I have an application that has two different type out output
files that are normally written to /var/log.
1: diagnostic log
- should be readable by "normal" system administrators.
2: security data
log - should only be readable by security officers.
Is there a different way to declare two different file
context types for output files?
My current attempts do not work:
For the diagnostic log, I have created a log file type
myapp_log_t, and created a file context:
/var/log/myapp\.log --
gen_context(system_u:object_r:myapp_log_t,s0)
Using the following policy statements, myapp creates a log
file, and SELinux takes care of assigning the file context automatically:
logging_log_file(myapp_log_t)
logging_log_filetrans(myapp_t, myapp_log_t, { file dir } )
manage_dirs_pattern(myapp_t, myapp_log_t, myapp_log_t)
manage_files_pattern(myapp_t, myapp_log_t, myapp_log_t)
I wish to have a different type for the data log, however
when I try to use logging_log_filetrans for a second log type, semodule
complains:
[root@host1 log]# semodule -i /home/brian/src/myapp/myapp.pp
libsepol.expand_terule_helper: conflicting TE rule for
(myapp_t, var_log_t:dir): old was myapp_log_t, new is myappsecurity_log_t
libsepol.expand_module: Error during expand
libsemanage.semanage_expand_sandbox: Expand module failed
semodule: Failed!
[root@host1 log]#
Thanks,
Brian