diff --git a/ossec.if b/ossec.if
index aa81784..14fc3d0 100644
--- a/ossec.if
+++ b/ossec.if
@@ -222,3 +222,41 @@ interface(`ossec_queue_filetrans',`
filetrans_pattern($1, ossec_queue_t, $2, $3, $4)
')
+########################################
+##
+## Create objects in the tmp directory
+## with a private type with a type transition.
+##
+##
+##
+## Domain allowed access.
+##
+##
+##
+##
+## Type to which the created node will be transitioned.
+##
+##
+##
+##
+## Object class(es) (single or set including {}) for which this
+## the transition will occur.
+##
+##
+##
+##
+## The name of the object being created.
+##
+##
+#
+interface(`ossec_tmp_filetrans',`
+ gen_require(`
+ type var_t;
+ type ossec_tmp_t;
+ ')
+
+ allow $1 var_t:dir search_dir_perms;
+ allow $1 ossec_tmp_t:dir search_dir_perms;
+ filetrans_pattern($1, ossec_tmp_t, $2, $3, $4)
+')
+
diff --git a/ossec.te b/ossec.te
index 233035a..1f333c3 100644
--- a/ossec.te
+++ b/ossec.te
@@ -1,5 +1,5 @@
-policy_module(ossec,1.0.239)
+policy_module(ossec,1.0.276)
########################################
#
@@ -67,6 +67,10 @@ type ossec_syscheckd_t;
type ossec_syscheckd_exec_t;
init_daemon_domain(ossec_syscheckd_t, ossec_syscheckd_exec_t)
+#domain_entry_file(ossec_syscheckd_t, shell_exec_t)
+#domtrans_pattern(ossec_syscheckd_t, ossec_ar_exec_t, ossec_ar_t)
+
+
# ossec-monitord daemon
type ossec_monitord_t;
type ossec_monitord_exec_t;
@@ -139,8 +143,10 @@ role system_r types ossec_ar_t;
unconfined_domain(ossec_ar_t)
###
+
require {
type httpd_t;
+ type hi_reserved_port_t;
class file { rename read lock create write getattr unlink open append entrypoint };
#class dir { write getattr read remove_name create add_name };
@@ -236,8 +242,12 @@ allow ossec_analysisd_t ossec_var_run_t:file manage_file_perms;
ossec_pid_filetrans(ossec_analysisd_t, ossec_var_run_t, file)
# queue dir
+#allow ossec_analysisd_t ossec_analysisd_file_t:dir { write add_name };
+#allow ossec_analysisd_t ossec_analysisd_file_t:dir { manage_dir_perms };
ossec_queue_filetrans(ossec_analysisd_t, ossec_analysisd_file_t, file)
-rw_files_pattern(ossec_analysisd_t, ossec_analysisd_file_t, ossec_analysisd_file_t)
+#rw_files_pattern(ossec_analysisd_t, ossec_analysisd_file_t, ossec_analysisd_file_t)
+manage_files_pattern(ossec_analysisd_t, ossec_analysisd_file_t, ossec_analysisd_file_t)
+
ossec_queue_filetrans(ossec_analysisd_t, ossec_analysisd_sock_t, sock_file)
manage_sock_files_pattern(ossec_analysisd_t, ossec_queue_t, ossec_analysisd_sock_t)
@@ -246,8 +256,9 @@ dgram_send_pattern(ossec_analysisd_t, ossec_queue_t, ossec_execd_sock_t, ossec_e
dgram_send_pattern(ossec_analysisd_t, ossec_queue_t, ossec_remoted_sock_t, ossec_remoted_t)
# stats dir
-append_files_pattern(ossec_analysisd_t, ossec_stats_t, ossec_stats_t)
-allow ossec_analysisd_t ossec_stats_t:file read_file_perms;
+manage_files_pattern(ossec_analysisd_t, ossec_stats_t, ossec_stats_t)
+#append_files_pattern(ossec_analysisd_t, ossec_stats_t, ossec_stats_t)
+#allow ossec_analysisd_t ossec_stats_t:file read_file_perms;
# logs
allow ossec_analysisd_t ossec_log_t:file { create_file_perms append_file_perms read link unlink };
@@ -341,6 +352,14 @@ ossec_pid_filetrans(ossec_syscheckd_t, ossec_var_run_t, file)
# queue dir
dgram_send_pattern(ossec_syscheckd_t, ossec_queue_t, ossec_analysisd_sock_t, ossec_analysisd_t)
+allow ossec_syscheckd_t ossec_queue_t:dir { create_dir_perms rw_dir_perms };
+allow ossec_syscheckd_t ossec_queue_t:file { create_file_perms rename_file_perms write_file_perms };
+ossec_queue_filetrans(ossec_syscheckd_t, ossec_queue_t, file)
+
+ossec_tmp_filetrans(ossec_syscheckd_t, ossec_tmp_t, lnk_file)
+manage_lnk_files_pattern(ossec_syscheckd_t, ossec_tmp_t, ossec_tmp_t)
+userdom_search_user_tmp_dirs(ossec_syscheckd_t)
+
# logs
allow ossec_syscheckd_t ossec_log_t:file { create_file_perms append_file_perms read };
ossec_log_filetrans(ossec_syscheckd_t, ossec_log_t, file)
@@ -353,11 +372,33 @@ allow ossec_syscheckd_t self:udp_socket create_socket_perms;
allow ossec_syscheckd_t self:tcp_socket create_socket_perms;
#allow ossec_syscheckd_t self:udp_socket { create connect read write bind };
#allow ossec_syscheckd_t self:tcp_socket { create connect read write };
+allow ossec_syscheckd_t hi_reserved_port_t:tcp_socket name_bind;
+allow ossec_syscheckd_t hi_reserved_port_t:udp_socket name_bind;
+corenet_tcp_bind_generic_node(ossec_syscheckd_t)
+corenet_udp_bind_generic_node(ossec_syscheckd_t)
+corenet_tcp_bind_generic_port(ossec_syscheckd_t)
+corenet_udp_bind_generic_port(ossec_syscheckd_t)
+corenet_tcp_bind_reserved_port(ossec_syscheckd_t)
+corenet_udp_bind_reserved_port(ossec_syscheckd_t)
+files_dontaudit_getattr_all_sockets(ossec_syscheckd_t)
-# all the things
+# exec patterns
+allow ossec_syscheckd_t shell_exec_t:file { exec_file_perms };
+exec_files_pattern(ossec_syscheckd_t, bin_t, bin_t);
+
+# all the files
files_read_all_files(ossec_syscheckd_t)
files_read_all_symlinks(ossec_syscheckd_t)
-kernel_getattr_proc_files(ossec_syscheckd_t)
+seutil_read_bin_policy(ossec_syscheckd_t)
+dev_getattr_all(ossec_syscheckd_t)
+
+# all the ports
+allow ossec_syscheckd_t self:capability kill;
+domain_read_all_domains_state(ossec_syscheckd_t)
+domain_dontaudit_getsession_all_domains(ossec_syscheckd_t)
+domain_getsession_all_domains(ossec_syscheckd_t)
+domain_getpgid_all_domains(ossec_syscheckd_t)
+domain_dontaudit_signull_all_domains(ossec_syscheckd_t)
#============= ossec-monitord_t ==============
@@ -381,7 +422,7 @@ list_dirs_pattern(ossec_monitord_t, ossec_queue_t, ossec_remoted_file_t)
allow ossec_monitord_t ossec_remoted_file_t:file getattr_file_perms;
# logs
-allow ossec_monitord_t ossec_log_t:file { create_file_perms append_file_perms read };
+allow ossec_monitord_t ossec_log_t:file { create_file_perms append_file_perms write read };
ossec_log_filetrans(ossec_monitord_t, ossec_log_t, file)
# dgram socket