From 39e18d655fdc80048daebe9eb1a5d45ae096cbef Mon Sep 17 00:00:00 2001 From: Eric Renfro Date: Sun, 31 Jul 2016 11:38:56 -0400 Subject: [PATCH] Finished detailing out the policy for syscheckd for rootcheck and syscheck successfully. --- ossec.te | 47 ++++++++++++++++++++++++++++++----------------- 1 file changed, 30 insertions(+), 17 deletions(-) diff --git a/ossec.te b/ossec.te index 11b8c3b..1f333c3 100644 --- a/ossec.te +++ b/ossec.te @@ -1,5 +1,5 @@ -policy_module(ossec,1.0.258) +policy_module(ossec,1.0.276) ######################################## # @@ -146,6 +146,7 @@ unconfined_domain(ossec_ar_t) require { type httpd_t; + type hi_reserved_port_t; class file { rename read lock create write getattr unlink open append entrypoint }; #class dir { write getattr read remove_name create add_name }; @@ -241,8 +242,12 @@ allow ossec_analysisd_t ossec_var_run_t:file manage_file_perms; ossec_pid_filetrans(ossec_analysisd_t, ossec_var_run_t, file) # queue dir +#allow ossec_analysisd_t ossec_analysisd_file_t:dir { write add_name }; +#allow ossec_analysisd_t ossec_analysisd_file_t:dir { manage_dir_perms }; ossec_queue_filetrans(ossec_analysisd_t, ossec_analysisd_file_t, file) -rw_files_pattern(ossec_analysisd_t, ossec_analysisd_file_t, ossec_analysisd_file_t) +#rw_files_pattern(ossec_analysisd_t, ossec_analysisd_file_t, ossec_analysisd_file_t) +manage_files_pattern(ossec_analysisd_t, ossec_analysisd_file_t, ossec_analysisd_file_t) + ossec_queue_filetrans(ossec_analysisd_t, ossec_analysisd_sock_t, sock_file) manage_sock_files_pattern(ossec_analysisd_t, ossec_queue_t, ossec_analysisd_sock_t) @@ -251,8 +256,9 @@ dgram_send_pattern(ossec_analysisd_t, ossec_queue_t, ossec_execd_sock_t, ossec_e dgram_send_pattern(ossec_analysisd_t, ossec_queue_t, ossec_remoted_sock_t, ossec_remoted_t) # stats dir -append_files_pattern(ossec_analysisd_t, ossec_stats_t, ossec_stats_t) -allow ossec_analysisd_t ossec_stats_t:file read_file_perms; +manage_files_pattern(ossec_analysisd_t, ossec_stats_t, ossec_stats_t) +#append_files_pattern(ossec_analysisd_t, ossec_stats_t, ossec_stats_t) +#allow ossec_analysisd_t ossec_stats_t:file read_file_perms; # logs allow ossec_analysisd_t ossec_log_t:file { create_file_perms append_file_perms read link unlink }; @@ -349,14 +355,9 @@ dgram_send_pattern(ossec_syscheckd_t, ossec_queue_t, ossec_analysisd_sock_t, oss allow ossec_syscheckd_t ossec_queue_t:dir { create_dir_perms rw_dir_perms }; allow ossec_syscheckd_t ossec_queue_t:file { create_file_perms rename_file_perms write_file_perms }; ossec_queue_filetrans(ossec_syscheckd_t, ossec_queue_t, file) -#rw_files_pattern(ossec_syscheckd_t, ossec_queue_t, ossec_queue_t) -#rename_files_pattern(ossec_syscheckd_t, ossec_queue_t, ossec_queue_t) -#create_files_pattern(ossec_syscheckd_t, ossec_queue_t, ossec_queue_t) ossec_tmp_filetrans(ossec_syscheckd_t, ossec_tmp_t, lnk_file) -#manage_files_pattern(ossec_syscheckd_t, ossec_tmp_t, ossec_tmp_t) manage_lnk_files_pattern(ossec_syscheckd_t, ossec_tmp_t, ossec_tmp_t) -#allow ossec_syscheckd_t user_tmp_t:sock_file getattr; userdom_search_user_tmp_dirs(ossec_syscheckd_t) # logs @@ -371,21 +372,33 @@ allow ossec_syscheckd_t self:udp_socket create_socket_perms; allow ossec_syscheckd_t self:tcp_socket create_socket_perms; #allow ossec_syscheckd_t self:udp_socket { create connect read write bind }; #allow ossec_syscheckd_t self:tcp_socket { create connect read write }; +allow ossec_syscheckd_t hi_reserved_port_t:tcp_socket name_bind; +allow ossec_syscheckd_t hi_reserved_port_t:udp_socket name_bind; +corenet_tcp_bind_generic_node(ossec_syscheckd_t) +corenet_udp_bind_generic_node(ossec_syscheckd_t) +corenet_tcp_bind_generic_port(ossec_syscheckd_t) +corenet_udp_bind_generic_port(ossec_syscheckd_t) +corenet_tcp_bind_reserved_port(ossec_syscheckd_t) +corenet_udp_bind_reserved_port(ossec_syscheckd_t) +files_dontaudit_getattr_all_sockets(ossec_syscheckd_t) # exec patterns allow ossec_syscheckd_t shell_exec_t:file { exec_file_perms }; exec_files_pattern(ossec_syscheckd_t, bin_t, bin_t); -# all the things -#allow ossec_syscheckd_t shell_exec_t:file { exec_file_perms }; -#allow ossec_syscheckd_t bin_t:file { exec_file_perms }; -#allow ossec_syscheckd_t bin_t:file { execute execute_no_trans }; +# all the files files_read_all_files(ossec_syscheckd_t) files_read_all_symlinks(ossec_syscheckd_t) seutil_read_bin_policy(ossec_syscheckd_t) -kernel_getattr_proc_files(ossec_syscheckd_t) -#read_sock_files_pattern(ossec_syscheckd_t, tmp_t, tmp_t) -files_dontaudit_getattr_all_sockets(ossec_syscheckd_t) +dev_getattr_all(ossec_syscheckd_t) + +# all the ports +allow ossec_syscheckd_t self:capability kill; +domain_read_all_domains_state(ossec_syscheckd_t) +domain_dontaudit_getsession_all_domains(ossec_syscheckd_t) +domain_getsession_all_domains(ossec_syscheckd_t) +domain_getpgid_all_domains(ossec_syscheckd_t) +domain_dontaudit_signull_all_domains(ossec_syscheckd_t) #============= ossec-monitord_t ============== @@ -409,7 +422,7 @@ list_dirs_pattern(ossec_monitord_t, ossec_queue_t, ossec_remoted_file_t) allow ossec_monitord_t ossec_remoted_file_t:file getattr_file_perms; # logs -allow ossec_monitord_t ossec_log_t:file { create_file_perms append_file_perms read }; +allow ossec_monitord_t ossec_log_t:file { create_file_perms append_file_perms write read }; ossec_log_filetrans(ossec_monitord_t, ossec_log_t, file) # dgram socket