commit: 42a6dc478442e531cd701638057210d9b1c58ec1
Author: Jonathan Davies <jpds <AT> protonmail <DOT> com>
AuthorDate: Fri May 28 14:00:30 2021 +0000
Commit: Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Fri Nov 12 01:53:00 2021 +0000
URL:
https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=42a6dc47
logrotate.te: Added boolean for allowing logrotate to rotate the audit log.
Signed-off-by: Jonathan Davies <jpds <AT> protonmail.com>
Signed-off-by: Jason Zaman <perfinion <AT> gentoo.org>
policy/modules/admin/logrotate.te | 13 +++++++++++++
1 file changed, 13 insertions(+)
diff --git a/policy/modules/admin/logrotate.te
b/policy/modules/admin/logrotate.te
index 1c704120..1419d878 100644
--- a/policy/modules/admin/logrotate.te
+++ b/policy/modules/admin/logrotate.te
@@ -5,6 +5,14 @@ policy_module(logrotate, 1.26.0)
# Declarations
#
+## <desc>
+## <p>
+## Determine whether logrotate can manage
+## audit log files
+## </p>
+## </desc>
+gen_tunable(logrotate_manage_audit_log, false)
+
attribute_role logrotate_roles;
roleattribute system_r logrotate_roles;
@@ -138,6 +146,11 @@ ifdef(`distro_debian',`
logging_read_syslog_config(logrotate_t)
')
+tunable_policy(`logrotate_manage_audit_log',`
+ logging_manage_audit_log(logrotate_t)
+')
+
+
optional_policy(`
abrt_manage_cache(logrotate_t)
')
