[refpolicy] [PATCH 1/1] Allow userdomains to send syslog messages

[domg472@gmail.com (Dominick Grift)]

On Wed, Aug 24, 2011 at 09:10:00AM -0400, Christopher J. PeBenito wrote:
> On 08/23/11 06:57, Sven Vermeulen wrote:
> > Some applications that run within the user domain send messages to the syslog
> > daemon (for instance through the syslog() function). This patch allows the
> > userdomain to write to the devlog_t socket and interact properly with the
> > syslog daemon.
> 
> Do you have some examples?  My initial reaction is definitely not
> merged, as I don't want users to be able to flood the system logs.

I do, the git-daemon run by users can be configured to use syslog. I allowed this by default in my git policy. Would you prefer a boolean "git_session_daemon_can_syslog" instead of allowing it by default?

> 
> 
> > Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
> > ---
> >  policy/modules/system/userdomain.if |    2 ++
> >  1 files changed, 2 insertions(+), 0 deletions(-)
> > 
> > diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if
> > index c6d3cc8..17abfcf 100644
> > --- a/policy/modules/system/userdomain.if
> > +++ b/policy/modules/system/userdomain.if
> > @@ -965,6 +965,8 @@ template(`userdom_unpriv_user_template', `
> >  	# cjp: why?
> >  	files_read_kernel_symbol_table($1_t)
> >  
> > +	logging_send_syslog_msg($1_t)
> > +
> >  	ifndef(`enable_mls',`
> >  		fs_exec_noxattr($1_t)
> >  
> 
> 
> -- 
> Chris PeBenito
> Tresys Technology, LLC
> www.tresys.com | oss.tresys.com
> _______________________________________________
> refpolicy mailing list
> refpolicy at oss.tresys.com
> http://oss.tresys.com/mailman/listinfo/refpolicy
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 198 bytes
Desc: not available
Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20110824/b2a56548/attachment.bin