Add policy for systemd_logger and additional proivs for systemd_logind

diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
index af215c134cd3e9c18b33aabbb738bf9857977967..82cf8aedaeeb7e06dd8fb1b6c17db69d5500ce7b 100644 (file)
--- a/policy/modules/system/init.te
+++ b/policy/modules/system/init.te
@@ -332,6 +332,7 @@ tunable_policy(`init_systemd',`
 
        systemd_exec_systemctl(init_t)
        systemd_read_unit_files(init_t)
+       systemd_logger_stream_connect(init_t)
 
        # needs to remain
        logging_create_devlog_dev(init_t)

diff --git a/policy/modules/system/systemd.fc b/policy/modules/system/systemd.fc
index 9819b563684712a7fa8c5d1532143249b9bfd74b..3248032157aca81848c2eb3ec2e24fb1af3f39bc 100644 (file)
--- a/policy/modules/system/systemd.fc
+++ b/policy/modules/system/systemd.fc
@@ -8,6 +8,7 @@
 
 /lib/systemd/system(/.*)?                              --              gen_context(system_u:object_r:systemd_unit_file_t,s0)
 /lib/systemd/systemd-logind    --      gen_context(system_u:object_r:systemd_logind_exec_t,s0)
+/lib/systemd/systemd-logger    --      gen_context(system_u:object_r:systemd_logger_exec_t,s0)
 /lib/systemd/systemd-tmpfiles                          --              gen_context(system_u:object_r:systemd_tmpfiles_exec_t,s0)
 
 /var/run/systemd/seats(/.*)?   gen_context(system_u:object_r:systemd_logind_var_run_t,s0)

diff --git a/policy/modules/system/systemd.if b/policy/modules/system/systemd.if
index 31e51f24c30fe95134073ac3170af461d52dabfd..9cc3fb6195ffdc5cc9bc387094fbf6b8e95522e6 100644 (file)
--- a/policy/modules/system/systemd.if
+++ b/policy/modules/system/systemd.if
@@ -304,3 +304,22 @@ interface(`systemd_passwd_agent_dev_template',`
                allow systemd_passwd_agent_t systemd_$1_device_t:sock_file write;
         allow systemd_passwd_agent_t systemd_$1_device_t:file read_file_perms;
 ')
+
+########################################
+## <summary>
+##     Allow the specified domain to connect to
+##     systemd_logger with a unix socket.
+## </summary>
+## <param name="domain">
+##     <summary>
+##     Domain allowed access.
+##     </summary>
+## </param>
+#
+interface(`systemd_logger_stream_connect',`
+       gen_require(`
+               type systemd_logger_t;
+       ')
+
+       allow $1 systemd_logger_t:unix_stream_socket connectto;
+')

diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
index fdc509dbc5cd44047ae82db7e8f5039c298c0bf1..4571714fb4ae674b7b4a8adc9dd9c3ffb385a443 100644 (file)
--- a/policy/modules/system/systemd.te
+++ b/policy/modules/system/systemd.te
@@ -8,6 +8,12 @@ policy_module(systemd, 1.0.0)
 attribute systemd_unit_file_type;
 
 # New in f16
+permissive systemd_logger_t;
+
+type systemd_logger_t;
+type systemd_logger_exec_t;
+init_systemd_domain(systemd_logger_t, systemd_logger_exec_t)
+
 permissive systemd_logind_t;
 
 type systemd_logind_t;
@@ -72,12 +78,12 @@ init_pid_filetrans(systemd_logind_t, systemd_logind_var_run_t, dir)
 
 dev_read_sysfs(systemd_logind_t)
 
-dev_getattr_dri_dev(systemd_logind_t)
+dev_getattr_all_chr_files(systemd_logind_t)
+dev_getattr_all_blk_files(systemd_logind_t)
 dev_setattr_dri_dev(systemd_logind_t)
-dev_getattr_sound_dev(systemd_logind_t)
 dev_setattr_sound_dev(systemd_logind_t)
-dev_getattr_video_dev(systemd_logind_t)
 dev_setattr_video_dev(systemd_logind_t)
+dev_setattr_kvm_dev(systemd_logind_t)
 
 # /etc/udev/udev.conf should probably have a private type if only for confined administration
 # /etc/nsswitch.conf
@@ -88,6 +94,9 @@ fs_manage_cgroup_dirs(systemd_logind_t)
 # write getattr open setattr
 fs_manage_cgroup_files(systemd_logind_t)
 
+storage_setattr_removable_dev(systemd_logind_t)
+storage_setattr_scsi_generic_dev(systemd_logind_t)
+
 term_use_unallocated_ttys(systemd_logind_t)
 
 # /run/user/.*
@@ -268,3 +277,47 @@ miscfiles_read_localization(systemd_notify_t)
 optional_policy(`
        readahead_manage_pid_files(systemd_notify_t)
 ')
+
+########################################
+#
+# systemd_logger local policy
+#
+allow systemd_logger_t self:capability { sys_admin chown kill };
+allow systemd_logger_t self:process { fork setfscreate setsockcreate };
+
+allow systemd_logger_t self:fifo_file rw_fifo_file_perms;
+allow systemd_logger_t self:unix_stream_socket create_stream_socket_perms;
+
+domain_use_interactive_fds(systemd_logger_t)
+
+files_read_etc_files(systemd_logger_t)
+
+auth_use_nsswitch(systemd_logger_t)
+
+logging_send_syslog_msg(systemd_logger_t)
+
+miscfiles_read_localization(systemd_logger_t)
+
+#============= abrt_helper_t ==============
+kernel_read_kernel_sysctls(abrt_helper_t)
+kernel_read_system_state(abrt_helper_t)
+
+#============= init_t ==============
+allow init_t systemd_logger_t:unix_stream_socket connectto;
+
+#============= initrc_t ==============
+allow initrc_t wdmd_var_run_t:dir add_name;
+allow initrc_t wdmd_var_run_t:file create;
+
+#============= system_dbusd_t ==============
+allow system_dbusd_t systemd_logind_sessions_t:fifo_file write;
+domain_type(system_dbusd_t)
+
+#============= systemd_logger_t ==============
+
+#============= virtd_t ==============
+allow virtd_t dnsmasq_var_run_t:dir create;
+
+#============= xdm_t ==============
+allow xdm_t systemd_logind_sessions_t:fifo_file write;
+domain_type(xdm_t)