selinux-ossec/ossec.te

policy_module(ossec,1.0.161)

########################################
#
# Declarations
#

type ossec_t;
type ossec_bin_t;
files_type(ossec_bin_t)

type ossec_maild_t;
type ossec_maild_exec_t;
init_daemon_domain(ossec_maild_t, ossec_maild_exec_t)

type ossec_execd_t;
type ossec_execd_exec_t;
init_daemon_domain(ossec_execd_t, ossec_execd_exec_t)

type ossec_analysisd_t;
type ossec_analysisd_exec_t;
init_daemon_domain(ossec_analysisd_t, ossec_analysisd_exec_t)

type ossec_logcollector_t;
type ossec_logcollector_exec_t;
init_daemon_domain(ossec_logcollector_t, ossec_logcollector_exec_t)

type ossec_remoted_t;
type ossec_remoted_exec_t;
init_daemon_domain(ossec_remoted_t, ossec_remoted_exec_t)

type ossec_syscheckd_t;
type ossec_syscheckd_exec_t;
init_daemon_domain(ossec_syscheckd_t, ossec_syscheckd_exec_t)

type ossec_monitord_t;
type ossec_monitord_exec_t;
init_daemon_domain(ossec_monitord_t, ossec_monitord_exec_t)

type ossec_dbd_t;
type ossec_dbd_exec_t;
init_daemon_domain(ossec_dbd_t, ossec_dbd_exec_t)

type ossec_csyslogd_t;
type ossec_csyslogd_exec_t;
init_daemon_domain(ossec_csyslogd_t, ossec_csyslogd_exec_t)

type ossec_agentlessd_t;
type ossec_agentlessd_exec_t;
init_daemon_domain(ossec_agentlessd_t, ossec_agentlessd_exec_t)

type ossec_initrc_exec_t;
init_script_file(ossec_initrc_exec_t)

optional_policy(`
        ossec_domtrans(httpd_t)
')

type ossec_var_t;
files_type(ossec_var_t)

type ossec_var_run_t;
files_pid_file(ossec_var_run_t)

type ossec_tmp_t;
files_tmp_file(ossec_tmp_t)

type ossec_log_t;
logging_log_file(ossec_log_t)

type ossec_etc_t;
files_config_file(ossec_etc_t)

type ossec_etc_share_t;
files_config_file(ossec_etc_share_t)

type ossec_rule_t;
files_config_file(ossec_rule_t)

type ossec_stats_t;
files_type(ossec_stats_t)

type ossec_queue_t;
files_type(ossec_queue_t)

#type ossec_ar_t;
#files_type(ossec_ar_t);

#type ossec_ar_bin_t;
#files_type(ossec_ar_bin_t);

#type ossec_ar_exec_t;
#files_type(ossec_ar_exec_t);


type ossec_script_t;
type ossec_script_exec_t;
files_type(ossec_script_t)
domain_type(ossec_script_t)
domain_entry_file(ossec_script_t, ossec_script_exec_t)
domtrans_pattern(ossec_execd_t, ossec_script_exec_t, ossec_script_t)
role system_r types ossec_script_t;
unconfined_domain(ossec_script_t)
#unconfined_run(ossec_script_exec_t, ossec_script_t)

#type_transition ossec_execd_t ossec_script_exec_t:process unconfined_t;

#files_type(ossec_script_exec_t)
#domain_type(ossec_script_exec_t)
#domain_entry_file(ossec_script_exec_t, ossec_execd_t)
##domtrans_pattern(unconfined_t, ossec_script_exec_t, ossec_execd_t)
#unconfined_domain(ossec_script_exec_t)
#unconfined_shell_domtrans(ossec_script_exec_t)
#unconfined_run(ossec_execd_t, system_r)
#unconfined_run(ossec_script_exec_t, ossec_script_t)


require {
	type ossec_t;
	type ossec_bin_t;

	type ossec_maild_t;
	type ossec_maild_exec_t;
	type ossec_execd_t;
	type ossec_execd_exec_t;
	type ossec_analysisd_t;
	type ossec_analysisd_exec_t;
	type ossec_logcollector_t;
	type ossec_logcollector_exec_t;
	type ossec_remoted_t;
	type ossec_remoted_exec_t;
	type ossec_syscheckd_t;
	type ossec_syscheckd_exec_t;
	type ossec_monitord_t;
	type ossec_monitord_exec_t;
	type ossec_dbd_t;
	type ossec_dbd_exec_t;
	type ossec_csyslogd_t;
	type ossec_csyslogd_exec_t;
	type ossec_agentlessd_t;
	type ossec_agentlessd_exec_t;
	
	type ossec_var_t;
	type ossec_tmp_t;
	type ossec_log_t;
	type ossec_etc_t;
	type ossec_rule_t;
	type ossec_stats_t;
	type ossec_queue_t;
	type ossec_script_t;
	type ossec_script_exec_t;
	type httpd_t;
	type httpd_log_t;
	type unreserved_port_t;
	type smtp_port_t;
	type node_t;
	type shell_exec_t;
	type unconfined_t;
	class file { rename read lock create write getattr unlink open append entrypoint };
	class dir { write getattr read remove_name create add_name };
	class process { setsched transition rlimitinh siginh noatsecure };
	class capability { dac_override dac_read_search setuid setgid fsetid sys_chroot sys_nice };
	class tcp_socket { create name_bind name_connect };
	class udp_socket { create bind name_bind node_bind };

}


########################################
#
# ossec local policy
#


#============= ossec_maild_t ==============
auth_read_passwd(ossec_maild_t)

# init
allow ossec_maild_t self:capability { dac_override dac_read_search setuid setgid sys_chroot }; #fsetid sys_nice };
#allow ossec_t self:process { setsched };

# etc dir
search_dirs_pattern(ossec_maild_t, ossec_etc_t, ossec_etc_t)
read_lnk_files_pattern(ossec_maild_t, ossec_etc_t, ossec_etc_t)
read_files_pattern(ossec_maild_t, ossec_etc_t, ossec_etc_t)
sysnet_read_config(ossec_maild_t)

# var dir
search_dirs_pattern(ossec_maild_t, ossec_var_t, ossec_var_t)

# var run dir
manage_dirs_pattern(ossec_maild_t, ossec_var_run_t, ossec_var_run_t)
manage_files_pattern(ossec_maild_t, ossec_var_run_t, ossec_var_run_t)

# logs
search_dirs_pattern(ossec_maild_t, ossec_log_t, ossec_log_t)
read_files_pattern(ossec_maild_t, ossec_log_t, ossec_log_t)
allow ossec_maild_t ossec_log_t:file { create_file_perms append_file_perms };
logging_log_filetrans(ossec_maild_t, ossec_log_t, file)

# Sockets
#allow ossec_t self:udp_socket { create };
allow ossec_maild_t self:tcp_socket { create connect read write };
allow ossec_maild_t smtp_port_t:tcp_socket { name_connect };


#============= ossec_execd_t ==============

# init
auth_read_passwd(ossec_execd_t)
allow ossec_execd_t self:capability { dac_override dac_read_search setgid };

# var dir
#search_dirs_pattern(ossec_execd_t, ossec_var_t, ossec_var_t)
rw_dirs_pattern(ossec_execd_t, ossec_var_t, ossec_var_t)
#rw_files_pattern(ossec_execd_t, ossec_var_t, ossec_var_t)
#create_files_pattern(ossec_execd_t, ossec_var_t, ossec_var_t)
manage_files_pattern(ossec_execd_t, ossec_var_t, ossec_var_t)

# var run dir
manage_dirs_pattern(ossec_execd_t, ossec_var_run_t, ossec_var_run_t)
manage_files_pattern(ossec_execd_t, ossec_var_run_t, ossec_var_run_t)

# queue dir
rw_dirs_pattern(ossec_execd_t, ossec_queue_t, ossec_queue_t)
manage_sock_files_pattern(ossec_execd_t, ossec_queue_t, ossec_queue_t);

# logs
search_dirs_pattern(ossec_execd_t, ossec_log_t, ossec_log_t)
read_files_pattern(ossec_execd_t, ossec_log_t, ossec_log_t)
allow ossec_execd_t ossec_log_t:file { create_file_perms append_file_perms };
logging_log_filetrans(ossec_execd_t, ossec_log_t, file)

# etc dir
search_dirs_pattern(ossec_execd_t, ossec_etc_t, ossec_etc_t)
read_lnk_files_pattern(ossec_execd_t, ossec_etc_t, ossec_etc_t)
read_files_pattern(ossec_execd_t, ossec_etc_t, ossec_etc_t)
#sysnet_read_config(ossec_execd_t)

# etc share dir
search_dirs_pattern(ossec_execd_t, ossec_etc_share_t, ossec_etc_share_t)
read_files_pattern(ossec_execd_t, ossec_etc_share_t, ossec_etc_share_t)
#manage_files_pattern(ossec_execd_t, ossec_etc_share_t, ossec_etc_share_t)

# script dir
search_dirs_pattern(ossec_execd_t, ossec_script_t, ossec_script_t)
read_files_pattern(ossec_execd_t, ossec_script_exec_t, ossec_script_exec_t)
exec_files_pattern(ossec_execd_t, ossec_script_exec_t, ossec_script_exec_t)
exec_files_pattern(ossec_execd_t, shell_exec_t, shell_exec_t)


# dgram socket
allow ossec_execd_t self:unix_dgram_socket { create bind getopt read write };

# Read urandom
dev_read_urand(ossec_execd_t)

# Run autoresponce unconstrained
allow ossec_execd_t ossec_script_t:process { rlimitinh siginh noatsecure };
#allow ossec_execd_t unconfined_t:process { transition rlimitinh siginh noatsecure };
#allow unconfined_t ossec_script_exec_t:file { entrypoint };

##unconfined_domtrans(ossec_script_t)
##unconfined_run(ossec_execd_t, ossec_script_t)


#============= ossec_analysisd_t ==============

# init
auth_read_passwd(ossec_analysisd_t)
allow ossec_analysisd_t self:capability { dac_override dac_read_search fsetid setuid setgid sys_chroot };

# var dir
search_dirs_pattern(ossec_analysisd_t, ossec_var_t, ossec_var_t)
#rw_dirs_pattern(ossec_execd_t, ossec_var_t, ossec_var_t)
##rw_files_pattern(ossec_execd_t, ossec_var_t, ossec_var_t)
##create_files_pattern(ossec_execd_t, ossec_var_t, ossec_var_t)
##manage_files_pattern(ossec_execd_t, ossec_var_t, ossec_var_t)

# var run dir
manage_dirs_pattern(ossec_analysisd_t, ossec_var_run_t, ossec_var_run_t)
manage_files_pattern(ossec_analysisd_t, ossec_var_run_t, ossec_var_run_t)

# queue dir
rw_dirs_pattern(ossec_analysisd_t, ossec_queue_t, ossec_queue_t)
rw_files_pattern(ossec_analysisd_t, ossec_queue_t, ossec_queue_t)
manage_sock_files_pattern(ossec_analysisd_t, ossec_queue_t, ossec_queue_t)

# stats dir
rw_dirs_pattern(ossec_analysisd_t, ossec_stats_t, ossec_stats_t)
rw_files_pattern(ossec_analysisd_t, ossec_stats_t, ossec_stats_t)
create_files_pattern(ossec_analysisd_t, ossec_stats_t, ossec_stats_t)
append_files_pattern(ossec_analysisd_t, ossec_stats_t, ossec_stats_t)

# etc dir
search_dirs_pattern(ossec_analysisd_t, ossec_etc_t, ossec_etc_t)
read_lnk_files_pattern(ossec_analysisd_t, ossec_etc_t, ossec_etc_t)
read_files_pattern(ossec_analysisd_t, ossec_etc_t, ossec_etc_t)
#sysnet_read_config(ossec_maild_t)

# etc share dir
search_dirs_pattern(ossec_analysisd_t, ossec_etc_share_t, ossec_etc_share_t)
manage_files_pattern(ossec_analysisd_t, ossec_etc_share_t, ossec_etc_share_t)

# logs
#search_dirs_pattern(ossec_analysisd_t, ossec_log_t, ossec_log_t)
add_entry_dirs_pattern(ossec_analysisd_t, ossec_log_t, ossec_log_t)
manage_files_pattern(ossec_analysisd_t, ossec_log_t, ossec_log_t)
#read_files_pattern(ossec_analysisd_t, ossec_log_t, ossec_log_t)
#delete_files_pattern(ossec_analysisd_t, ossec_log_t, ossec_log_t)
#allow ossec_analysisd_t ossec_log_t:file { create_file_perms append_file_perms };
logging_log_filetrans(ossec_analysisd_t, ossec_log_t, file)

# rules dir
search_dirs_pattern(ossec_analysisd_t, ossec_rule_t, ossec_rule_t)
read_files_pattern(ossec_analysisd_t, ossec_rule_t, ossec_rule_t)

# dgram socket
allow ossec_analysisd_t self:unix_dgram_socket { create bind getopt connect read write }; 
allow ossec_analysisd_t ossec_execd_t:unix_dgram_socket { sendto };
allow ossec_analysisd_t ossec_remoted_t:unix_dgram_socket { sendto };


#============= ossec_logcollector_t ==============

# init
##auth_read_passwd(ossec_execd_t)
allow ossec_logcollector_t self:capability { dac_override dac_read_search };

# etc dir
search_dirs_pattern(ossec_logcollector_t, ossec_etc_t, ossec_etc_t)
read_lnk_files_pattern(ossec_logcollector_t, ossec_etc_t, ossec_etc_t)
read_files_pattern(ossec_logcollector_t, ossec_etc_t, ossec_etc_t)

# var dir
search_dirs_pattern(ossec_logcollector_t, ossec_var_t, ossec_var_t)

# var run dir
manage_dirs_pattern(ossec_logcollector_t, ossec_var_run_t, ossec_var_run_t)
manage_files_pattern(ossec_logcollector_t, ossec_var_run_t, ossec_var_run_t)

# queue dir
search_dirs_pattern(ossec_logcollector_t, ossec_queue_t, ossec_queue_t)
#rw_dirs_pattern(ossec_analysisd_t, ossec_queue_t, ossec_queue_t)
#rw_files_pattern(ossec_analysisd_t, ossec_queue_t, ossec_queue_t)
manage_sock_files_pattern(ossec_logcollector_t, ossec_queue_t, ossec_queue_t)

# logs
search_dirs_pattern(ossec_logcollector_t, ossec_log_t, ossec_log_t)
#add_entry_dirs_pattern(ossec_analysisd_t, ossec_log_t, ossec_log_t)
#manage_files_pattern(ossec_analysisd_t, ossec_log_t, ossec_log_t)
read_files_pattern(ossec_logcollector_t, ossec_log_t, ossec_log_t)
##delete_files_pattern(ossec_analysisd_t, ossec_log_t, ossec_log_t)
##allow ossec_analysisd_t ossec_log_t:file { create_file_perms append_file_perms };
logging_log_filetrans(ossec_logcollector_t, ossec_log_t, file)

search_dirs_pattern(ossec_logcollector_t, httpd_log_t, httpd_log_t)
read_files_pattern(ossec_logcollector_t, httpd_log_t, httpd_log_t)
read_files_pattern(ossec_logcollector_t, var_log_t, var_log_t)

# dgram socket
allow ossec_logcollector_t self:unix_dgram_socket { create bind getopt connect write }; 
allow ossec_logcollector_t ossec_analysisd_t:unix_dgram_socket { sendto };


#============= ossec_remoted_t ==============

# init
auth_read_passwd(ossec_remoted_t)
allow ossec_remoted_t self:capability { dac_override dac_read_search setuid setgid sys_chroot };

# etc dir
search_dirs_pattern(ossec_remoted_t, ossec_etc_t, ossec_etc_t)
read_lnk_files_pattern(ossec_remoted_t, ossec_etc_t, ossec_etc_t)
read_files_pattern(ossec_remoted_t, ossec_etc_t, ossec_etc_t)

# etc share dir
search_dirs_pattern(ossec_remoted_t, ossec_etc_share_t, ossec_etc_share_t)
read_files_pattern(ossec_remoted_t, ossec_etc_share_t, ossec_etc_share_t)
manage_files_pattern(ossec_remoted_t, ossec_etc_share_t, ossec_etc_share_t)

# var dir
search_dirs_pattern(ossec_remoted_t, ossec_var_t, ossec_var_t)

# var run dir
manage_dirs_pattern(ossec_remoted_t, ossec_var_run_t, ossec_var_run_t)
manage_files_pattern(ossec_remoted_t, ossec_var_run_t, ossec_var_run_t)

# queue dir
search_dirs_pattern(ossec_remoted_t, ossec_queue_t, ossec_queue_t)
##rw_dirs_pattern(ossec_analysisd_t, ossec_queue_t, ossec_queue_t)
rw_files_pattern(ossec_remoted_t, ossec_queue_t, ossec_queue_t)
manage_sock_files_pattern(ossec_remoted_t, ossec_queue_t, ossec_queue_t)

# logs
search_dirs_pattern(ossec_remoted_t, ossec_log_t, ossec_log_t)
#add_entry_dirs_pattern(ossec_analysisd_t, ossec_log_t, ossec_log_t)
#manage_files_pattern(ossec_analysisd_t, ossec_log_t, ossec_log_t)
read_files_pattern(ossec_remoted_t, ossec_log_t, ossec_log_t)
##delete_files_pattern(ossec_analysisd_t, ossec_log_t, ossec_log_t)
##allow ossec_analysisd_t ossec_log_t:file { create_file_perms append_file_perms };
logging_log_filetrans(ossec_remoted_t, ossec_log_t, file)

# Sockets
allow ossec_remoted_t self:udp_socket { create bind read write };
allow ossec_remoted_t unreserved_port_t:udp_socket { name_bind };
allow ossec_remoted_t node_t:udp_socket { node_bind };

allow ossec_remoted_t self:tcp_socket { create bind };
#allow ossec_remoted_t unreserved_port_t:tcp_socket { name_bind };
#allow ossec_remoted_t node_t:tcp_socket { node_bind };

# dgram socket
allow ossec_remoted_t self:unix_dgram_socket { create bind getopt connect read write };
allow ossec_remoted_t ossec_analysisd_t:unix_dgram_socket { sendto };


#============= ossec_syscheckd_t ==============

# init
#auth_read_passwd(ossec_syschecld_t)
allow ossec_syscheckd_t self:capability { dac_override dac_read_search setuid setgid sys_chroot sys_nice };
allow ossec_syscheckd_t self:process { setsched };

# etc dir
search_dirs_pattern(ossec_syscheckd_t, ossec_etc_t, ossec_etc_t)
read_lnk_files_pattern(ossec_syscheckd_t, ossec_etc_t, ossec_etc_t)
read_files_pattern(ossec_syscheckd_t, ossec_etc_t, ossec_etc_t)

# var dir
search_dirs_pattern(ossec_syscheckd_t, ossec_var_t, ossec_var_t)

# var run dir
manage_dirs_pattern(ossec_syscheckd_t, ossec_var_run_t, ossec_var_run_t)
manage_files_pattern(ossec_syscheckd_t, ossec_var_run_t, ossec_var_run_t)

# queue dir
search_dirs_pattern(ossec_syscheckd_t, ossec_queue_t, ossec_queue_t)
##rw_dirs_pattern(ossec_analysisd_t, ossec_queue_t, ossec_queue_t)
#rw_files_pattern(ossec_remoted_t, ossec_queue_t, ossec_queue_t)
manage_sock_files_pattern(ossec_syscheckd_t, ossec_queue_t, ossec_queue_t)

# logs
search_dirs_pattern(ossec_syscheckd_t, ossec_log_t, ossec_log_t)
#add_entry_dirs_pattern(ossec_analysisd_t, ossec_log_t, ossec_log_t)
#manage_files_pattern(ossec_analysisd_t, ossec_log_t, ossec_log_t)
read_files_pattern(ossec_syscheckd_t, ossec_log_t, ossec_log_t)
##delete_files_pattern(ossec_analysisd_t, ossec_log_t, ossec_log_t)
##allow ossec_analysisd_t ossec_log_t:file { create_file_perms append_file_perms };
logging_log_filetrans(ossec_syscheckd_t, ossec_log_t, file)

# dgram socket
allow ossec_syscheckd_t self:unix_dgram_socket { create bind getopt connect write };
allow ossec_syscheckd_t ossec_analysisd_t:unix_dgram_socket { sendto };

# Sockets
allow ossec_syscheckd_t self:udp_socket { create connect read write bind };
allow ossec_syscheckd_t self:tcp_socket { create connect read write };
#allow ossec_d_t smtp_port_t:tcp_socket { name_connect };

# all the things
files_read_all_files(ossec_syscheckd_t)
files_read_all_symlinks(ossec_syscheckd_t)
kernel_getattr_proc_files(ossec_syscheckd_t)


#============= ossec-monitord_t ==============

# init
auth_read_passwd(ossec_monitord_t)
allow ossec_monitord_t self:capability { dac_override dac_read_search setuid setgid sys_chroot };

# etc dir
search_dirs_pattern(ossec_monitord_t, ossec_etc_t, ossec_etc_t)
read_lnk_files_pattern(ossec_monitord_t, ossec_etc_t, ossec_etc_t)
read_files_pattern(ossec_monitord_t, ossec_etc_t, ossec_etc_t)

# var dir
search_dirs_pattern(ossec_monitord_t, ossec_var_t, ossec_var_t)

# var run dir
manage_dirs_pattern(ossec_monitord_t, ossec_var_run_t, ossec_var_run_t)
manage_files_pattern(ossec_monitord_t, ossec_var_run_t, ossec_var_run_t)

# queue dir
search_dirs_pattern(ossec_monitord_t, ossec_queue_t, ossec_queue_t)
##rw_dirs_pattern(ossec_analysisd_t, ossec_queue_t, ossec_queue_t)
#rw_files_pattern(ossec_monitord_t, ossec_queue_t, ossec_queue_t)
read_files_pattern(ossec_monitord_t, ossec_queue_t, ossec_queue_t)
manage_sock_files_pattern(ossec_monitord_t, ossec_queue_t, ossec_queue_t)

# logs
rw_dirs_pattern(ossec_monitord_t, ossec_log_t, ossec_log_t)
#add_entry_dirs_pattern(ossec_analysisd_t, ossec_log_t, ossec_log_t)
#manage_files_pattern(ossec_analysisd_t, ossec_log_t, ossec_log_t)
rw_files_pattern(ossec_monitord_t, ossec_log_t, ossec_log_t)
##delete_files_pattern(ossec_analysisd_t, ossec_log_t, ossec_log_t)
##allow ossec_analysisd_t ossec_log_t:file { create_file_perms append_file_perms };
logging_log_filetrans(ossec_monitord_t, ossec_log_t, file)

# dgram socket
allow ossec_monitord_t self:unix_dgram_socket { create bind getopt connect write };
allow ossec_monitord_t ossec_analysisd_t:unix_dgram_socket { sendto };


#============= httpd_t ==============

allow httpd_t ossec_log_t:dir { read };
allow httpd_t ossec_log_t:file { open read getattr };

allow httpd_t ossec_queue_t:dir { read };
allow httpd_t ossec_queue_t:file { open read getattr };

allow httpd_t ossec_stats_t:dir { read };
allow httpd_t ossec_stats_t:file { open read getattr };