logrotate: update to the version from stretch and merge with my own changes

policy/modules/logrotate.fc

@@ -1,6 +1,9 @@
 /etc/cron\.(daily|weekly)/logrotate	--	gen_context(system_u:object_r:logrotate_exec_t,s0)
 /etc/cron\.(daily|weekly)/sysklogd	--	gen_context(system_u:object_r:logrotate_exec_t,s0)
 
+# Systemd unit file
+/usr/lib/systemd/system/[^/]*logrotate.*	--	gen_context(system_u:object_r:logrotate_unit_t,s0)
+
 /usr/sbin/logrotate	--	gen_context(system_u:object_r:logrotate_exec_t,s0)
 
 /var/lib/logrotate(/.*)?	gen_context(system_u:object_r:logrotate_var_lib_t,s0)

policy/modules/logrotate.te

@@ -1,4 +1,4 @@
-policy_module(logrotate, 1.16.5)
+policy_module(logrotate, 1.18.2)
 
 ########################################
 #
@@ -25,6 +25,9 @@ files_tmp_file(logrotate_tmp_t)
 type logrotate_var_lib_t;
 files_type(logrotate_var_lib_t)
 
+type logrotate_unit_t;
+init_unit_file(logrotate_unit_t)
+
 mta_base_mail_template(logrotate)
 role system_r types logrotate_mail_t;
 
@@ -33,8 +36,9 @@ role system_r types logrotate_mail_t;
 # Local policy
 #
 
-allow logrotate_t self:capability { chown dac_override dac_read_search kill fsetid fowner setuid setgid sys_resource sys_nice sys_ptrace };
-allow logrotate_t self:process ~{ ptrace setcurrent setexec setrlimit execmem execstack execheap };
+allow logrotate_t self:capability { chown dac_override dac_read_search kill fsetid fowner net_admin setuid setgid sys_resource sys_nice sys_ptrace };
+allow logrotate_t self:process ~{ ptrace setcurrent setexec execmem execstack execheap };
+allow logrotate_t self:process execmem;
 allow logrotate_t self:fd use;
 allow logrotate_t self:key manage_key_perms;
 allow logrotate_t self:fifo_file rw_fifo_file_perms;
@@ -86,6 +90,7 @@ files_dontaudit_list_mnt(logrotate_t)
 fs_search_auto_mountpoints(logrotate_t)
 fs_getattr_xattr_fs(logrotate_t)
 fs_list_inotifyfs(logrotate_t)
+fs_getattr_tmpfs(logrotate_t)
 
 mls_file_read_all_levels(logrotate_t)
 mls_file_write_all_levels(logrotate_t)
@@ -99,6 +104,15 @@ auth_manage_login_records(logrotate_t)
 auth_use_nsswitch(logrotate_t)
 
 init_all_labeled_script_domtrans(logrotate_t)
+init_script_service_restart(logrotate_t)
+init_get_generic_units_status(logrotate_t)
+init_get_all_units_status(logrotate_t)
+init_get_system_status(logrotate_t)
+init_dbus_chat(logrotate_t)
+init_stream_connect(logrotate_t)
+
+dbus_system_bus_client(logrotate_t)
+init_write_pid_socket(logrotate_t)
 
 logging_manage_all_logs(logrotate_t)
 logging_send_syslog_msg(logrotate_t)
@@ -123,9 +137,7 @@ ifdef(`distro_debian',`
 	logging_read_syslog_config(logrotate_t)
 ')
 
-optional_policy(`
-	systemd_systemctl_domain(logrotate)
-')
+init_manage_all_units(logrotate_t)
 
 optional_policy(`
 	abrt_manage_cache(logrotate_t)
@@ -204,6 +216,7 @@ optional_policy(`
 optional_policy(`
 	mysql_read_config(logrotate_t)
 	mysql_stream_connect(logrotate_t)
+	mysql_signal(logrotate_t)
 ')
 
 optional_policy(`
@@ -236,31 +249,39 @@ optional_policy(`
 ')
 
 optional_policy(`
-	jabber_domtrans(logrotate_t)
+	su_exec(logrotate_t)
 ')
 
 optional_policy(`
-	su_exec(logrotate_t)
+	varnishd_manage_log(logrotate_t)
 ')
 
 optional_policy(`
-	varnishd_manage_log(logrotate_t)
+	manage_webalizer_var_lib(logrotate_t)
+	webalizer_run(logrotate_t, system_r)
+')
+
+optional_policy(`
+        gen_require(`
+               type phpfpm_etc_t;
+       ')
+       read_files_pattern(logrotate_t,phpfpm_etc_t,phpfpm_etc_t)
 ')
 
 optional_policy(`
-	gen_require(`
-		type php_usr_lib_t;
-	')
-	allow logrotate_t php_usr_lib_t:file { read open execute execute_no_trans };
+       gen_require(`
+               type php_usr_lib_t;
+       ')
+       allow logrotate_t php_usr_lib_t:file { read open execute execute_no_trans };
 ')
 
 optional_policy(`
         gen_require(`
-		type phpfpm_etc_t;
-	')
-	read_files_pattern(logrotate_t,phpfpm_etc_t,phpfpm_etc_t)
+               type php_etc_t;
+       ')
+       read_files_pattern(logrotate_t,php_etc_t,php_etc_t)
 ')
-	
+
 #######################################
 #
 # Mail local policy