commit: 303b29dde89cf3974eb2efd6927b7664df3e20e6 Author: Kenton Groombridge <me <AT> concord <DOT> sh> AuthorDate: Tue May 17 17:47:20 2022 +0000 Commit: Jason Zaman <perfinion <AT> gentoo <DOT> org> CommitDate: Sat Sep 3 18:41:55 2022 +0000 URL: https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=303b29dd
certbot: various fixes Allow acme-sh to send syslog msgs and dontaudit reading /proc. Signed-off-by: Kenton Groombridge <me <AT> concord.sh> Signed-off-by: Jason Zaman <perfinion <AT> gentoo.org> policy/modules/services/certbot.te | 3 +++ 1 file changed, 3 insertions(+) diff --git a/policy/modules/services/certbot.te b/policy/modules/services/certbot.te index ac609795..9723f788 100644 --- a/policy/modules/services/certbot.te +++ b/policy/modules/services/certbot.te @@ -69,6 +69,7 @@ allow certbot_t certbot_log_t:file manage_file_perms; manage_files_pattern(certbot_t, certbot_runtime_t, certbot_runtime_t) files_runtime_filetrans(certbot_t, certbot_runtime_t, file) +kernel_dontaudit_read_system_state(certbot_t) kernel_search_fs_sysctls(certbot_t) corecmd_list_bin(certbot_t) @@ -108,6 +109,8 @@ userdom_use_user_ptys(certbot_t) tunable_policy(`certbot_acmesh',` corecmd_exec_bin(certbot_t) corecmd_exec_shell(certbot_t) + + logging_send_syslog_msg(certbot_t) ') optional_policy(`