Added all ossec components, just fine tuning remaining

ossec.fc

@@ -21,6 +21,7 @@
 /var/ossec/etc/shared(/.*)?               gen_context(system_u:object_r:ossec_etc_share_t,s0)
 /var/ossec/rules(/.*)?                    gen_context(system_u:object_r:ossec_rule_t,s0)
 
+/var/ossec/active-response/bin(/.*)? --   gen_context(system_u:object_r:ossec_script_exec_t,s0)
 /var/ossec/active-response(/.*)?          gen_context(system_u:object_r:ossec_script_t,s0)
 
 /etc/init.d/ossec-hids           --       gen_context(system_u:object_r:ossec_initrc_exec_t,s0)

ossec.te

@@ -1,5 +1,5 @@
 
-policy_module(ossec,1.0.70)
+policy_module(ossec,1.0.139)
 
 ########################################
 #
@@ -86,6 +86,13 @@ files_type(ossec_queue_t)
 type ossec_script_t;
 files_type(ossec_script_t)
 
+type ossec_script_exec_t;
+files_type(ossec_script_exec_t)
+domain_type(ossec_script_exec_t)
+domain_entry_file(ossec_script_exec_t, ossec_execd_t)
+#domtrans_pattern(unconfined_t, ossec_script_exec_t, uossec_execd_t)
+unconfined_domain(ossec_script_exec_t)
+
 require {
 	type ossec_t;
 	type ossec_bin_t;
@@ -119,9 +126,15 @@ require {
 	type ossec_stats_t;
 	type ossec_queue_t;
 	type ossec_script_t;
+	type ossec_script_exec_t;
 	type httpd_t;
+	type httpd_log_t;
+	type unreserved_port_t;
+	type smtp_port_t;
+	type node_t;
 	class file { rename read lock create write getattr unlink open append };
 	class dir { write getattr read remove_name create add_name };
+	class process { setsched };
 	class capability { dac_override dac_read_search setuid setgid fsetid sys_chroot sys_nice };
 	class tcp_socket { create name_bind name_connect };
 	class udp_socket { create bind name_bind node_bind };
@@ -162,7 +175,9 @@ allow ossec_maild_t ossec_log_t:file { create_file_perms append_file_perms };
 logging_log_filetrans(ossec_maild_t, ossec_log_t, file)
 
 # Sockets
-allow ossec_t self:udp_socket { create };
+#allow ossec_t self:udp_socket { create };
+allow ossec_maild_t self:tcp_socket { create connect read write };
+allow ossec_maild_t smtp_port_t:tcp_socket { name_connect };
 
 
 #============= ossec_execd_t ==============
@@ -204,6 +219,10 @@ allow ossec_execd_t self:unix_dgram_socket { create bind getopt }; # connect sen
 # Read urandom
 dev_read_urand(ossec_execd_t)
 
+# Run autoresponce unconstrained
+#unconfined_domtrans(ossec_script_t)
+#unconfined_run(ossec_execd_t, ossec_script_t)
+
 
 #============= ossec_analysisd_t ==============
 
@@ -229,7 +248,8 @@ manage_sock_files_pattern(ossec_analysisd_t, ossec_queue_t, ossec_queue_t)
 
 # stats dir
 rw_dirs_pattern(ossec_analysisd_t, ossec_stats_t, ossec_stats_t)
-read_files_pattern(ossec_analysisd_t, ossec_stats_t, ossec_stats_t)
+rw_files_pattern(ossec_analysisd_t, ossec_stats_t, ossec_stats_t)
+append_files_pattern(ossec_analysisd_t, ossec_stats_t, ossec_stats_t)
 
 # etc dir
 search_dirs_pattern(ossec_analysisd_t, ossec_etc_t, ossec_etc_t)
@@ -255,8 +275,9 @@ search_dirs_pattern(ossec_analysisd_t, ossec_rule_t, ossec_rule_t)
 read_files_pattern(ossec_analysisd_t, ossec_rule_t, ossec_rule_t)
 
 # dgram socket
-allow ossec_analysisd_t self:unix_dgram_socket { create bind getopt connect }; 
+allow ossec_analysisd_t self:unix_dgram_socket { create bind getopt connect read write }; 
 allow ossec_analysisd_t ossec_execd_t:unix_dgram_socket { sendto };
+allow ossec_analysisd_t ossec_remoted_t:unix_dgram_socket { sendto };
 
 
 #============= ossec_logcollector_t ==============
@@ -270,6 +291,176 @@ search_dirs_pattern(ossec_logcollector_t, ossec_etc_t, ossec_etc_t)
 read_lnk_files_pattern(ossec_logcollector_t, ossec_etc_t, ossec_etc_t)
 read_files_pattern(ossec_logcollector_t, ossec_etc_t, ossec_etc_t)
 
+# var dir
+search_dirs_pattern(ossec_logcollector_t, ossec_var_t, ossec_var_t)
+
+# var run dir
+manage_dirs_pattern(ossec_logcollector_t, ossec_var_run_t, ossec_var_run_t)
+manage_files_pattern(ossec_logcollector_t, ossec_var_run_t, ossec_var_run_t)
+
+# queue dir
+search_dirs_pattern(ossec_logcollector_t, ossec_queue_t, ossec_queue_t)
+#rw_dirs_pattern(ossec_analysisd_t, ossec_queue_t, ossec_queue_t)
+#rw_files_pattern(ossec_analysisd_t, ossec_queue_t, ossec_queue_t)
+manage_sock_files_pattern(ossec_logcollector_t, ossec_queue_t, ossec_queue_t)
+
+# logs
+search_dirs_pattern(ossec_logcollector_t, ossec_log_t, ossec_log_t)
+#add_entry_dirs_pattern(ossec_analysisd_t, ossec_log_t, ossec_log_t)
+#manage_files_pattern(ossec_analysisd_t, ossec_log_t, ossec_log_t)
+read_files_pattern(ossec_logcollector_t, ossec_log_t, ossec_log_t)
+##delete_files_pattern(ossec_analysisd_t, ossec_log_t, ossec_log_t)
+##allow ossec_analysisd_t ossec_log_t:file { create_file_perms append_file_perms };
+logging_log_filetrans(ossec_logcollector_t, ossec_log_t, file)
+
+search_dirs_pattern(ossec_logcollector_t, httpd_log_t, httpd_log_t)
+read_files_pattern(ossec_logcollector_t, httpd_log_t, httpd_log_t)
+read_files_pattern(ossec_logcollector_t, var_log_t, var_log_t)
+
+# dgram socket
+allow ossec_logcollector_t self:unix_dgram_socket { create bind getopt connect write }; 
+allow ossec_logcollector_t ossec_analysisd_t:unix_dgram_socket { sendto };
+
+
+#============= ossec_remoted_t ==============
+
+# init
+auth_read_passwd(ossec_remoted_t)
+allow ossec_remoted_t self:capability { dac_override dac_read_search setuid setgid sys_chroot };
+
+# etc dir
+search_dirs_pattern(ossec_remoted_t, ossec_etc_t, ossec_etc_t)
+read_lnk_files_pattern(ossec_remoted_t, ossec_etc_t, ossec_etc_t)
+read_files_pattern(ossec_remoted_t, ossec_etc_t, ossec_etc_t)
+
+# etc share dir
+search_dirs_pattern(ossec_remoted_t, ossec_etc_share_t, ossec_etc_share_t)
+read_files_pattern(ossec_remoted_t, ossec_etc_share_t, ossec_etc_share_t)
+manage_files_pattern(ossec_remoted_t, ossec_etc_share_t, ossec_etc_share_t)
+
+# var dir
+search_dirs_pattern(ossec_remoted_t, ossec_var_t, ossec_var_t)
+
+# var run dir
+manage_dirs_pattern(ossec_remoted_t, ossec_var_run_t, ossec_var_run_t)
+manage_files_pattern(ossec_remoted_t, ossec_var_run_t, ossec_var_run_t)
+
+# queue dir
+search_dirs_pattern(ossec_remoted_t, ossec_queue_t, ossec_queue_t)
+##rw_dirs_pattern(ossec_analysisd_t, ossec_queue_t, ossec_queue_t)
+rw_files_pattern(ossec_remoted_t, ossec_queue_t, ossec_queue_t)
+manage_sock_files_pattern(ossec_remoted_t, ossec_queue_t, ossec_queue_t)
+
+# logs
+search_dirs_pattern(ossec_remoted_t, ossec_log_t, ossec_log_t)
+#add_entry_dirs_pattern(ossec_analysisd_t, ossec_log_t, ossec_log_t)
+#manage_files_pattern(ossec_analysisd_t, ossec_log_t, ossec_log_t)
+read_files_pattern(ossec_remoted_t, ossec_log_t, ossec_log_t)
+##delete_files_pattern(ossec_analysisd_t, ossec_log_t, ossec_log_t)
+##allow ossec_analysisd_t ossec_log_t:file { create_file_perms append_file_perms };
+logging_log_filetrans(ossec_remoted_t, ossec_log_t, file)
+
+# Sockets
+allow ossec_remoted_t self:udp_socket { create bind read write };
+allow ossec_remoted_t unreserved_port_t:udp_socket { name_bind };
+allow ossec_remoted_t node_t:udp_socket { node_bind };
+
+allow ossec_remoted_t self:tcp_socket { create bind };
+#allow ossec_remoted_t unreserved_port_t:tcp_socket { name_bind };
+#allow ossec_remoted_t node_t:tcp_socket { node_bind };
+
+# dgram socket
+allow ossec_remoted_t self:unix_dgram_socket { create bind getopt connect read write };
+allow ossec_remoted_t ossec_analysisd_t:unix_dgram_socket { sendto };
+
+
+#============= ossec_syscheckd_t ==============
+
+# init
+#auth_read_passwd(ossec_syschecld_t)
+allow ossec_syscheckd_t self:capability { dac_override dac_read_search setuid setgid sys_chroot sys_nice };
+allow ossec_syscheckd_t self:process { setsched };
+
+# etc dir
+search_dirs_pattern(ossec_syscheckd_t, ossec_etc_t, ossec_etc_t)
+read_lnk_files_pattern(ossec_syscheckd_t, ossec_etc_t, ossec_etc_t)
+read_files_pattern(ossec_syscheckd_t, ossec_etc_t, ossec_etc_t)
+
+# var dir
+search_dirs_pattern(ossec_syscheckd_t, ossec_var_t, ossec_var_t)
+
+# var run dir
+manage_dirs_pattern(ossec_syscheckd_t, ossec_var_run_t, ossec_var_run_t)
+manage_files_pattern(ossec_syscheckd_t, ossec_var_run_t, ossec_var_run_t)
+
+# queue dir
+search_dirs_pattern(ossec_syscheckd_t, ossec_queue_t, ossec_queue_t)
+##rw_dirs_pattern(ossec_analysisd_t, ossec_queue_t, ossec_queue_t)
+#rw_files_pattern(ossec_remoted_t, ossec_queue_t, ossec_queue_t)
+manage_sock_files_pattern(ossec_syscheckd_t, ossec_queue_t, ossec_queue_t)
+
+# logs
+search_dirs_pattern(ossec_syscheckd_t, ossec_log_t, ossec_log_t)
+#add_entry_dirs_pattern(ossec_analysisd_t, ossec_log_t, ossec_log_t)
+#manage_files_pattern(ossec_analysisd_t, ossec_log_t, ossec_log_t)
+read_files_pattern(ossec_syscheckd_t, ossec_log_t, ossec_log_t)
+##delete_files_pattern(ossec_analysisd_t, ossec_log_t, ossec_log_t)
+##allow ossec_analysisd_t ossec_log_t:file { create_file_perms append_file_perms };
+logging_log_filetrans(ossec_syscheckd_t, ossec_log_t, file)
+
+# dgram socket
+allow ossec_syscheckd_t self:unix_dgram_socket { create bind getopt connect write };
+allow ossec_syscheckd_t ossec_analysisd_t:unix_dgram_socket { sendto };
+
+# Sockets
+#allow ossec_t self:udp_socket { create };
+allow ossec_syscheckd_t self:tcp_socket { create connect read write };
+#allow ossec_d_t smtp_port_t:tcp_socket { name_connect };
+
+# all the things
+files_read_all_files(ossec_syscheckd_t)
+files_read_all_symlinks(ossec_syscheckd_t)
+kernel_getattr_proc_files(ossec_syscheckd_t)
+
+
+#============= ossec-monitord_t ==============
+
+# init
+auth_read_passwd(ossec_monitord_t)
+allow ossec_monitord_t self:capability { dac_override dac_read_search setuid setgid sys_chroot };
+
+# etc dir
+search_dirs_pattern(ossec_monitord_t, ossec_etc_t, ossec_etc_t)
+read_lnk_files_pattern(ossec_monitord_t, ossec_etc_t, ossec_etc_t)
+read_files_pattern(ossec_monitord_t, ossec_etc_t, ossec_etc_t)
+
+# var dir
+search_dirs_pattern(ossec_monitord_t, ossec_var_t, ossec_var_t)
+
+# var run dir
+manage_dirs_pattern(ossec_monitord_t, ossec_var_run_t, ossec_var_run_t)
+manage_files_pattern(ossec_monitord_t, ossec_var_run_t, ossec_var_run_t)
+
+# queue dir
+search_dirs_pattern(ossec_monitord_t, ossec_queue_t, ossec_queue_t)
+##rw_dirs_pattern(ossec_analysisd_t, ossec_queue_t, ossec_queue_t)
+#rw_files_pattern(ossec_monitord_t, ossec_queue_t, ossec_queue_t)
+read_files_pattern(ossec_monitord_t, ossec_queue_t, ossec_queue_t)
+manage_sock_files_pattern(ossec_monitord_t, ossec_queue_t, ossec_queue_t)
+
+# logs
+rw_dirs_pattern(ossec_monitord_t, ossec_log_t, ossec_log_t)
+#add_entry_dirs_pattern(ossec_analysisd_t, ossec_log_t, ossec_log_t)
+#manage_files_pattern(ossec_analysisd_t, ossec_log_t, ossec_log_t)
+rw_files_pattern(ossec_monitord_t, ossec_log_t, ossec_log_t)
+##delete_files_pattern(ossec_analysisd_t, ossec_log_t, ossec_log_t)
+##allow ossec_analysisd_t ossec_log_t:file { create_file_perms append_file_perms };
+logging_log_filetrans(ossec_monitord_t, ossec_log_t, file)
+
+# dgram socket
+allow ossec_monitord_t self:unix_dgram_socket { create bind getopt connect write };
+allow ossec_monitord_t ossec_analysisd_t:unix_dgram_socket { sendto };
+
 
 #============= httpd_t ==============
 allow httpd_t ossec_log_t:dir { read };