Linux-Help/selinux-ossec
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Finished detailing out the policy for syscheckd for rootcheck and syscheck successfully.

Browse source
This commit is contained in:
Eric Renfro 2016-07-31 11:38:56 -04:00
parent c1c499a09c
commit 39e18d655f
1 changed files with 30 additions and 17 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

47
ossec.te
View file

@ -1,5 +1,5 @@
policy_module(ossec,1.0.258)
policy_module(ossec,1.0.276)
########################################
#
@ -146,6 +146,7 @@ unconfined_domain(ossec_ar_t)
require {
type httpd_t;
type hi_reserved_port_t;
class file { rename read lock create write getattr unlink open append entrypoint };
#class dir { write getattr read remove_name create add_name };
@ -241,8 +242,12 @@ allow ossec_analysisd_t ossec_var_run_t:file manage_file_perms;
ossec_pid_filetrans(ossec_analysisd_t, ossec_var_run_t, file)
# queue dir
#allow ossec_analysisd_t ossec_analysisd_file_t:dir { write add_name };
#allow ossec_analysisd_t ossec_analysisd_file_t:dir { manage_dir_perms };
ossec_queue_filetrans(ossec_analysisd_t, ossec_analysisd_file_t, file)
rw_files_pattern(ossec_analysisd_t, ossec_analysisd_file_t, ossec_analysisd_file_t)
#rw_files_pattern(ossec_analysisd_t, ossec_analysisd_file_t, ossec_analysisd_file_t)
manage_files_pattern(ossec_analysisd_t, ossec_analysisd_file_t, ossec_analysisd_file_t)
ossec_queue_filetrans(ossec_analysisd_t, ossec_analysisd_sock_t, sock_file)
manage_sock_files_pattern(ossec_analysisd_t, ossec_queue_t, ossec_analysisd_sock_t)
@ -251,8 +256,9 @@ dgram_send_pattern(ossec_analysisd_t, ossec_queue_t, ossec_execd_sock_t, ossec_e
dgram_send_pattern(ossec_analysisd_t, ossec_queue_t, ossec_remoted_sock_t, ossec_remoted_t)
# stats dir
append_files_pattern(ossec_analysisd_t, ossec_stats_t, ossec_stats_t)
allow ossec_analysisd_t ossec_stats_t:file read_file_perms;
manage_files_pattern(ossec_analysisd_t, ossec_stats_t, ossec_stats_t)
#append_files_pattern(ossec_analysisd_t, ossec_stats_t, ossec_stats_t)
#allow ossec_analysisd_t ossec_stats_t:file read_file_perms;
# logs
allow ossec_analysisd_t ossec_log_t:file { create_file_perms append_file_perms read link unlink };
@ -349,14 +355,9 @@ dgram_send_pattern(ossec_syscheckd_t, ossec_queue_t, ossec_analysisd_sock_t, oss
allow ossec_syscheckd_t ossec_queue_t:dir { create_dir_perms rw_dir_perms };
allow ossec_syscheckd_t ossec_queue_t:file { create_file_perms rename_file_perms write_file_perms };
ossec_queue_filetrans(ossec_syscheckd_t, ossec_queue_t, file)
#rw_files_pattern(ossec_syscheckd_t, ossec_queue_t, ossec_queue_t)
#rename_files_pattern(ossec_syscheckd_t, ossec_queue_t, ossec_queue_t)
#create_files_pattern(ossec_syscheckd_t, ossec_queue_t, ossec_queue_t)
ossec_tmp_filetrans(ossec_syscheckd_t, ossec_tmp_t, lnk_file)
#manage_files_pattern(ossec_syscheckd_t, ossec_tmp_t, ossec_tmp_t)
manage_lnk_files_pattern(ossec_syscheckd_t, ossec_tmp_t, ossec_tmp_t)
#allow ossec_syscheckd_t user_tmp_t:sock_file getattr;
userdom_search_user_tmp_dirs(ossec_syscheckd_t)
# logs
@ -371,21 +372,33 @@ allow ossec_syscheckd_t self:udp_socket create_socket_perms;
allow ossec_syscheckd_t self:tcp_socket create_socket_perms;
#allow ossec_syscheckd_t self:udp_socket { create connect read write bind };
#allow ossec_syscheckd_t self:tcp_socket { create connect read write };
allow ossec_syscheckd_t hi_reserved_port_t:tcp_socket name_bind;
allow ossec_syscheckd_t hi_reserved_port_t:udp_socket name_bind;
corenet_tcp_bind_generic_node(ossec_syscheckd_t)
corenet_udp_bind_generic_node(ossec_syscheckd_t)
corenet_tcp_bind_generic_port(ossec_syscheckd_t)
corenet_udp_bind_generic_port(ossec_syscheckd_t)
corenet_tcp_bind_reserved_port(ossec_syscheckd_t)
corenet_udp_bind_reserved_port(ossec_syscheckd_t)
files_dontaudit_getattr_all_sockets(ossec_syscheckd_t)
# exec patterns
allow ossec_syscheckd_t shell_exec_t:file { exec_file_perms };
exec_files_pattern(ossec_syscheckd_t, bin_t, bin_t);
# all the things
#allow ossec_syscheckd_t shell_exec_t:file { exec_file_perms };
#allow ossec_syscheckd_t bin_t:file { exec_file_perms };
#allow ossec_syscheckd_t bin_t:file { execute execute_no_trans };
# all the files
files_read_all_files(ossec_syscheckd_t)
files_read_all_symlinks(ossec_syscheckd_t)
seutil_read_bin_policy(ossec_syscheckd_t)
kernel_getattr_proc_files(ossec_syscheckd_t)
#read_sock_files_pattern(ossec_syscheckd_t, tmp_t, tmp_t)
files_dontaudit_getattr_all_sockets(ossec_syscheckd_t)
dev_getattr_all(ossec_syscheckd_t)
# all the ports
allow ossec_syscheckd_t self:capability kill;
domain_read_all_domains_state(ossec_syscheckd_t)
domain_dontaudit_getsession_all_domains(ossec_syscheckd_t)
domain_getsession_all_domains(ossec_syscheckd_t)
domain_getpgid_all_domains(ossec_syscheckd_t)
domain_dontaudit_signull_all_domains(ossec_syscheckd_t)
#============= ossec-monitord_t ==============
@ -409,7 +422,7 @@ list_dirs_pattern(ossec_monitord_t, ossec_queue_t, ossec_remoted_file_t)
allow ossec_monitord_t ossec_remoted_file_t:file getattr_file_perms;
# logs
allow ossec_monitord_t ossec_log_t:file { create_file_perms append_file_perms read };
allow ossec_monitord_t ossec_log_t:file { create_file_perms append_file_perms write read };
ossec_log_filetrans(ossec_monitord_t, ossec_log_t, file)
# dgram socket