From 2907553dfa149911906b803e046927d5054d7de9 Mon Sep 17 00:00:00 2001 From: Antonio Enrico Russo Date: Sat, 20 Jun 2026 05:33:01 -0600 Subject: [PATCH] wip-logging --- policy/modules/kernel/kernel.te | 6 +++++- policy/modules/system/init.te | 11 ++++++----- policy/modules/system/logging.if | 4 ++-- policy/modules/system/logging.te | 7 +++---- 4 files changed, 16 insertions(+), 12 deletions(-) diff --git a/policy/modules/kernel/kernel.te b/policy/modules/kernel/kernel.te index 6917215c60..7079fa78b4 100644 --- a/policy/modules/kernel/kernel.te +++ b/policy/modules/kernel/kernel.te @@ -50,7 +50,11 @@ type kernel_t, can_load_kernmodule; domain_base_type(kernel_t) role system_r types kernel_t; sid kernel gen_context(system_u:system_r:kernel_t,mls_systemhigh) -sid init gen_context(system_u:system_r:kernel_t,mls_systemhigh) + +type init_t; +domain_type(init_t) +role system_r types init_t; +sid init gen_context(system_u:system_r:init_t,mls_systemhigh) # # DebugFS diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te index 388c9b28c4..35e511186a 100644 --- a/policy/modules/system/init.te +++ b/policy/modules/system/init.te @@ -67,12 +67,13 @@ files_type(init_random_seed_t) # # init_t is the domain of the init process. # -type init_t, initrc_transition_domain; +gen_require(` + type init_t; +') +typeattribute init_t initrc_transition_domain; type init_exec_t; -domain_type(init_t) domain_entry_file(init_t, init_exec_t) kernel_domtrans_to(init_t, init_exec_t) -role system_r types init_t; optional_policy(` # required by calico @@ -208,7 +209,7 @@ files_runtime_filetrans(init_t, initctl_t, fifo_file) # Modify utmp. allow init_t initrc_runtime_t:file { rw_file_perms setattr }; -allow init_t init_tmpfs_t:file manage_file_perms; +allow init_t init_tmpfs_t:file { manage_file_perms relabelfrom }; fs_tmpfs_filetrans(init_t, init_tmpfs_t, file) kernel_read_psi(init_t) @@ -1183,7 +1184,7 @@ ifdef(`init_systemd',` allow initrc_t init_script_file_type:service { reload start status stop }; # Access to notify socket for services with Type=notify - kernel_dgram_send(initrc_t) + init_dgram_send(initrc_t) # run systemd misc initializations # in the initrc_t domain, as would be diff --git a/policy/modules/system/logging.if b/policy/modules/system/logging.if index 3dd2c06c26..718106ce97 100644 --- a/policy/modules/system/logging.if +++ b/policy/modules/system/logging.if @@ -702,8 +702,8 @@ interface(`logging_send_syslog_msg',` # Allow systemd-journald to check whether the process died allow syslogd_t $1:process signull; - kernel_dgram_send($1) - kernel_stream_connect($1) + init_dgram_send($1) + init_stream_connect($1) ') ') diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te index 314b2559bf..b22018cdc1 100644 --- a/policy/modules/system/logging.te +++ b/policy/modules/system/logging.te @@ -521,12 +521,11 @@ ifdef(`init_systemd',` # remove /run/log/journal when switching to permanent storage allow syslogd_t var_log_t:dir rmdir; - kernel_getattr_dgram_sockets(syslogd_t) kernel_read_ring_buffer(syslogd_t) - kernel_rw_stream_sockets(syslogd_t) - kernel_rw_unix_dgram_sockets(syslogd_t) + init_rw_stream_sockets(syslogd_t) + allow syslogd_t init_t:unix_dgram_socket { getattr ioctl read write }; kernel_rw_netlink_audit_sockets(syslogd_t) - kernel_use_fds(syslogd_t) + init_use_fds(syslogd_t) dev_read_kmsg(syslogd_t) dev_read_urand(syslogd_t)