Added all ossec components, just fine tuning remaining
This commit is contained in:
parent
16d399e40f
commit
5eb312d450
2 changed files with 196 additions and 4 deletions
1
ossec.fc
1
ossec.fc
|
|
@ -21,6 +21,7 @@
|
|||
/var/ossec/etc/shared(/.*)? gen_context(system_u:object_r:ossec_etc_share_t,s0)
|
||||
/var/ossec/rules(/.*)? gen_context(system_u:object_r:ossec_rule_t,s0)
|
||||
|
||||
/var/ossec/active-response/bin(/.*)? -- gen_context(system_u:object_r:ossec_script_exec_t,s0)
|
||||
/var/ossec/active-response(/.*)? gen_context(system_u:object_r:ossec_script_t,s0)
|
||||
|
||||
/etc/init.d/ossec-hids -- gen_context(system_u:object_r:ossec_initrc_exec_t,s0)
|
||||
|
|
|
|||
199
ossec.te
199
ossec.te
|
|
@ -1,5 +1,5 @@
|
|||
|
||||
policy_module(ossec,1.0.70)
|
||||
policy_module(ossec,1.0.139)
|
||||
|
||||
########################################
|
||||
#
|
||||
|
|
@ -86,6 +86,13 @@ files_type(ossec_queue_t)
|
|||
type ossec_script_t;
|
||||
files_type(ossec_script_t)
|
||||
|
||||
type ossec_script_exec_t;
|
||||
files_type(ossec_script_exec_t)
|
||||
domain_type(ossec_script_exec_t)
|
||||
domain_entry_file(ossec_script_exec_t, ossec_execd_t)
|
||||
#domtrans_pattern(unconfined_t, ossec_script_exec_t, uossec_execd_t)
|
||||
unconfined_domain(ossec_script_exec_t)
|
||||
|
||||
require {
|
||||
type ossec_t;
|
||||
type ossec_bin_t;
|
||||
|
|
@ -119,9 +126,15 @@ require {
|
|||
type ossec_stats_t;
|
||||
type ossec_queue_t;
|
||||
type ossec_script_t;
|
||||
type ossec_script_exec_t;
|
||||
type httpd_t;
|
||||
type httpd_log_t;
|
||||
type unreserved_port_t;
|
||||
type smtp_port_t;
|
||||
type node_t;
|
||||
class file { rename read lock create write getattr unlink open append };
|
||||
class dir { write getattr read remove_name create add_name };
|
||||
class process { setsched };
|
||||
class capability { dac_override dac_read_search setuid setgid fsetid sys_chroot sys_nice };
|
||||
class tcp_socket { create name_bind name_connect };
|
||||
class udp_socket { create bind name_bind node_bind };
|
||||
|
|
@ -162,7 +175,9 @@ allow ossec_maild_t ossec_log_t:file { create_file_perms append_file_perms };
|
|||
logging_log_filetrans(ossec_maild_t, ossec_log_t, file)
|
||||
|
||||
# Sockets
|
||||
allow ossec_t self:udp_socket { create };
|
||||
#allow ossec_t self:udp_socket { create };
|
||||
allow ossec_maild_t self:tcp_socket { create connect read write };
|
||||
allow ossec_maild_t smtp_port_t:tcp_socket { name_connect };
|
||||
|
||||
|
||||
#============= ossec_execd_t ==============
|
||||
|
|
@ -204,6 +219,10 @@ allow ossec_execd_t self:unix_dgram_socket { create bind getopt }; # connect sen
|
|||
# Read urandom
|
||||
dev_read_urand(ossec_execd_t)
|
||||
|
||||
# Run autoresponce unconstrained
|
||||
#unconfined_domtrans(ossec_script_t)
|
||||
#unconfined_run(ossec_execd_t, ossec_script_t)
|
||||
|
||||
|
||||
#============= ossec_analysisd_t ==============
|
||||
|
||||
|
|
@ -229,7 +248,8 @@ manage_sock_files_pattern(ossec_analysisd_t, ossec_queue_t, ossec_queue_t)
|
|||
|
||||
# stats dir
|
||||
rw_dirs_pattern(ossec_analysisd_t, ossec_stats_t, ossec_stats_t)
|
||||
read_files_pattern(ossec_analysisd_t, ossec_stats_t, ossec_stats_t)
|
||||
rw_files_pattern(ossec_analysisd_t, ossec_stats_t, ossec_stats_t)
|
||||
append_files_pattern(ossec_analysisd_t, ossec_stats_t, ossec_stats_t)
|
||||
|
||||
# etc dir
|
||||
search_dirs_pattern(ossec_analysisd_t, ossec_etc_t, ossec_etc_t)
|
||||
|
|
@ -255,8 +275,9 @@ search_dirs_pattern(ossec_analysisd_t, ossec_rule_t, ossec_rule_t)
|
|||
read_files_pattern(ossec_analysisd_t, ossec_rule_t, ossec_rule_t)
|
||||
|
||||
# dgram socket
|
||||
allow ossec_analysisd_t self:unix_dgram_socket { create bind getopt connect };
|
||||
allow ossec_analysisd_t self:unix_dgram_socket { create bind getopt connect read write };
|
||||
allow ossec_analysisd_t ossec_execd_t:unix_dgram_socket { sendto };
|
||||
allow ossec_analysisd_t ossec_remoted_t:unix_dgram_socket { sendto };
|
||||
|
||||
|
||||
#============= ossec_logcollector_t ==============
|
||||
|
|
@ -270,6 +291,176 @@ search_dirs_pattern(ossec_logcollector_t, ossec_etc_t, ossec_etc_t)
|
|||
read_lnk_files_pattern(ossec_logcollector_t, ossec_etc_t, ossec_etc_t)
|
||||
read_files_pattern(ossec_logcollector_t, ossec_etc_t, ossec_etc_t)
|
||||
|
||||
# var dir
|
||||
search_dirs_pattern(ossec_logcollector_t, ossec_var_t, ossec_var_t)
|
||||
|
||||
# var run dir
|
||||
manage_dirs_pattern(ossec_logcollector_t, ossec_var_run_t, ossec_var_run_t)
|
||||
manage_files_pattern(ossec_logcollector_t, ossec_var_run_t, ossec_var_run_t)
|
||||
|
||||
# queue dir
|
||||
search_dirs_pattern(ossec_logcollector_t, ossec_queue_t, ossec_queue_t)
|
||||
#rw_dirs_pattern(ossec_analysisd_t, ossec_queue_t, ossec_queue_t)
|
||||
#rw_files_pattern(ossec_analysisd_t, ossec_queue_t, ossec_queue_t)
|
||||
manage_sock_files_pattern(ossec_logcollector_t, ossec_queue_t, ossec_queue_t)
|
||||
|
||||
# logs
|
||||
search_dirs_pattern(ossec_logcollector_t, ossec_log_t, ossec_log_t)
|
||||
#add_entry_dirs_pattern(ossec_analysisd_t, ossec_log_t, ossec_log_t)
|
||||
#manage_files_pattern(ossec_analysisd_t, ossec_log_t, ossec_log_t)
|
||||
read_files_pattern(ossec_logcollector_t, ossec_log_t, ossec_log_t)
|
||||
##delete_files_pattern(ossec_analysisd_t, ossec_log_t, ossec_log_t)
|
||||
##allow ossec_analysisd_t ossec_log_t:file { create_file_perms append_file_perms };
|
||||
logging_log_filetrans(ossec_logcollector_t, ossec_log_t, file)
|
||||
|
||||
search_dirs_pattern(ossec_logcollector_t, httpd_log_t, httpd_log_t)
|
||||
read_files_pattern(ossec_logcollector_t, httpd_log_t, httpd_log_t)
|
||||
read_files_pattern(ossec_logcollector_t, var_log_t, var_log_t)
|
||||
|
||||
# dgram socket
|
||||
allow ossec_logcollector_t self:unix_dgram_socket { create bind getopt connect write };
|
||||
allow ossec_logcollector_t ossec_analysisd_t:unix_dgram_socket { sendto };
|
||||
|
||||
|
||||
#============= ossec_remoted_t ==============
|
||||
|
||||
# init
|
||||
auth_read_passwd(ossec_remoted_t)
|
||||
allow ossec_remoted_t self:capability { dac_override dac_read_search setuid setgid sys_chroot };
|
||||
|
||||
# etc dir
|
||||
search_dirs_pattern(ossec_remoted_t, ossec_etc_t, ossec_etc_t)
|
||||
read_lnk_files_pattern(ossec_remoted_t, ossec_etc_t, ossec_etc_t)
|
||||
read_files_pattern(ossec_remoted_t, ossec_etc_t, ossec_etc_t)
|
||||
|
||||
# etc share dir
|
||||
search_dirs_pattern(ossec_remoted_t, ossec_etc_share_t, ossec_etc_share_t)
|
||||
read_files_pattern(ossec_remoted_t, ossec_etc_share_t, ossec_etc_share_t)
|
||||
manage_files_pattern(ossec_remoted_t, ossec_etc_share_t, ossec_etc_share_t)
|
||||
|
||||
# var dir
|
||||
search_dirs_pattern(ossec_remoted_t, ossec_var_t, ossec_var_t)
|
||||
|
||||
# var run dir
|
||||
manage_dirs_pattern(ossec_remoted_t, ossec_var_run_t, ossec_var_run_t)
|
||||
manage_files_pattern(ossec_remoted_t, ossec_var_run_t, ossec_var_run_t)
|
||||
|
||||
# queue dir
|
||||
search_dirs_pattern(ossec_remoted_t, ossec_queue_t, ossec_queue_t)
|
||||
##rw_dirs_pattern(ossec_analysisd_t, ossec_queue_t, ossec_queue_t)
|
||||
rw_files_pattern(ossec_remoted_t, ossec_queue_t, ossec_queue_t)
|
||||
manage_sock_files_pattern(ossec_remoted_t, ossec_queue_t, ossec_queue_t)
|
||||
|
||||
# logs
|
||||
search_dirs_pattern(ossec_remoted_t, ossec_log_t, ossec_log_t)
|
||||
#add_entry_dirs_pattern(ossec_analysisd_t, ossec_log_t, ossec_log_t)
|
||||
#manage_files_pattern(ossec_analysisd_t, ossec_log_t, ossec_log_t)
|
||||
read_files_pattern(ossec_remoted_t, ossec_log_t, ossec_log_t)
|
||||
##delete_files_pattern(ossec_analysisd_t, ossec_log_t, ossec_log_t)
|
||||
##allow ossec_analysisd_t ossec_log_t:file { create_file_perms append_file_perms };
|
||||
logging_log_filetrans(ossec_remoted_t, ossec_log_t, file)
|
||||
|
||||
# Sockets
|
||||
allow ossec_remoted_t self:udp_socket { create bind read write };
|
||||
allow ossec_remoted_t unreserved_port_t:udp_socket { name_bind };
|
||||
allow ossec_remoted_t node_t:udp_socket { node_bind };
|
||||
|
||||
allow ossec_remoted_t self:tcp_socket { create bind };
|
||||
#allow ossec_remoted_t unreserved_port_t:tcp_socket { name_bind };
|
||||
#allow ossec_remoted_t node_t:tcp_socket { node_bind };
|
||||
|
||||
# dgram socket
|
||||
allow ossec_remoted_t self:unix_dgram_socket { create bind getopt connect read write };
|
||||
allow ossec_remoted_t ossec_analysisd_t:unix_dgram_socket { sendto };
|
||||
|
||||
|
||||
#============= ossec_syscheckd_t ==============
|
||||
|
||||
# init
|
||||
#auth_read_passwd(ossec_syschecld_t)
|
||||
allow ossec_syscheckd_t self:capability { dac_override dac_read_search setuid setgid sys_chroot sys_nice };
|
||||
allow ossec_syscheckd_t self:process { setsched };
|
||||
|
||||
# etc dir
|
||||
search_dirs_pattern(ossec_syscheckd_t, ossec_etc_t, ossec_etc_t)
|
||||
read_lnk_files_pattern(ossec_syscheckd_t, ossec_etc_t, ossec_etc_t)
|
||||
read_files_pattern(ossec_syscheckd_t, ossec_etc_t, ossec_etc_t)
|
||||
|
||||
# var dir
|
||||
search_dirs_pattern(ossec_syscheckd_t, ossec_var_t, ossec_var_t)
|
||||
|
||||
# var run dir
|
||||
manage_dirs_pattern(ossec_syscheckd_t, ossec_var_run_t, ossec_var_run_t)
|
||||
manage_files_pattern(ossec_syscheckd_t, ossec_var_run_t, ossec_var_run_t)
|
||||
|
||||
# queue dir
|
||||
search_dirs_pattern(ossec_syscheckd_t, ossec_queue_t, ossec_queue_t)
|
||||
##rw_dirs_pattern(ossec_analysisd_t, ossec_queue_t, ossec_queue_t)
|
||||
#rw_files_pattern(ossec_remoted_t, ossec_queue_t, ossec_queue_t)
|
||||
manage_sock_files_pattern(ossec_syscheckd_t, ossec_queue_t, ossec_queue_t)
|
||||
|
||||
# logs
|
||||
search_dirs_pattern(ossec_syscheckd_t, ossec_log_t, ossec_log_t)
|
||||
#add_entry_dirs_pattern(ossec_analysisd_t, ossec_log_t, ossec_log_t)
|
||||
#manage_files_pattern(ossec_analysisd_t, ossec_log_t, ossec_log_t)
|
||||
read_files_pattern(ossec_syscheckd_t, ossec_log_t, ossec_log_t)
|
||||
##delete_files_pattern(ossec_analysisd_t, ossec_log_t, ossec_log_t)
|
||||
##allow ossec_analysisd_t ossec_log_t:file { create_file_perms append_file_perms };
|
||||
logging_log_filetrans(ossec_syscheckd_t, ossec_log_t, file)
|
||||
|
||||
# dgram socket
|
||||
allow ossec_syscheckd_t self:unix_dgram_socket { create bind getopt connect write };
|
||||
allow ossec_syscheckd_t ossec_analysisd_t:unix_dgram_socket { sendto };
|
||||
|
||||
# Sockets
|
||||
#allow ossec_t self:udp_socket { create };
|
||||
allow ossec_syscheckd_t self:tcp_socket { create connect read write };
|
||||
#allow ossec_d_t smtp_port_t:tcp_socket { name_connect };
|
||||
|
||||
# all the things
|
||||
files_read_all_files(ossec_syscheckd_t)
|
||||
files_read_all_symlinks(ossec_syscheckd_t)
|
||||
kernel_getattr_proc_files(ossec_syscheckd_t)
|
||||
|
||||
|
||||
#============= ossec-monitord_t ==============
|
||||
|
||||
# init
|
||||
auth_read_passwd(ossec_monitord_t)
|
||||
allow ossec_monitord_t self:capability { dac_override dac_read_search setuid setgid sys_chroot };
|
||||
|
||||
# etc dir
|
||||
search_dirs_pattern(ossec_monitord_t, ossec_etc_t, ossec_etc_t)
|
||||
read_lnk_files_pattern(ossec_monitord_t, ossec_etc_t, ossec_etc_t)
|
||||
read_files_pattern(ossec_monitord_t, ossec_etc_t, ossec_etc_t)
|
||||
|
||||
# var dir
|
||||
search_dirs_pattern(ossec_monitord_t, ossec_var_t, ossec_var_t)
|
||||
|
||||
# var run dir
|
||||
manage_dirs_pattern(ossec_monitord_t, ossec_var_run_t, ossec_var_run_t)
|
||||
manage_files_pattern(ossec_monitord_t, ossec_var_run_t, ossec_var_run_t)
|
||||
|
||||
# queue dir
|
||||
search_dirs_pattern(ossec_monitord_t, ossec_queue_t, ossec_queue_t)
|
||||
##rw_dirs_pattern(ossec_analysisd_t, ossec_queue_t, ossec_queue_t)
|
||||
#rw_files_pattern(ossec_monitord_t, ossec_queue_t, ossec_queue_t)
|
||||
read_files_pattern(ossec_monitord_t, ossec_queue_t, ossec_queue_t)
|
||||
manage_sock_files_pattern(ossec_monitord_t, ossec_queue_t, ossec_queue_t)
|
||||
|
||||
# logs
|
||||
rw_dirs_pattern(ossec_monitord_t, ossec_log_t, ossec_log_t)
|
||||
#add_entry_dirs_pattern(ossec_analysisd_t, ossec_log_t, ossec_log_t)
|
||||
#manage_files_pattern(ossec_analysisd_t, ossec_log_t, ossec_log_t)
|
||||
rw_files_pattern(ossec_monitord_t, ossec_log_t, ossec_log_t)
|
||||
##delete_files_pattern(ossec_analysisd_t, ossec_log_t, ossec_log_t)
|
||||
##allow ossec_analysisd_t ossec_log_t:file { create_file_perms append_file_perms };
|
||||
logging_log_filetrans(ossec_monitord_t, ossec_log_t, file)
|
||||
|
||||
# dgram socket
|
||||
allow ossec_monitord_t self:unix_dgram_socket { create bind getopt connect write };
|
||||
allow ossec_monitord_t ossec_analysisd_t:unix_dgram_socket { sendto };
|
||||
|
||||
|
||||
#============= httpd_t ==============
|
||||
allow httpd_t ossec_log_t:dir { read };
|
||||
|
|
|
|||
Loading…
Reference in a new issue