log_container.cil

(block log_container
    (blockinherit container)

    (allow process var_t (dir (getattr search open)))
    (allow process logfile (dir (ioctl read getattr lock search open)))
    (allow process logfile (file (ioctl read getattr lock open map)))
    (allow process auditd_log_t (dir (ioctl read getattr lock search open)))
    (allow process auditd_log_t (file (ioctl read getattr lock open)))
)


(block log_rw_container
    (blockinherit log_container)

    (allow process logfile (dir (getattr search open)))
    (allow process logfile (file (ioctl read write getattr lock append open)))
    (allow process logfile (lnk_file (ioctl read write getattr lock append open)))
    (allow process var_t (dir (getattr search open)))
    (allow process auditd_log_t (dir (ioctl read write getattr lock search open)))
    (allow process auditd_log_t (file (ioctl read write getattr lock open)))
)

(block log_manage_container
    (blockinherit log_rw_container)

    (allow process logfile (dir (ioctl read write create getattr setattr lock unlink link rename add_name remove_name reparent search rmdir open)))
    (allow process logfile (file (ioctl read write create getattr setattr lock append unlink link rename open)))
    (allow process logfile (lnk_file (ioctl read write create getattr setattr lock append unlink link rename)))

)