policy/modules/system/iptables.fc | 1 + policy/modules/system/logging.te | 5 +++++ 2 files changed, 6 insertions(+), 0 deletions(-)
Signature · 1 line
1.7.8.6
PATCH 1/2 Allow syslogger to manage cron log files
Some cron daemons, including vixie-cron, support using the system logger for handling their logging events. Hence we allow syslogd_t to manage the cron logs, and put a file transition in place for the system logger when it creates the cron.log file.
--- policy/modules/system/logging.te | 5 +++++ 1 files changed, 5 insertions(+), 0 deletions(-)
policy/modules/system/logging.te +5 -0
@@ -490,6 +490,11 @@ optional_policy(` ') optional_policy(` + cron_manage_log(syslogd_t) + cron_generic_log_filetrans_log(syslogd_t, file, "cron.log") +') + +optional_policy(` inn_manage_log(syslogd_t) ')
Signature · 1 line
1.7.8.6
PATCH 1/2 Allow syslogger to manage cron log files
Quoted 15 lines · Sven Vermeulen
Some cron daemons, including vixie-cron, support using the system logger for handling their logging events. Hence we allow
syslogd_tto manage the cron logs, and put a file transition in place for the system logger when it creates the cron.log file.Signed-off-by Sven Vermeulen <[email protected]>--- policy/modules/system/logging.te | 5 +++++ 1 files changed, 5 insertions(+), 0 deletions(-)policy/modules/system/logging.te +0
-0
policy/modules/system/logging.te optional_policy(` · line 493
Quoted 4 lines
policy/modules/system/logging.te +1
-0@@ -490,6 +490,11 @@ optional_policy(` ') optional_policy(` + cron_manage_log(syslogd_t)
There is a cron_manage_log_files()
Quoted 7 lines
policy/modules/system/logging.te +4
-0+ cron_generic_log_filetrans_log(syslogd_t, file, "cron.log") +') + +optional_policy(` inn_manage_log(syslogd_t) ')
PATCH 2/2 Run ipset in iptables domain
In reply to Sven VermeulenThe ipset command is used to manage ip sets, used by iptables for a more flexible management of firewall rules. It has very similar requirements as iptables for accessing and working with the Linux kernel, so marking ipset as iptables_exec_t to have it run in the iptables domain.
--- policy/modules/system/iptables.fc | 1 + 1 files changed, 1 insertions(+), 0 deletions(-)
policy/modules/system/iptables.fc +1 -0
@@ -15,6 +15,7 @@ /sbin/xtables-multi -- gen_context(system_u:object_r:iptables_exec_t,s0) /usr/sbin/ipchains.* -- gen_context(system_u:object_r:iptables_exec_t,s0) +/usr/sbin/ipset -- gen_context(system_u:object_r:iptables_exec_t,s0) /usr/sbin/iptables -- gen_context(system_u:object_r:iptables_exec_t,s0) /usr/sbin/iptables-multi -- gen_context(system_u:object_r:iptables_exec_t,s0) /usr/sbin/iptables-restore -- gen_context(system_u:object_r:iptables_exec_t,s0)
Signature · 1 line
1.7.8.6
cover Smaller updates on main policy modules
In reply to Sven VermeulenQuoted 11 lines · Sven Vermeulen
This patchset contains a few smaller updates on the main policy modules. The first one (syslogger managing cron log files) requires the
cron_manage_loginterface to be available in the cron module first (sent earlier as a patch).Sven Vermeulen (2):
Allow syslogger to manage cron log files
Run ipset in iptables domainpolicy/modules/system/iptables.fc | 1 + policy/modules/system/logging.te | 5 +++++ 2 files changed, 6 insertions(+), 0 deletions(-)
This set merged.
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com
cover Smaller updates on main policy modules
Quoted 9 lines · Christopher J. PeBenito
Quoted 8 lines · Sven Vermeulen
This patchset contains a few smaller updates on the main policy modules. The first one (syslogger managing cron log files) requires the
cron_manage_loginterface to be available in the cron module first (sent earlier as a patch).Sven Vermeulen (2):
Allow syslogger to manage cron log files
Run ipset in iptables domain
Quoted 5 lines
Quoted 3 lines
policy/modules/system/iptables.fc | 1 + policy/modules/system/logging.te | 5 +++++ 2 files changed, 6 insertions(+), 0 deletions(-)This set merged.
Hit send too fast; only merged the iptables one. Cron interface doesn't exist for use in logging.
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com