From c1c499a09cc3eb9997e12d9c518697aa1685f87f Mon Sep 17 00:00:00 2001 From: Eric Renfro Date: Sat, 30 Jul 2016 16:37:59 -0400 Subject: [PATCH 1/2] Updated policy to fix syscheckd denials --- ossec.if | 38 ++++++++++++++++++++++++++++++++++++++ ossec.te | 30 +++++++++++++++++++++++++++++- 2 files changed, 67 insertions(+), 1 deletion(-) diff --git a/ossec.if b/ossec.if index aa81784..14fc3d0 100644 --- a/ossec.if +++ b/ossec.if @@ -222,3 +222,41 @@ interface(`ossec_queue_filetrans',` filetrans_pattern($1, ossec_queue_t, $2, $3, $4) ') +######################################## +## +## Create objects in the tmp directory +## with a private type with a type transition. +## +## +## +## Domain allowed access. +## +## +## +## +## Type to which the created node will be transitioned. +## +## +## +## +## Object class(es) (single or set including {}) for which this +## the transition will occur. +## +## +## +## +## The name of the object being created. +## +## +# +interface(`ossec_tmp_filetrans',` + gen_require(` + type var_t; + type ossec_tmp_t; + ') + + allow $1 var_t:dir search_dir_perms; + allow $1 ossec_tmp_t:dir search_dir_perms; + filetrans_pattern($1, ossec_tmp_t, $2, $3, $4) +') + diff --git a/ossec.te b/ossec.te index 233035a..11b8c3b 100644 --- a/ossec.te +++ b/ossec.te @@ -1,5 +1,5 @@ -policy_module(ossec,1.0.239) +policy_module(ossec,1.0.258) ######################################## # @@ -67,6 +67,10 @@ type ossec_syscheckd_t; type ossec_syscheckd_exec_t; init_daemon_domain(ossec_syscheckd_t, ossec_syscheckd_exec_t) +#domain_entry_file(ossec_syscheckd_t, shell_exec_t) +#domtrans_pattern(ossec_syscheckd_t, ossec_ar_exec_t, ossec_ar_t) + + # ossec-monitord daemon type ossec_monitord_t; type ossec_monitord_exec_t; @@ -139,6 +143,7 @@ role system_r types ossec_ar_t; unconfined_domain(ossec_ar_t) ### + require { type httpd_t; @@ -341,6 +346,19 @@ ossec_pid_filetrans(ossec_syscheckd_t, ossec_var_run_t, file) # queue dir dgram_send_pattern(ossec_syscheckd_t, ossec_queue_t, ossec_analysisd_sock_t, ossec_analysisd_t) +allow ossec_syscheckd_t ossec_queue_t:dir { create_dir_perms rw_dir_perms }; +allow ossec_syscheckd_t ossec_queue_t:file { create_file_perms rename_file_perms write_file_perms }; +ossec_queue_filetrans(ossec_syscheckd_t, ossec_queue_t, file) +#rw_files_pattern(ossec_syscheckd_t, ossec_queue_t, ossec_queue_t) +#rename_files_pattern(ossec_syscheckd_t, ossec_queue_t, ossec_queue_t) +#create_files_pattern(ossec_syscheckd_t, ossec_queue_t, ossec_queue_t) + +ossec_tmp_filetrans(ossec_syscheckd_t, ossec_tmp_t, lnk_file) +#manage_files_pattern(ossec_syscheckd_t, ossec_tmp_t, ossec_tmp_t) +manage_lnk_files_pattern(ossec_syscheckd_t, ossec_tmp_t, ossec_tmp_t) +#allow ossec_syscheckd_t user_tmp_t:sock_file getattr; +userdom_search_user_tmp_dirs(ossec_syscheckd_t) + # logs allow ossec_syscheckd_t ossec_log_t:file { create_file_perms append_file_perms read }; ossec_log_filetrans(ossec_syscheckd_t, ossec_log_t, file) @@ -354,10 +372,20 @@ allow ossec_syscheckd_t self:tcp_socket create_socket_perms; #allow ossec_syscheckd_t self:udp_socket { create connect read write bind }; #allow ossec_syscheckd_t self:tcp_socket { create connect read write }; +# exec patterns +allow ossec_syscheckd_t shell_exec_t:file { exec_file_perms }; +exec_files_pattern(ossec_syscheckd_t, bin_t, bin_t); + # all the things +#allow ossec_syscheckd_t shell_exec_t:file { exec_file_perms }; +#allow ossec_syscheckd_t bin_t:file { exec_file_perms }; +#allow ossec_syscheckd_t bin_t:file { execute execute_no_trans }; files_read_all_files(ossec_syscheckd_t) files_read_all_symlinks(ossec_syscheckd_t) +seutil_read_bin_policy(ossec_syscheckd_t) kernel_getattr_proc_files(ossec_syscheckd_t) +#read_sock_files_pattern(ossec_syscheckd_t, tmp_t, tmp_t) +files_dontaudit_getattr_all_sockets(ossec_syscheckd_t) #============= ossec-monitord_t ============== From 39e18d655fdc80048daebe9eb1a5d45ae096cbef Mon Sep 17 00:00:00 2001 From: Eric Renfro Date: Sun, 31 Jul 2016 11:38:56 -0400 Subject: [PATCH 2/2] Finished detailing out the policy for syscheckd for rootcheck and syscheck successfully. --- ossec.te | 47 ++++++++++++++++++++++++++++++----------------- 1 file changed, 30 insertions(+), 17 deletions(-) diff --git a/ossec.te b/ossec.te index 11b8c3b..1f333c3 100644 --- a/ossec.te +++ b/ossec.te @@ -1,5 +1,5 @@ -policy_module(ossec,1.0.258) +policy_module(ossec,1.0.276) ######################################## # @@ -146,6 +146,7 @@ unconfined_domain(ossec_ar_t) require { type httpd_t; + type hi_reserved_port_t; class file { rename read lock create write getattr unlink open append entrypoint }; #class dir { write getattr read remove_name create add_name }; @@ -241,8 +242,12 @@ allow ossec_analysisd_t ossec_var_run_t:file manage_file_perms; ossec_pid_filetrans(ossec_analysisd_t, ossec_var_run_t, file) # queue dir +#allow ossec_analysisd_t ossec_analysisd_file_t:dir { write add_name }; +#allow ossec_analysisd_t ossec_analysisd_file_t:dir { manage_dir_perms }; ossec_queue_filetrans(ossec_analysisd_t, ossec_analysisd_file_t, file) -rw_files_pattern(ossec_analysisd_t, ossec_analysisd_file_t, ossec_analysisd_file_t) +#rw_files_pattern(ossec_analysisd_t, ossec_analysisd_file_t, ossec_analysisd_file_t) +manage_files_pattern(ossec_analysisd_t, ossec_analysisd_file_t, ossec_analysisd_file_t) + ossec_queue_filetrans(ossec_analysisd_t, ossec_analysisd_sock_t, sock_file) manage_sock_files_pattern(ossec_analysisd_t, ossec_queue_t, ossec_analysisd_sock_t) @@ -251,8 +256,9 @@ dgram_send_pattern(ossec_analysisd_t, ossec_queue_t, ossec_execd_sock_t, ossec_e dgram_send_pattern(ossec_analysisd_t, ossec_queue_t, ossec_remoted_sock_t, ossec_remoted_t) # stats dir -append_files_pattern(ossec_analysisd_t, ossec_stats_t, ossec_stats_t) -allow ossec_analysisd_t ossec_stats_t:file read_file_perms; +manage_files_pattern(ossec_analysisd_t, ossec_stats_t, ossec_stats_t) +#append_files_pattern(ossec_analysisd_t, ossec_stats_t, ossec_stats_t) +#allow ossec_analysisd_t ossec_stats_t:file read_file_perms; # logs allow ossec_analysisd_t ossec_log_t:file { create_file_perms append_file_perms read link unlink }; @@ -349,14 +355,9 @@ dgram_send_pattern(ossec_syscheckd_t, ossec_queue_t, ossec_analysisd_sock_t, oss allow ossec_syscheckd_t ossec_queue_t:dir { create_dir_perms rw_dir_perms }; allow ossec_syscheckd_t ossec_queue_t:file { create_file_perms rename_file_perms write_file_perms }; ossec_queue_filetrans(ossec_syscheckd_t, ossec_queue_t, file) -#rw_files_pattern(ossec_syscheckd_t, ossec_queue_t, ossec_queue_t) -#rename_files_pattern(ossec_syscheckd_t, ossec_queue_t, ossec_queue_t) -#create_files_pattern(ossec_syscheckd_t, ossec_queue_t, ossec_queue_t) ossec_tmp_filetrans(ossec_syscheckd_t, ossec_tmp_t, lnk_file) -#manage_files_pattern(ossec_syscheckd_t, ossec_tmp_t, ossec_tmp_t) manage_lnk_files_pattern(ossec_syscheckd_t, ossec_tmp_t, ossec_tmp_t) -#allow ossec_syscheckd_t user_tmp_t:sock_file getattr; userdom_search_user_tmp_dirs(ossec_syscheckd_t) # logs @@ -371,21 +372,33 @@ allow ossec_syscheckd_t self:udp_socket create_socket_perms; allow ossec_syscheckd_t self:tcp_socket create_socket_perms; #allow ossec_syscheckd_t self:udp_socket { create connect read write bind }; #allow ossec_syscheckd_t self:tcp_socket { create connect read write }; +allow ossec_syscheckd_t hi_reserved_port_t:tcp_socket name_bind; +allow ossec_syscheckd_t hi_reserved_port_t:udp_socket name_bind; +corenet_tcp_bind_generic_node(ossec_syscheckd_t) +corenet_udp_bind_generic_node(ossec_syscheckd_t) +corenet_tcp_bind_generic_port(ossec_syscheckd_t) +corenet_udp_bind_generic_port(ossec_syscheckd_t) +corenet_tcp_bind_reserved_port(ossec_syscheckd_t) +corenet_udp_bind_reserved_port(ossec_syscheckd_t) +files_dontaudit_getattr_all_sockets(ossec_syscheckd_t) # exec patterns allow ossec_syscheckd_t shell_exec_t:file { exec_file_perms }; exec_files_pattern(ossec_syscheckd_t, bin_t, bin_t); -# all the things -#allow ossec_syscheckd_t shell_exec_t:file { exec_file_perms }; -#allow ossec_syscheckd_t bin_t:file { exec_file_perms }; -#allow ossec_syscheckd_t bin_t:file { execute execute_no_trans }; +# all the files files_read_all_files(ossec_syscheckd_t) files_read_all_symlinks(ossec_syscheckd_t) seutil_read_bin_policy(ossec_syscheckd_t) -kernel_getattr_proc_files(ossec_syscheckd_t) -#read_sock_files_pattern(ossec_syscheckd_t, tmp_t, tmp_t) -files_dontaudit_getattr_all_sockets(ossec_syscheckd_t) +dev_getattr_all(ossec_syscheckd_t) + +# all the ports +allow ossec_syscheckd_t self:capability kill; +domain_read_all_domains_state(ossec_syscheckd_t) +domain_dontaudit_getsession_all_domains(ossec_syscheckd_t) +domain_getsession_all_domains(ossec_syscheckd_t) +domain_getpgid_all_domains(ossec_syscheckd_t) +domain_dontaudit_signull_all_domains(ossec_syscheckd_t) #============= ossec-monitord_t ============== @@ -409,7 +422,7 @@ list_dirs_pattern(ossec_monitord_t, ossec_queue_t, ossec_remoted_file_t) allow ossec_monitord_t ossec_remoted_file_t:file getattr_file_perms; # logs -allow ossec_monitord_t ossec_log_t:file { create_file_perms append_file_perms read }; +allow ossec_monitord_t ossec_log_t:file { create_file_perms append_file_perms write read }; ossec_log_filetrans(ossec_monitord_t, ossec_log_t, file) # dgram socket