commit: 75b6f28b5850e1e997dac51d25e1688999db603a Author: Nicolas Iooss <nicolas.iooss <AT> m4x <DOT> org> AuthorDate: Sun Sep 7 21:28:15 2014 +0000 Commit: Sven Vermeulen <swift <AT> gentoo <DOT> org> CommitDate: Sat Sep 13 09:30:15 2014 +0000 URL: http://sources.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=75b6f28b
Allow journald to access to the state of all processes When a process sends a syslog message to journald, journald records information such as command, executable, cgroup, etc.: http://cgit.freedesktop.org/systemd/systemd/tree/src/journal/journald-server.c?id=v215#n589 This needs domain_read_all_domains_state. --- policy/modules/system/logging.te | 2 ++ 1 file changed, 2 insertions(+) diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te index 241a409..85c3c73 100644 --- a/policy/modules/system/logging.te +++ b/policy/modules/system/logging.te @@ -443,6 +443,8 @@ dev_read_sysfs(syslogd_t) dev_rw_kmsg(syslogd_t) domain_use_interactive_fds(syslogd_t) +# Allow access to /proc/ information for journald +domain_read_all_domains_state(syslogd_t) files_read_etc_files(syslogd_t) files_read_usr_files(syslogd_t)
