commit: 5fcc3d0770d58a36c657164ff60d81a276c39d79
Author: Chris PeBenito <Christopher.PeBenito <AT> microsoft <DOT> com>
AuthorDate: Thu May 16 12:57:36 2019 +0000
Commit: Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Sat Jul 13 06:43:14 2019 +0000
URL:
https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=5fcc3d07
logrotate: Make MTA optional.
Signed-off-by: Chris PeBenito <Christopher.PeBenito <AT> microsoft.com>
Signed-off-by: Jason Zaman <jason <AT> perfinion.com>
policy/modules/admin/logrotate.te | 22 +++++++++++++---------
1 file changed, 13 insertions(+), 9 deletions(-)
diff --git a/policy/modules/admin/logrotate.te
b/policy/modules/admin/logrotate.te
index 52cb35a5..37bab0aa 100644
--- a/policy/modules/admin/logrotate.te
+++ b/policy/modules/admin/logrotate.te
@@ -29,8 +29,6 @@ files_type(logrotate_var_lib_t)
type logrotate_unit_t;
init_unit_file(logrotate_unit_t)
-mta_base_mail_template(logrotate)
-role system_r types logrotate_mail_t;
########################################
#
@@ -131,8 +129,6 @@ userdom_use_user_terminals(logrotate_t)
userdom_list_user_home_dirs(logrotate_t)
userdom_use_unpriv_users_fds(logrotate_t)
-mta_sendmail_domtrans(logrotate_t, logrotate_mail_t)
-
ifdef(`distro_debian',`
allow logrotate_t logrotate_tmp_t:file relabel_file_perms;
can_exec(logrotate_t, logrotate_exec_t)
@@ -279,13 +275,21 @@ optional_policy(`
# Mail local policy
#
-allow logrotate_mail_t logrotate_t:fd use;
-allow logrotate_mail_t logrotate_t:fifo_file rw_fifo_file_perms;
-allow logrotate_mail_t logrotate_t:process sigchld;
+optional_policy(`
+ mta_base_mail_template(logrotate)
+ role system_r types logrotate_mail_t;
+
+ allow logrotate_mail_t logrotate_t:fd use;
+ allow logrotate_mail_t logrotate_t:fifo_file rw_fifo_file_perms;
+ allow logrotate_mail_t logrotate_t:process sigchld;
-manage_files_pattern(logrotate_mail_t, logrotate_tmp_t, logrotate_tmp_t)
+ manage_files_pattern(logrotate_mail_t, logrotate_tmp_t, logrotate_tmp_t)
+
+ mta_sendmail_domtrans(logrotate_t, logrotate_mail_t)
+
+ logging_read_all_logs(logrotate_mail_t)
+')
-logging_read_all_logs(logrotate_mail_t)
ifdef(`distro_gentoo',`
# Fix bug 534256 - fail2ban installs a logrotate file that calls
fail2ban-client so allow transition
