Completely reformatted the style based on what I understand of the style guide thus far

This commit is contained in:
Eric Renfro 2016-07-31 19:23:16 -04:00
parent fb51062e5d
commit 66ef615fde

513
ossec.te
View file

@ -1,33 +1,31 @@
policy_module(ossec,1.0.277) policy_module(ossec,1.1.0)
######################################## ########################################
# #
# Declarations # Declarations
# #
# ossec bin dir ###
type ossec_bin_t; # Active-Response Domain and File Types
files_type(ossec_bin_t) type ossec_ar_t;
type ossec_ar_exec_t;
domain_type(ossec_ar_t)
domain_entry_file(ossec_ar_t, ossec_ar_exec_t)
domtrans_pattern(ossec_execd_t, ossec_ar_exec_t, ossec_ar_t)
role system_r types ossec_ar_t;
files_type(ossec_ar_exec_t);
# ossec-maild daemon type ossec_ar_bin_t;
type ossec_maild_t; files_type(ossec_ar_bin_t);
type ossec_maild_exec_t;
init_daemon_domain(ossec_maild_t, ossec_maild_exec_t)
# ossec-execd daemon unconfined_domain(ossec_ar_t)
type ossec_execd_t; ###
type ossec_execd_exec_t;
init_daemon_domain(ossec_execd_t, ossec_execd_exec_t)
type ossec_execd_file_t; # ossec-agentlessd daemon
files_type(ossec_execd_file_t) type ossec_agentlessd_t;
type ossec_agentlessd_exec_t;
type ossec_execd_journal_t; init_daemon_domain(ossec_agentlessd_t, ossec_agentlessd_exec_t)
files_type(ossec_execd_journal_t)
type ossec_execd_sock_t;
files_type(ossec_execd_sock_t)
# ossec-analysisd daemon # ossec-analysisd daemon
type ossec_analysisd_t; type ossec_analysisd_t;
@ -43,11 +41,57 @@ files_type(ossec_analysisd_file_t)
type ossec_analysisd_sock_t; type ossec_analysisd_sock_t;
files_type(ossec_analysisd_sock_t) files_type(ossec_analysisd_sock_t)
# ossec-csyslogd daemon
type ossec_csyslogd_t;
type ossec_csyslogd_exec_t;
init_daemon_domain(ossec_csyslogd_t, ossec_csyslogd_exec_t)
# ossec-dbd daemon
type ossec_dbd_t;
type ossec_dbd_exec_t;
init_daemon_domain(ossec_dbd_t, ossec_dbd_exec_t)
# ossec etc dir
type ossec_etc_t;
files_config_file(ossec_etc_t)
# ossec-execd daemon
type ossec_execd_t;
type ossec_execd_exec_t;
init_daemon_domain(ossec_execd_t, ossec_execd_exec_t)
type ossec_execd_file_t;
files_type(ossec_execd_file_t)
type ossec_execd_journal_t;
files_type(ossec_execd_journal_t)
type ossec_execd_sock_t;
files_type(ossec_execd_sock_t)
# ossec_initrc
type ossec_initrc_exec_t;
init_script_file(ossec_initrc_exec_t)
# ossec-logcollector daemon # ossec-logcollector daemon
type ossec_logcollector_t; type ossec_logcollector_t;
type ossec_logcollector_exec_t; type ossec_logcollector_exec_t;
init_daemon_domain(ossec_logcollector_t, ossec_logcollector_exec_t) init_daemon_domain(ossec_logcollector_t, ossec_logcollector_exec_t)
# ossec logs dir
type ossec_log_t;
logging_log_file(ossec_log_t)
# ossec-maild daemon
type ossec_maild_t;
type ossec_maild_exec_t;
init_daemon_domain(ossec_maild_t, ossec_maild_exec_t)
# ossec-monitord daemon
type ossec_monitord_t;
type ossec_monitord_exec_t;
init_daemon_domain(ossec_monitord_t, ossec_monitord_exec_t)
# ossec-remoted daemon # ossec-remoted daemon
type ossec_remoted_t; type ossec_remoted_t;
type ossec_remoted_exec_t; type ossec_remoted_exec_t;
@ -67,52 +111,14 @@ type ossec_syscheckd_t;
type ossec_syscheckd_exec_t; type ossec_syscheckd_exec_t;
init_daemon_domain(ossec_syscheckd_t, ossec_syscheckd_exec_t) init_daemon_domain(ossec_syscheckd_t, ossec_syscheckd_exec_t)
#domain_entry_file(ossec_syscheckd_t, shell_exec_t)
#domtrans_pattern(ossec_syscheckd_t, ossec_ar_exec_t, ossec_ar_t)
# ossec bin dir
type ossec_bin_t;
files_type(ossec_bin_t)
# ossec-monitord daemon # ossec queue dir
type ossec_monitord_t; type ossec_queue_t;
type ossec_monitord_exec_t; files_type(ossec_queue_t)
init_daemon_domain(ossec_monitord_t, ossec_monitord_exec_t)
# ossec-dbd daemon
type ossec_dbd_t;
type ossec_dbd_exec_t;
init_daemon_domain(ossec_dbd_t, ossec_dbd_exec_t)
# ossec-csyslogd daemon
type ossec_csyslogd_t;
type ossec_csyslogd_exec_t;
init_daemon_domain(ossec_csyslogd_t, ossec_csyslogd_exec_t)
# ossec-agentlessd daemon
type ossec_agentlessd_t;
type ossec_agentlessd_exec_t;
init_daemon_domain(ossec_agentlessd_t, ossec_agentlessd_exec_t)
# initrc
type ossec_initrc_exec_t;
init_script_file(ossec_initrc_exec_t)
type ossec_var_t;
files_type(ossec_var_t)
# ossec var run dir
type ossec_var_run_t;
files_pid_file(ossec_var_run_t)
# ossec tmp dir
type ossec_tmp_t;
files_tmp_file(ossec_tmp_t)
# ossec logs dir
type ossec_log_t;
logging_log_file(ossec_log_t)
# ossec etc dir
type ossec_etc_t;
files_config_file(ossec_etc_t)
# ossec rules dir # ossec rules dir
type ossec_rule_t; type ossec_rule_t;
@ -122,26 +128,16 @@ files_config_file(ossec_rule_t)
type ossec_stats_t; type ossec_stats_t;
files_type(ossec_stats_t) files_type(ossec_stats_t)
# ossec queue dir # ossec tmp dir
type ossec_queue_t; type ossec_tmp_t;
files_type(ossec_queue_t) files_tmp_file(ossec_tmp_t)
### # ossec var run dir
# Active-Response Domain and File Types type ossec_var_t;
type ossec_ar_t; files_type(ossec_var_t)
type ossec_ar_bin_t; type ossec_var_run_t;
files_type(ossec_ar_bin_t); files_pid_file(ossec_var_run_t)
type ossec_ar_exec_t;
files_type(ossec_ar_exec_t);
domain_type(ossec_ar_t)
domain_entry_file(ossec_ar_t, ossec_ar_exec_t)
domtrans_pattern(ossec_execd_t, ossec_ar_exec_t, ossec_ar_t)
role system_r types ossec_ar_t;
unconfined_domain(ossec_ar_t)
###
require { require {
@ -163,275 +159,164 @@ require {
# #
#============= ossec_maild_t ============== allow ossec_analysisd_t ossec_log_t:file { create_file_perms append_file_perms read link unlink };
auth_read_passwd(ossec_maild_t) allow ossec_analysisd_t ossec_var_run_t:file manage_file_perms;
allow ossec_analysisd_t self:capability { dac_override dac_read_search fsetid setuid setgid sys_chroot };
# init allow ossec_analysisd_t self:unix_dgram_socket create_stream_socket_perms;
allow ossec_maild_t self:capability { dac_override dac_read_search setuid setgid sys_chroot };
# etc dir
ossec_read_config(ossec_maild_t)
sysnet_read_config(ossec_maild_t)
# var run dir
allow ossec_maild_t ossec_var_run_t:file manage_file_perms;
ossec_pid_filetrans(ossec_maild_t, ossec_var_run_t, file)
# logs
allow ossec_maild_t ossec_log_t:file { create_file_perms append_file_perms read };
ossec_log_filetrans(ossec_maild_t, ossec_log_t, file)
# Sockets
allow ossec_maild_t self:tcp_socket create_socket_perms;
corenet_tcp_connect_smtp_port(ossec_maild_t)
#============= ossec_execd_t ==============
# init
auth_read_passwd(ossec_execd_t)
allow ossec_execd_t self:capability { dac_override dac_read_search setgid };
# etc dir
ossec_read_config(ossec_execd_t)
sysnet_read_config(ossec_execd_t)
allow ossec_execd_t ossec_ar_t:process { rlimitinh siginh noatsecure };
allow ossec_execd_t ossec_execd_file_t:file { create_file_perms rw_file_perms }; allow ossec_execd_t ossec_execd_file_t:file { create_file_perms rw_file_perms };
allow ossec_execd_t ossec_execd_journal_t:file manage_file_perms; allow ossec_execd_t ossec_execd_journal_t:file manage_file_perms;
filetrans_pattern(ossec_execd_t, ossec_var_t, ossec_execd_journal_t, file, "execd.sqlite-journal");
# var run dir
allow ossec_execd_t ossec_var_run_t:file manage_file_perms;
ossec_pid_filetrans(ossec_execd_t, ossec_var_run_t, file)
# queue dir
ossec_queue_filetrans(ossec_execd_t, ossec_execd_sock_t, sock_file)
manage_sock_files_pattern(ossec_execd_t, ossec_queue_t, ossec_execd_sock_t)
# logs
allow ossec_execd_t ossec_log_t:file { create_file_perms append_file_perms read }; allow ossec_execd_t ossec_log_t:file { create_file_perms append_file_perms read };
ossec_log_filetrans(ossec_execd_t, ossec_log_t, file) allow ossec_execd_t ossec_var_run_t:file manage_file_perms;
allow ossec_execd_t self:capability { dac_override dac_read_search setgid };
# active-response scripts
search_dirs_pattern(ossec_execd_t, ossec_ar_bin_t, ossec_ar_bin_t)
corecmd_exec_shell(ossec_execd_t)
# dgram socket
allow ossec_execd_t self:unix_dgram_socket create_stream_socket_perms; allow ossec_execd_t self:unix_dgram_socket create_stream_socket_perms;
# Read urandom allow ossec_logcollector_t ossec_log_t:file { create_file_perms append_file_perms read };
dev_read_urand(ossec_execd_t) allow ossec_logcollector_t ossec_var_run_t:file manage_file_perms;
allow ossec_logcollector_t self:capability { dac_override dac_read_search };
allow ossec_logcollector_t self:unix_dgram_socket create_socket_perms;
# Run autoresponce unconstrained allow ossec_maild_t ossec_log_t:file { create_file_perms append_file_perms read };
allow ossec_execd_t ossec_ar_t:process { rlimitinh siginh noatsecure }; allow ossec_maild_t ossec_var_run_t:file manage_file_perms;
allow ossec_maild_t self:capability { dac_override dac_read_search setuid setgid sys_chroot };
allow ossec_maild_t self:tcp_socket create_socket_perms;
allow ossec_monitord_t ossec_log_t:file { create_file_perms append_file_perms write read };
allow ossec_monitord_t ossec_remoted_file_t:file getattr_file_perms;
allow ossec_monitord_t ossec_var_run_t:file manage_file_perms;
allow ossec_monitord_t self:capability { dac_override dac_read_search setuid setgid sys_chroot };
allow ossec_monitord_t self:unix_dgram_socket create_socket_perms;
allow ossec_remoted_t ossec_log_t:file { create_file_perms append_file_perms read };
allow ossec_remoted_t ossec_var_run_t:file manage_file_perms;
allow ossec_remoted_t self:capability { dac_override dac_read_search setuid setgid sys_chroot };
allow ossec_remoted_t self:udp_socket create_stream_socket_perms;
allow ossec_remoted_t self:unix_dgram_socket create_stream_socket_perms;
allow ossec_syscheckd_t hi_reserved_port_t:tcp_socket name_bind;
allow ossec_syscheckd_t hi_reserved_port_t:udp_socket name_bind;
allow ossec_syscheckd_t ossec_log_t:file { create_file_perms append_file_perms read };
allow ossec_syscheckd_t ossec_queue_t:dir { create_dir_perms rw_dir_perms };
allow ossec_syscheckd_t ossec_queue_t:file { create_file_perms rename_file_perms write_file_perms };
allow ossec_syscheckd_t ossec_var_run_t:file manage_file_perms;
allow ossec_syscheckd_t self:capability { dac_override dac_read_search kill setuid setgid sys_chroot sys_nice };
allow ossec_syscheckd_t self:process { setsched };
allow ossec_syscheckd_t self:tcp_socket create_socket_perms;
allow ossec_syscheckd_t self:udp_socket create_socket_perms;
allow ossec_syscheckd_t self:unix_dgram_socket create_socket_perms;
#============= ossec_analysisd_t ==============
# init
auth_read_passwd(ossec_analysisd_t) auth_read_passwd(ossec_analysisd_t)
allow ossec_analysisd_t self:capability { dac_override dac_read_search fsetid setuid setgid sys_chroot }; auth_read_passwd(ossec_execd_t)
auth_read_passwd(ossec_maild_t)
auth_read_passwd(ossec_monitord_t)
auth_read_passwd(ossec_remoted_t)
# etc dir corecmd_exec_bin(ossec_syscheckd_t)
ossec_read_config(ossec_analysisd_t) corecmd_exec_shell(ossec_execd_t)
sysnet_read_config(ossec_analysisd_t) corecmd_exec_shell(ossec_syscheckd_t)
manage_files_pattern(ossec_analysisd_t, ossec_etc_t, ossec_analysisd_configfile_t)
# var run dir corenet_tcp_bind_generic_node(ossec_syscheckd_t)
allow ossec_analysisd_t ossec_var_run_t:file manage_file_perms; corenet_tcp_bind_generic_port(ossec_syscheckd_t)
ossec_pid_filetrans(ossec_analysisd_t, ossec_var_run_t, file) corenet_tcp_bind_reserved_port(ossec_syscheckd_t)
corenet_tcp_connect_smtp_port(ossec_maild_t)
# queue dir corenet_udp_bind_all_unreserved_ports(ossec_remoted_t)
#allow ossec_analysisd_t ossec_analysisd_file_t:dir { write add_name }; corenet_udp_bind_generic_node(ossec_remoted_t)
#allow ossec_analysisd_t ossec_analysisd_file_t:dir { manage_dir_perms }; corenet_udp_bind_generic_node(ossec_syscheckd_t)
ossec_queue_filetrans(ossec_analysisd_t, ossec_analysisd_file_t, file) corenet_udp_bind_generic_port(ossec_syscheckd_t)
#rw_files_pattern(ossec_analysisd_t, ossec_analysisd_file_t, ossec_analysisd_file_t) corenet_udp_bind_reserved_port(ossec_syscheckd_t)
manage_files_pattern(ossec_analysisd_t, ossec_analysisd_file_t, ossec_analysisd_file_t)
dev_getattr_all(ossec_syscheckd_t)
ossec_queue_filetrans(ossec_analysisd_t, ossec_analysisd_sock_t, sock_file) dev_read_urand(ossec_execd_t)
manage_sock_files_pattern(ossec_analysisd_t, ossec_queue_t, ossec_analysisd_sock_t)
dgram_send_pattern(ossec_analysisd_t, ossec_queue_t, ossec_execd_sock_t, ossec_execd_t) dgram_send_pattern(ossec_analysisd_t, ossec_queue_t, ossec_execd_sock_t, ossec_execd_t)
dgram_send_pattern(ossec_analysisd_t, ossec_queue_t, ossec_remoted_sock_t, ossec_remoted_t) dgram_send_pattern(ossec_analysisd_t, ossec_queue_t, ossec_remoted_sock_t, ossec_remoted_t)
# stats dir
manage_files_pattern(ossec_analysisd_t, ossec_stats_t, ossec_stats_t)
#append_files_pattern(ossec_analysisd_t, ossec_stats_t, ossec_stats_t)
#allow ossec_analysisd_t ossec_stats_t:file read_file_perms;
# logs
allow ossec_analysisd_t ossec_log_t:file { create_file_perms append_file_perms read link unlink };
ossec_log_filetrans(ossec_analysisd_t, ossec_log_t, file)
# rules dir
search_dirs_pattern(ossec_analysisd_t, ossec_rule_t, ossec_rule_t)
read_files_pattern(ossec_analysisd_t, ossec_rule_t, ossec_rule_t)
# dgram socket
allow ossec_analysisd_t self:unix_dgram_socket create_stream_socket_perms;
#============= ossec_logcollector_t ==============
# init
allow ossec_logcollector_t self:capability { dac_override dac_read_search };
# etc dir
ossec_read_config(ossec_logcollector_t)
sysnet_read_config(ossec_logcollector_t)
# var run dir
allow ossec_logcollector_t ossec_var_run_t:file manage_file_perms;
ossec_pid_filetrans(ossec_logcollector_t, ossec_var_run_t, file)
# queue dir
dgram_send_pattern(ossec_logcollector_t, ossec_queue_t, ossec_analysisd_sock_t, ossec_analysisd_t) dgram_send_pattern(ossec_logcollector_t, ossec_queue_t, ossec_analysisd_sock_t, ossec_analysisd_t)
dgram_send_pattern(ossec_monitord_t, ossec_queue_t, ossec_analysisd_sock_t, ossec_analysisd_t)
# logs
allow ossec_logcollector_t ossec_log_t:file { create_file_perms append_file_perms read };
ossec_log_filetrans(ossec_logcollector_t, ossec_log_t, file)
# Access all system logs:
logging_read_all_logs(ossec_logcollector_t)
# dgram socket
allow ossec_logcollector_t self:unix_dgram_socket create_socket_perms;
#============= ossec_remoted_t ==============
# init
auth_read_passwd(ossec_remoted_t)
allow ossec_remoted_t self:capability { dac_override dac_read_search setuid setgid sys_chroot };
# etc dir
ossec_read_config(ossec_remoted_t)
sysnet_read_config(ossec_remoted_t)
manage_files_pattern(ossec_remoted_t, ossec_etc_t, ossec_remoted_configfile_t)
# var run dir
allow ossec_remoted_t ossec_var_run_t:file manage_file_perms;
ossec_pid_filetrans(ossec_remoted_t, ossec_var_run_t, file)
# queue dir
dgram_send_pattern(ossec_remoted_t, ossec_queue_t, ossec_analysisd_sock_t, ossec_analysisd_t) dgram_send_pattern(ossec_remoted_t, ossec_queue_t, ossec_analysisd_sock_t, ossec_analysisd_t)
ossec_queue_filetrans(ossec_remoted_t, ossec_remoted_sock_t, sock_file)
manage_sock_files_pattern(ossec_remoted_t, ossec_queue_t, ossec_remoted_sock_t)
# queue/rids/
rw_files_pattern(ossec_remoted_t, ossec_remoted_file_t, ossec_remoted_file_t)
# logs
allow ossec_remoted_t ossec_log_t:file { create_file_perms append_file_perms read };
ossec_log_filetrans(ossec_remoted_t, ossec_log_t, file)
# Sockets
allow ossec_remoted_t self:udp_socket create_stream_socket_perms;
corenet_udp_bind_all_unreserved_ports(ossec_remoted_t)
corenet_udp_bind_generic_node(ossec_remoted_t)
# dgram socket
allow ossec_remoted_t self:unix_dgram_socket create_stream_socket_perms;
#============= ossec_syscheckd_t ==============
# init
allow ossec_syscheckd_t self:capability { dac_override dac_read_search setuid setgid sys_chroot sys_nice };
allow ossec_syscheckd_t self:process { setsched };
# etc dir
ossec_read_config(ossec_syscheckd_t)
sysnet_read_config(ossec_syscheckd_t)
# var run dir
allow ossec_syscheckd_t ossec_var_run_t:file manage_file_perms;
ossec_pid_filetrans(ossec_syscheckd_t, ossec_var_run_t, file)
# queue dir
dgram_send_pattern(ossec_syscheckd_t, ossec_queue_t, ossec_analysisd_sock_t, ossec_analysisd_t) dgram_send_pattern(ossec_syscheckd_t, ossec_queue_t, ossec_analysisd_sock_t, ossec_analysisd_t)
allow ossec_syscheckd_t ossec_queue_t:dir { create_dir_perms rw_dir_perms };
allow ossec_syscheckd_t ossec_queue_t:file { create_file_perms rename_file_perms write_file_perms };
ossec_queue_filetrans(ossec_syscheckd_t, ossec_queue_t, file)
ossec_tmp_filetrans(ossec_syscheckd_t, ossec_tmp_t, lnk_file)
manage_lnk_files_pattern(ossec_syscheckd_t, ossec_tmp_t, ossec_tmp_t)
userdom_search_user_tmp_dirs(ossec_syscheckd_t)
# logs
allow ossec_syscheckd_t ossec_log_t:file { create_file_perms append_file_perms read };
ossec_log_filetrans(ossec_syscheckd_t, ossec_log_t, file)
# dgram socket
allow ossec_syscheckd_t self:unix_dgram_socket create_socket_perms;
# Sockets
allow ossec_syscheckd_t self:udp_socket create_socket_perms;
allow ossec_syscheckd_t self:tcp_socket create_socket_perms;
#allow ossec_syscheckd_t self:udp_socket { create connect read write bind };
#allow ossec_syscheckd_t self:tcp_socket { create connect read write };
allow ossec_syscheckd_t hi_reserved_port_t:tcp_socket name_bind;
allow ossec_syscheckd_t hi_reserved_port_t:udp_socket name_bind;
corenet_tcp_bind_generic_node(ossec_syscheckd_t)
corenet_udp_bind_generic_node(ossec_syscheckd_t)
corenet_tcp_bind_generic_port(ossec_syscheckd_t)
corenet_udp_bind_generic_port(ossec_syscheckd_t)
corenet_tcp_bind_reserved_port(ossec_syscheckd_t)
corenet_udp_bind_reserved_port(ossec_syscheckd_t)
files_dontaudit_getattr_all_sockets(ossec_syscheckd_t)
# exec patterns
corecmd_exec_bin(ossec_syscheckd_t)
corecmd_exec_shell(ossec_syscheckd_t)
# all the files
files_read_all_files(ossec_syscheckd_t)
files_read_all_symlinks(ossec_syscheckd_t)
seutil_read_bin_policy(ossec_syscheckd_t)
dev_getattr_all(ossec_syscheckd_t)
# all the ports
allow ossec_syscheckd_t self:capability kill;
domain_read_all_domains_state(ossec_syscheckd_t) domain_read_all_domains_state(ossec_syscheckd_t)
domain_dontaudit_getsession_all_domains(ossec_syscheckd_t) domain_dontaudit_getsession_all_domains(ossec_syscheckd_t)
domain_getsession_all_domains(ossec_syscheckd_t) domain_getsession_all_domains(ossec_syscheckd_t)
domain_getpgid_all_domains(ossec_syscheckd_t) domain_getpgid_all_domains(ossec_syscheckd_t)
domain_dontaudit_signull_all_domains(ossec_syscheckd_t) domain_dontaudit_signull_all_domains(ossec_syscheckd_t)
files_dontaudit_getattr_all_sockets(ossec_syscheckd_t)
files_read_all_files(ossec_syscheckd_t)
files_read_all_symlinks(ossec_syscheckd_t)
#============= ossec-monitord_t ============== filetrans_pattern(ossec_execd_t, ossec_var_t, ossec_execd_journal_t, file, "execd.sqlite-journal");
# init
auth_read_passwd(ossec_monitord_t)
allow ossec_monitord_t self:capability { dac_override dac_read_search setuid setgid sys_chroot };
# etc dir
ossec_read_config(ossec_monitord_t)
sysnet_read_config(ossec_monitord_t)
# var run dir
allow ossec_monitord_t ossec_var_run_t:file manage_file_perms;
ossec_pid_filetrans(ossec_monitord_t, ossec_var_run_t, file)
# queue dir
dgram_send_pattern(ossec_monitord_t, ossec_queue_t, ossec_analysisd_sock_t, ossec_analysisd_t)
list_dirs_pattern(ossec_monitord_t, ossec_queue_t, ossec_remoted_file_t) list_dirs_pattern(ossec_monitord_t, ossec_queue_t, ossec_remoted_file_t)
allow ossec_monitord_t ossec_remoted_file_t:file getattr_file_perms;
# logs logging_read_all_logs(ossec_logcollector_t)
allow ossec_monitord_t ossec_log_t:file { create_file_perms append_file_perms write read };
manage_files_pattern(ossec_analysisd_t, ossec_analysisd_file_t, ossec_analysisd_file_t)
manage_files_pattern(ossec_analysisd_t, ossec_etc_t, ossec_analysisd_configfile_t)
manage_files_pattern(ossec_analysisd_t, ossec_stats_t, ossec_stats_t)
manage_files_pattern(ossec_remoted_t, ossec_etc_t, ossec_remoted_configfile_t)
manage_lnk_files_pattern(ossec_syscheckd_t, ossec_tmp_t, ossec_tmp_t)
manage_sock_files_pattern(ossec_analysisd_t, ossec_queue_t, ossec_analysisd_sock_t)
manage_sock_files_pattern(ossec_execd_t, ossec_queue_t, ossec_execd_sock_t)
manage_sock_files_pattern(ossec_remoted_t, ossec_queue_t, ossec_remoted_sock_t)
ossec_log_filetrans(ossec_analysisd_t, ossec_log_t, file)
ossec_log_filetrans(ossec_execd_t, ossec_log_t, file)
ossec_log_filetrans(ossec_logcollector_t, ossec_log_t, file)
ossec_log_filetrans(ossec_maild_t, ossec_log_t, file)
ossec_log_filetrans(ossec_monitord_t, ossec_log_t, file) ossec_log_filetrans(ossec_monitord_t, ossec_log_t, file)
ossec_log_filetrans(ossec_remoted_t, ossec_log_t, file)
ossec_log_filetrans(ossec_syscheckd_t, ossec_log_t, file)
# dgram socket ossec_pid_filetrans(ossec_analysisd_t, ossec_var_run_t, file)
allow ossec_monitord_t self:unix_dgram_socket create_socket_perms; ossec_pid_filetrans(ossec_execd_t, ossec_var_run_t, file)
ossec_pid_filetrans(ossec_logcollector_t, ossec_var_run_t, file)
ossec_pid_filetrans(ossec_maild_t, ossec_var_run_t, file)
ossec_pid_filetrans(ossec_monitord_t, ossec_var_run_t, file)
ossec_pid_filetrans(ossec_remoted_t, ossec_var_run_t, file)
ossec_pid_filetrans(ossec_syscheckd_t, ossec_var_run_t, file)
ossec_queue_filetrans(ossec_analysisd_t, ossec_analysisd_file_t, file)
ossec_queue_filetrans(ossec_analysisd_t, ossec_analysisd_sock_t, sock_file)
ossec_queue_filetrans(ossec_execd_t, ossec_execd_sock_t, sock_file)
ossec_queue_filetrans(ossec_remoted_t, ossec_remoted_sock_t, sock_file)
ossec_queue_filetrans(ossec_syscheckd_t, ossec_queue_t, file)
#============= httpd_t ============== ossec_read_config(ossec_analysisd_t)
ossec_read_config(ossec_execd_t)
ossec_read_config(ossec_logcollector_t)
ossec_read_config(ossec_maild_t)
ossec_read_config(ossec_monitord_t)
ossec_read_config(ossec_remoted_t)
ossec_read_config(ossec_syscheckd_t)
ossec_read_logs(httpd_t) ossec_read_logs(httpd_t)
ossec_read_queue(httpd_t) ossec_read_queue(httpd_t)
ossec_read_stats(httpd_t) ossec_read_stats(httpd_t)
ossec_tmp_filetrans(ossec_syscheckd_t, ossec_tmp_t, lnk_file)
read_files_pattern(ossec_analysisd_t, ossec_rule_t, ossec_rule_t)
rw_files_pattern(ossec_remoted_t, ossec_remoted_file_t, ossec_remoted_file_t)
search_dirs_pattern(ossec_analysisd_t, ossec_rule_t, ossec_rule_t)
search_dirs_pattern(ossec_execd_t, ossec_ar_bin_t, ossec_ar_bin_t)
seutil_read_bin_policy(ossec_syscheckd_t)
sysnet_read_config(ossec_analysisd_t)
sysnet_read_config(ossec_execd_t)
sysnet_read_config(ossec_logcollector_t)
sysnet_read_config(ossec_maild_t)
sysnet_read_config(ossec_monitord_t)
sysnet_read_config(ossec_remoted_t)
sysnet_read_config(ossec_syscheckd_t)
userdom_search_user_tmp_dirs(ossec_syscheckd_t)