From: sven.vermeulen@siphos.be (Sven Vermeulen)
Date: Wed, 31 Oct 2012 18:58:09 +0100
Subject: [refpolicy] [PATCH 1/1] Allow system logger to write to cron
 log files
In-Reply-To: <1351694777.4200.26.camel@d30.localdomain>
References: <20121029191656.GA14388@siphos.be> <509135F9.4040202@tresys.com>
	<1351694777.4200.26.camel@d30.localdomain>
Message-ID: <20121031175808.GA31545@siphos.be>
To: refpolicy@oss.tresys.com
List-Id: refpolicy.oss.tresys.com

On Wed, Oct 31, 2012 at 03:46:17PM +0100, Dominick Grift wrote:
> > While we already have syslogd doing this for inn logs, your patch makes me question this.  Do we really want this?  It seems that we would want all of the syslog logs to be var_log_t.  If a service does logging itself, it would need a private log type, but if its logging to syslog, the logs should probably still come out var_log_t.
> 
> Why? What is your argument for this?
> 
> I could think of one argument to use private types. This will help the
> administrator of the service. We can now give him access to only the
> service logs as opposed to all generic logs

My first idea was to allow syslogd_t to manage all possible log files
(attribute "logfile"), but grift correctly pointed out that not all log
files are to be managed by the system logger, making this a bit too broad.
Prime examples of this are xserver_log_t, rpm_log_t, portage_log_t,
fsadm_log_t and others. Some of these are only generated by their respective
daemons, others are application log files (not service/daemon, and
definitely not syslog trigered).

Another possibility would be to provide interfaces like
"logging_syslog_log_file" and "logging_syslog_log_dir" which takes two
arguments, one being the type and one being an (optional) name to use for
file name transitions.

In case of cron, this could then be something like:

type cron_log_t;
logging_syslog_log_file(cron_log_t, "cron.log")

If the type is also to be used for directories, something like

type httpd_log_t;
logging_syslog_log_file(httpd_log_t)
logging_syslog_log_dir(httpd_log_t, "apache")

The interface would then assign an attribute "syslogfile" to the type, and
introduce a file transition:

logging_syslog_log_file(`
	gen_require(`
		attribute syslogfile;
		type syslogd_t;
		type var_log_t;
	')

	typeattribute $1 syslogfile;
	filetrans_pattern(syslogd_t, var_log_t, $1, file, $2)

	logging_log_file($1)
')

In the logging.te, there would be something like:

manage_files_pattern(syslogd_t, syslogfile, syslogfile)
manage_dirs_pattern(syslogd_t, syslogfile, syslogfile)

Is that an option to consider?

Wkr,
	Sven Vermeulen