Linux-Help
/
selinux-ossec
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Changed ossec_scripts_t domain to ossec_ar_t domain and started using interfaces for etc

This commit is contained in:
Eric Renfro 2015-11-23 23:32:34 -05:00
parent 7a6f7d3a04
commit 944fcedf8d
2 changed files with 117 additions and 80 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
ossec.fc
View File

@ -21,8 +21,10 @@
/var/ossec/etc/shared(/.*)? gen_context(system_u:object_r:ossec_etc_share_t,s0) /var/ossec/etc/shared(/.*)? gen_context(system_u:object_r:ossec_etc_share_t,s0)
/var/ossec/rules(/.*)? gen_context(system_u:object_r:ossec_rule_t,s0) /var/ossec/rules(/.*)? gen_context(system_u:object_r:ossec_rule_t,s0)
/var/ossec/active-response/bin(/.*)? -- gen_context(system_u:object_r:ossec_script_exec_t,s0) #/var/ossec/active-response/bin(/.*)? -- gen_context(system_u:object_r:ossec_script_exec_t,s0)
/var/ossec/active-response(/.*)? gen_context(system_u:object_r:ossec_script_t,s0) #/var/ossec/active-response(/.*)? gen_context(system_u:object_r:ossec_script_t,s0)
/var/ossec/active-response/bin(/.*)? -- gen_context(system_u:object_r:ossec_ar_exec_t,s0)
/var/ossec/active-response(/.*)? gen_context(system_u:object_r:ossec_ar_bin_t,s0)
/etc/init.d/ossec-hids -- gen_context(system_u:object_r:ossec_initrc_exec_t,s0) /etc/init.d/ossec-hids -- gen_context(system_u:object_r:ossec_initrc_exec_t,s0)
/var/ossec/bin/ossec-control -- gen_context(system_u:object_r:ossec_initrc_exec_t,s0) /var/ossec/bin/ossec-control -- gen_context(system_u:object_r:ossec_initrc_exec_t,s0)

191
ossec.te
View File

@ -1,55 +1,66 @@
policy_module(ossec,1.0.161) policy_module(ossec,1.0.165)
######################################## ########################################
# #
# Declarations # Declarations
# #
type ossec_t; # ossec bin dir
type ossec_bin_t; type ossec_bin_t;
files_type(ossec_bin_t) files_type(ossec_bin_t)
# ossec-maild daemon
type ossec_maild_t; type ossec_maild_t;
type ossec_maild_exec_t; type ossec_maild_exec_t;
init_daemon_domain(ossec_maild_t, ossec_maild_exec_t) init_daemon_domain(ossec_maild_t, ossec_maild_exec_t)
# ossec-execd daemon
type ossec_execd_t; type ossec_execd_t;
type ossec_execd_exec_t; type ossec_execd_exec_t;
init_daemon_domain(ossec_execd_t, ossec_execd_exec_t) init_daemon_domain(ossec_execd_t, ossec_execd_exec_t)
# ossec-analysisd daemon
type ossec_analysisd_t; type ossec_analysisd_t;
type ossec_analysisd_exec_t; type ossec_analysisd_exec_t;
init_daemon_domain(ossec_analysisd_t, ossec_analysisd_exec_t) init_daemon_domain(ossec_analysisd_t, ossec_analysisd_exec_t)
# ossec-logcollector daemon
type ossec_logcollector_t; type ossec_logcollector_t;
type ossec_logcollector_exec_t; type ossec_logcollector_exec_t;
init_daemon_domain(ossec_logcollector_t, ossec_logcollector_exec_t) init_daemon_domain(ossec_logcollector_t, ossec_logcollector_exec_t)
# ossec-remoted daemon
type ossec_remoted_t; type ossec_remoted_t;
type ossec_remoted_exec_t; type ossec_remoted_exec_t;
init_daemon_domain(ossec_remoted_t, ossec_remoted_exec_t) init_daemon_domain(ossec_remoted_t, ossec_remoted_exec_t)
# ossec-syscheckd daemon
type ossec_syscheckd_t; type ossec_syscheckd_t;
type ossec_syscheckd_exec_t; type ossec_syscheckd_exec_t;
init_daemon_domain(ossec_syscheckd_t, ossec_syscheckd_exec_t) init_daemon_domain(ossec_syscheckd_t, ossec_syscheckd_exec_t)
# ossec-monitord daemon
type ossec_monitord_t; type ossec_monitord_t;
type ossec_monitord_exec_t; type ossec_monitord_exec_t;
init_daemon_domain(ossec_monitord_t, ossec_monitord_exec_t) init_daemon_domain(ossec_monitord_t, ossec_monitord_exec_t)
# ossec-dbd daemon
type ossec_dbd_t; type ossec_dbd_t;
type ossec_dbd_exec_t; type ossec_dbd_exec_t;
init_daemon_domain(ossec_dbd_t, ossec_dbd_exec_t) init_daemon_domain(ossec_dbd_t, ossec_dbd_exec_t)
# ossec-csyslogd daemon
type ossec_csyslogd_t; type ossec_csyslogd_t;
type ossec_csyslogd_exec_t; type ossec_csyslogd_exec_t;
init_daemon_domain(ossec_csyslogd_t, ossec_csyslogd_exec_t) init_daemon_domain(ossec_csyslogd_t, ossec_csyslogd_exec_t)
# ossec-agentlessd daemon
type ossec_agentlessd_t; type ossec_agentlessd_t;
type ossec_agentlessd_exec_t; type ossec_agentlessd_exec_t;
init_daemon_domain(ossec_agentlessd_t, ossec_agentlessd_exec_t) init_daemon_domain(ossec_agentlessd_t, ossec_agentlessd_exec_t)
# initrc
type ossec_initrc_exec_t; type ossec_initrc_exec_t;
init_script_file(ossec_initrc_exec_t) init_script_file(ossec_initrc_exec_t)
@ -57,67 +68,82 @@ optional_policy(`
ossec_domtrans(httpd_t) ossec_domtrans(httpd_t)
') ')
# ossec var dir
type ossec_var_t; type ossec_var_t;
files_type(ossec_var_t) files_type(ossec_var_t)
# ossec var run dir
type ossec_var_run_t; type ossec_var_run_t;
files_pid_file(ossec_var_run_t) files_pid_file(ossec_var_run_t)
# ossec tmp dir
type ossec_tmp_t; type ossec_tmp_t;
files_tmp_file(ossec_tmp_t) files_tmp_file(ossec_tmp_t)
# ossec logs dir
type ossec_log_t; type ossec_log_t;
logging_log_file(ossec_log_t) logging_log_file(ossec_log_t)
# ossec etc dir
type ossec_etc_t; type ossec_etc_t;
files_config_file(ossec_etc_t) files_config_file(ossec_etc_t)
# ossec etc share dir
type ossec_etc_share_t; type ossec_etc_share_t;
files_config_file(ossec_etc_share_t) files_config_file(ossec_etc_share_t)
# ossec rules dir
type ossec_rule_t; type ossec_rule_t;
files_config_file(ossec_rule_t) files_config_file(ossec_rule_t)
# ossec stats dir
type ossec_stats_t; type ossec_stats_t;
files_type(ossec_stats_t) files_type(ossec_stats_t)
# ossec queue dir
type ossec_queue_t; type ossec_queue_t;
files_type(ossec_queue_t) files_type(ossec_queue_t)
#type ossec_ar_t; ###
#files_type(ossec_ar_t); # Active-Response Domain and File Types
type ossec_ar_t;
#type ossec_ar_bin_t; type ossec_ar_bin_t;
#files_type(ossec_ar_bin_t); files_type(ossec_ar_bin_t);
#type ossec_ar_exec_t; type ossec_ar_exec_t;
#files_type(ossec_ar_exec_t); files_type(ossec_ar_exec_t);
domain_type(ossec_ar_t)
domain_entry_file(ossec_ar_t, ossec_ar_exec_t)
domtrans_pattern(ossec_execd_t, ossec_ar_exec_t, ossec_ar_t)
role system_r types ossec_ar_t;
unconfined_domain(ossec_ar_t)
###
type ossec_script_t; #type ossec_script_t;
type ossec_script_exec_t; #type ossec_script_exec_t;
files_type(ossec_script_t) #files_type(ossec_script_t)
domain_type(ossec_script_t) #domain_type(ossec_script_t)
domain_entry_file(ossec_script_t, ossec_script_exec_t) #domain_entry_file(ossec_script_t, ossec_script_exec_t)
domtrans_pattern(ossec_execd_t, ossec_script_exec_t, ossec_script_t) #domtrans_pattern(ossec_execd_t, ossec_script_exec_t, ossec_script_t)
role system_r types ossec_script_t; #role system_r types ossec_script_t;
unconfined_domain(ossec_script_t) #unconfined_domain(ossec_script_t)
#unconfined_run(ossec_script_exec_t, ossec_script_t) ##unconfined_run(ossec_script_exec_t, ossec_script_t)
#type_transition ossec_execd_t ossec_script_exec_t:process unconfined_t; ##type_transition ossec_execd_t ossec_script_exec_t:process unconfined_t;
#files_type(ossec_script_exec_t) ##files_type(ossec_script_exec_t)
#domain_type(ossec_script_exec_t) ##domain_type(ossec_script_exec_t)
#domain_entry_file(ossec_script_exec_t, ossec_execd_t) ##domain_entry_file(ossec_script_exec_t, ossec_execd_t)
##domtrans_pattern(unconfined_t, ossec_script_exec_t, ossec_execd_t) ###domtrans_pattern(unconfined_t, ossec_script_exec_t, ossec_execd_t)
#unconfined_domain(ossec_script_exec_t) ##unconfined_domain(ossec_script_exec_t)
#unconfined_shell_domtrans(ossec_script_exec_t) ##unconfined_shell_domtrans(ossec_script_exec_t)
#unconfined_run(ossec_execd_t, system_r) ##unconfined_run(ossec_execd_t, system_r)
#unconfined_run(ossec_script_exec_t, ossec_script_t) ##unconfined_run(ossec_script_exec_t, ossec_script_t)
require { require {
type ossec_t;
type ossec_bin_t; type ossec_bin_t;
type ossec_maild_t; type ossec_maild_t;
@ -148,8 +174,11 @@ require {
type ossec_rule_t; type ossec_rule_t;
type ossec_stats_t; type ossec_stats_t;
type ossec_queue_t; type ossec_queue_t;
type ossec_script_t;
type ossec_script_exec_t; type ossec_ar_t;
type ossec_ar_bin_t;
type ossec_ar_exec_t;
type httpd_t; type httpd_t;
type httpd_log_t; type httpd_log_t;
type unreserved_port_t; type unreserved_port_t;
@ -163,7 +192,6 @@ require {
class capability { dac_override dac_read_search setuid setgid fsetid sys_chroot sys_nice }; class capability { dac_override dac_read_search setuid setgid fsetid sys_chroot sys_nice };
class tcp_socket { create name_bind name_connect }; class tcp_socket { create name_bind name_connect };
class udp_socket { create bind name_bind node_bind }; class udp_socket { create bind name_bind node_bind };
} }
@ -177,14 +205,14 @@ require {
auth_read_passwd(ossec_maild_t) auth_read_passwd(ossec_maild_t)
# init # init
allow ossec_maild_t self:capability { dac_override dac_read_search setuid setgid sys_chroot }; #fsetid sys_nice }; allow ossec_maild_t self:capability { dac_override dac_read_search setuid setgid sys_chroot };
#allow ossec_t self:process { setsched };
# etc dir # etc dir
search_dirs_pattern(ossec_maild_t, ossec_etc_t, ossec_etc_t) ossec_read_config(ossec_maild_t)
read_lnk_files_pattern(ossec_maild_t, ossec_etc_t, ossec_etc_t) #search_dirs_pattern(ossec_maild_t, ossec_etc_t, ossec_etc_t)
read_files_pattern(ossec_maild_t, ossec_etc_t, ossec_etc_t) #read_lnk_files_pattern(ossec_maild_t, ossec_etc_t, ossec_etc_t)
sysnet_read_config(ossec_maild_t) #read_files_pattern(ossec_maild_t, ossec_etc_t, ossec_etc_t)
#sysnet_read_config(ossec_maild_t)
# var dir # var dir
search_dirs_pattern(ossec_maild_t, ossec_var_t, ossec_var_t) search_dirs_pattern(ossec_maild_t, ossec_var_t, ossec_var_t)
@ -200,7 +228,6 @@ allow ossec_maild_t ossec_log_t:file { create_file_perms append_file_perms };
logging_log_filetrans(ossec_maild_t, ossec_log_t, file) logging_log_filetrans(ossec_maild_t, ossec_log_t, file)
# Sockets # Sockets
#allow ossec_t self:udp_socket { create };
allow ossec_maild_t self:tcp_socket { create connect read write }; allow ossec_maild_t self:tcp_socket { create connect read write };
allow ossec_maild_t smtp_port_t:tcp_socket { name_connect }; allow ossec_maild_t smtp_port_t:tcp_socket { name_connect };
@ -211,6 +238,18 @@ allow ossec_maild_t smtp_port_t:tcp_socket { name_connect };
auth_read_passwd(ossec_execd_t) auth_read_passwd(ossec_execd_t)
allow ossec_execd_t self:capability { dac_override dac_read_search setgid }; allow ossec_execd_t self:capability { dac_override dac_read_search setgid };
# etc dir
ossec_read_config(ossec_execd_t)
#search_dirs_pattern(ossec_execd_t, ossec_etc_t, ossec_etc_t)
#read_lnk_files_pattern(ossec_execd_t, ossec_etc_t, ossec_etc_t)
#read_files_pattern(ossec_execd_t, ossec_etc_t, ossec_etc_t)
##sysnet_read_config(ossec_execd_t)
# etc share dir
search_dirs_pattern(ossec_execd_t, ossec_etc_share_t, ossec_etc_share_t)
read_files_pattern(ossec_execd_t, ossec_etc_share_t, ossec_etc_share_t)
#manage_files_pattern(ossec_execd_t, ossec_etc_share_t, ossec_etc_share_t)
# var dir # var dir
#search_dirs_pattern(ossec_execd_t, ossec_var_t, ossec_var_t) #search_dirs_pattern(ossec_execd_t, ossec_var_t, ossec_var_t)
rw_dirs_pattern(ossec_execd_t, ossec_var_t, ossec_var_t) rw_dirs_pattern(ossec_execd_t, ossec_var_t, ossec_var_t)
@ -232,21 +271,11 @@ read_files_pattern(ossec_execd_t, ossec_log_t, ossec_log_t)
allow ossec_execd_t ossec_log_t:file { create_file_perms append_file_perms }; allow ossec_execd_t ossec_log_t:file { create_file_perms append_file_perms };
logging_log_filetrans(ossec_execd_t, ossec_log_t, file) logging_log_filetrans(ossec_execd_t, ossec_log_t, file)
# etc dir
search_dirs_pattern(ossec_execd_t, ossec_etc_t, ossec_etc_t)
read_lnk_files_pattern(ossec_execd_t, ossec_etc_t, ossec_etc_t)
read_files_pattern(ossec_execd_t, ossec_etc_t, ossec_etc_t)
#sysnet_read_config(ossec_execd_t)
# etc share dir
search_dirs_pattern(ossec_execd_t, ossec_etc_share_t, ossec_etc_share_t)
read_files_pattern(ossec_execd_t, ossec_etc_share_t, ossec_etc_share_t)
#manage_files_pattern(ossec_execd_t, ossec_etc_share_t, ossec_etc_share_t)
# script dir # script dir
search_dirs_pattern(ossec_execd_t, ossec_script_t, ossec_script_t) search_dirs_pattern(ossec_execd_t, ossec_ar_bin_t, ossec_ar_bin_t)
read_files_pattern(ossec_execd_t, ossec_script_exec_t, ossec_script_exec_t) #search_dirs_pattern(ossec_execd_t, ossec_script_t, ossec_script_t)
exec_files_pattern(ossec_execd_t, ossec_script_exec_t, ossec_script_exec_t) #read_files_pattern(ossec_execd_t, ossec_script_exec_t, ossec_script_exec_t)
#exec_files_pattern(ossec_execd_t, ossec_script_exec_t, ossec_script_exec_t)
exec_files_pattern(ossec_execd_t, shell_exec_t, shell_exec_t) exec_files_pattern(ossec_execd_t, shell_exec_t, shell_exec_t)
@ -257,12 +286,13 @@ allow ossec_execd_t self:unix_dgram_socket { create bind getopt read write };
dev_read_urand(ossec_execd_t) dev_read_urand(ossec_execd_t)
# Run autoresponce unconstrained # Run autoresponce unconstrained
allow ossec_execd_t ossec_script_t:process { rlimitinh siginh noatsecure }; allow ossec_execd_t ossec_ar_t:process { rlimitinh siginh noatsecure };
#allow ossec_execd_t unconfined_t:process { transition rlimitinh siginh noatsecure }; #allow ossec_execd_t ossec_script_t:process { rlimitinh siginh noatsecure };
#allow unconfined_t ossec_script_exec_t:file { entrypoint }; ##allow ossec_execd_t unconfined_t:process { transition rlimitinh siginh noatsecure };
##allow unconfined_t ossec_script_exec_t:file { entrypoint };
##unconfined_domtrans(ossec_script_t) ###unconfined_domtrans(ossec_script_t)
##unconfined_run(ossec_execd_t, ossec_script_t) ###unconfined_run(ossec_execd_t, ossec_script_t)
#============= ossec_analysisd_t ============== #============= ossec_analysisd_t ==============
@ -271,6 +301,17 @@ allow ossec_execd_t ossec_script_t:process { rlimitinh siginh noatsecure };
auth_read_passwd(ossec_analysisd_t) auth_read_passwd(ossec_analysisd_t)
allow ossec_analysisd_t self:capability { dac_override dac_read_search fsetid setuid setgid sys_chroot }; allow ossec_analysisd_t self:capability { dac_override dac_read_search fsetid setuid setgid sys_chroot };
# etc dir
ossec_read_config(ossec_analysisd_t)
#search_dirs_pattern(ossec_analysisd_t, ossec_etc_t, ossec_etc_t)
#read_lnk_files_pattern(ossec_analysisd_t, ossec_etc_t, ossec_etc_t)
#read_files_pattern(ossec_analysisd_t, ossec_etc_t, ossec_etc_t)
##sysnet_read_config(ossec_maild_t)
# etc share dir
search_dirs_pattern(ossec_analysisd_t, ossec_etc_share_t, ossec_etc_share_t)
manage_files_pattern(ossec_analysisd_t, ossec_etc_share_t, ossec_etc_share_t)
# var dir # var dir
search_dirs_pattern(ossec_analysisd_t, ossec_var_t, ossec_var_t) search_dirs_pattern(ossec_analysisd_t, ossec_var_t, ossec_var_t)
#rw_dirs_pattern(ossec_execd_t, ossec_var_t, ossec_var_t) #rw_dirs_pattern(ossec_execd_t, ossec_var_t, ossec_var_t)
@ -293,16 +334,6 @@ rw_files_pattern(ossec_analysisd_t, ossec_stats_t, ossec_stats_t)
create_files_pattern(ossec_analysisd_t, ossec_stats_t, ossec_stats_t) create_files_pattern(ossec_analysisd_t, ossec_stats_t, ossec_stats_t)
append_files_pattern(ossec_analysisd_t, ossec_stats_t, ossec_stats_t) append_files_pattern(ossec_analysisd_t, ossec_stats_t, ossec_stats_t)
# etc dir
search_dirs_pattern(ossec_analysisd_t, ossec_etc_t, ossec_etc_t)
read_lnk_files_pattern(ossec_analysisd_t, ossec_etc_t, ossec_etc_t)
read_files_pattern(ossec_analysisd_t, ossec_etc_t, ossec_etc_t)
#sysnet_read_config(ossec_maild_t)
# etc share dir
search_dirs_pattern(ossec_analysisd_t, ossec_etc_share_t, ossec_etc_share_t)
manage_files_pattern(ossec_analysisd_t, ossec_etc_share_t, ossec_etc_share_t)
# logs # logs
#search_dirs_pattern(ossec_analysisd_t, ossec_log_t, ossec_log_t) #search_dirs_pattern(ossec_analysisd_t, ossec_log_t, ossec_log_t)
add_entry_dirs_pattern(ossec_analysisd_t, ossec_log_t, ossec_log_t) add_entry_dirs_pattern(ossec_analysisd_t, ossec_log_t, ossec_log_t)
@ -329,9 +360,10 @@ allow ossec_analysisd_t ossec_remoted_t:unix_dgram_socket { sendto };
allow ossec_logcollector_t self:capability { dac_override dac_read_search }; allow ossec_logcollector_t self:capability { dac_override dac_read_search };
# etc dir # etc dir
search_dirs_pattern(ossec_logcollector_t, ossec_etc_t, ossec_etc_t) ossec_read_config(ossec_logcollector_t)
read_lnk_files_pattern(ossec_logcollector_t, ossec_etc_t, ossec_etc_t) #search_dirs_pattern(ossec_logcollector_t, ossec_etc_t, ossec_etc_t)
read_files_pattern(ossec_logcollector_t, ossec_etc_t, ossec_etc_t) #read_lnk_files_pattern(ossec_logcollector_t, ossec_etc_t, ossec_etc_t)
#read_files_pattern(ossec_logcollector_t, ossec_etc_t, ossec_etc_t)
# var dir # var dir
search_dirs_pattern(ossec_logcollector_t, ossec_var_t, ossec_var_t) search_dirs_pattern(ossec_logcollector_t, ossec_var_t, ossec_var_t)
@ -371,9 +403,10 @@ auth_read_passwd(ossec_remoted_t)
allow ossec_remoted_t self:capability { dac_override dac_read_search setuid setgid sys_chroot }; allow ossec_remoted_t self:capability { dac_override dac_read_search setuid setgid sys_chroot };
# etc dir # etc dir
search_dirs_pattern(ossec_remoted_t, ossec_etc_t, ossec_etc_t) ossec_read_config(ossec_remoted_t)
read_lnk_files_pattern(ossec_remoted_t, ossec_etc_t, ossec_etc_t) #search_dirs_pattern(ossec_remoted_t, ossec_etc_t, ossec_etc_t)
read_files_pattern(ossec_remoted_t, ossec_etc_t, ossec_etc_t) #read_lnk_files_pattern(ossec_remoted_t, ossec_etc_t, ossec_etc_t)
#read_files_pattern(ossec_remoted_t, ossec_etc_t, ossec_etc_t)
# etc share dir # etc share dir
search_dirs_pattern(ossec_remoted_t, ossec_etc_share_t, ossec_etc_share_t) search_dirs_pattern(ossec_remoted_t, ossec_etc_share_t, ossec_etc_share_t)
@ -424,9 +457,10 @@ allow ossec_syscheckd_t self:capability { dac_override dac_read_search setuid se
allow ossec_syscheckd_t self:process { setsched }; allow ossec_syscheckd_t self:process { setsched };
# etc dir # etc dir
search_dirs_pattern(ossec_syscheckd_t, ossec_etc_t, ossec_etc_t) ossec_read_config(ossec_syscheckd_t)
read_lnk_files_pattern(ossec_syscheckd_t, ossec_etc_t, ossec_etc_t) #search_dirs_pattern(ossec_syscheckd_t, ossec_etc_t, ossec_etc_t)
read_files_pattern(ossec_syscheckd_t, ossec_etc_t, ossec_etc_t) #read_lnk_files_pattern(ossec_syscheckd_t, ossec_etc_t, ossec_etc_t)
#read_files_pattern(ossec_syscheckd_t, ossec_etc_t, ossec_etc_t)
# var dir # var dir
search_dirs_pattern(ossec_syscheckd_t, ossec_var_t, ossec_var_t) search_dirs_pattern(ossec_syscheckd_t, ossec_var_t, ossec_var_t)
@ -472,9 +506,10 @@ auth_read_passwd(ossec_monitord_t)
allow ossec_monitord_t self:capability { dac_override dac_read_search setuid setgid sys_chroot }; allow ossec_monitord_t self:capability { dac_override dac_read_search setuid setgid sys_chroot };
# etc dir # etc dir
search_dirs_pattern(ossec_monitord_t, ossec_etc_t, ossec_etc_t) ossec_read_config(ossec_monitord_t)
read_lnk_files_pattern(ossec_monitord_t, ossec_etc_t, ossec_etc_t) #search_dirs_pattern(ossec_monitord_t, ossec_etc_t, ossec_etc_t)
read_files_pattern(ossec_monitord_t, ossec_etc_t, ossec_etc_t) #read_lnk_files_pattern(ossec_monitord_t, ossec_etc_t, ossec_etc_t)
#read_files_pattern(ossec_monitord_t, ossec_etc_t, ossec_etc_t)
# var dir # var dir
search_dirs_pattern(ossec_monitord_t, ossec_var_t, ossec_var_t) search_dirs_pattern(ossec_monitord_t, ossec_var_t, ossec_var_t)