diff --git a/ossec.te b/ossec.te index 3ddce79..119b90a 100644 --- a/ossec.te +++ b/ossec.te @@ -1,5 +1,5 @@ -policy_module(ossec,1.0.157) +policy_module(ossec,1.0.161) ######################################## # @@ -8,6 +8,7 @@ policy_module(ossec,1.0.157) type ossec_t; type ossec_bin_t; +files_type(ossec_bin_t) type ossec_maild_t; type ossec_maild_exec_t; @@ -83,16 +84,27 @@ files_type(ossec_stats_t) type ossec_queue_t; files_type(ossec_queue_t) +#type ossec_ar_t; +#files_type(ossec_ar_t); + +#type ossec_ar_bin_t; +#files_type(ossec_ar_bin_t); + +#type ossec_ar_exec_t; +#files_type(ossec_ar_exec_t); + + type ossec_script_t; type ossec_script_exec_t; files_type(ossec_script_t) -role system_r types ossec_script_t; domain_type(ossec_script_t) domain_entry_file(ossec_script_t, ossec_script_exec_t) +domtrans_pattern(ossec_execd_t, ossec_script_exec_t, ossec_script_t) +role system_r types ossec_script_t; unconfined_domain(ossec_script_t) #unconfined_run(ossec_script_exec_t, ossec_script_t) -type_transition ossec_execd_t ossec_script_exec_t:process unconfined_t; +#type_transition ossec_execd_t ossec_script_exec_t:process unconfined_t; #files_type(ossec_script_exec_t) #domain_type(ossec_script_exec_t) @@ -245,11 +257,12 @@ allow ossec_execd_t self:unix_dgram_socket { create bind getopt read write }; dev_read_urand(ossec_execd_t) # Run autoresponce unconstrained -allow ossec_execd_t unconfined_t:process { transition rlimitinh siginh noatsecure }; -allow unconfined_t ossec_script_exec_t:file { entrypoint }; +allow ossec_execd_t ossec_script_t:process { rlimitinh siginh noatsecure }; +#allow ossec_execd_t unconfined_t:process { transition rlimitinh siginh noatsecure }; +#allow unconfined_t ossec_script_exec_t:file { entrypoint }; -#unconfined_domtrans(ossec_script_t) -#unconfined_run(ossec_execd_t, ossec_script_t) +##unconfined_domtrans(ossec_script_t) +##unconfined_run(ossec_execd_t, ossec_script_t) #============= ossec_analysisd_t ============== @@ -442,7 +455,7 @@ allow ossec_syscheckd_t self:unix_dgram_socket { create bind getopt connect writ allow ossec_syscheckd_t ossec_analysisd_t:unix_dgram_socket { sendto }; # Sockets -allow ossec_syscheckd_t self:udp_socket { create connect read write }; +allow ossec_syscheckd_t self:udp_socket { create connect read write bind }; allow ossec_syscheckd_t self:tcp_socket { create connect read write }; #allow ossec_d_t smtp_port_t:tcp_socket { name_connect }; @@ -492,6 +505,7 @@ allow ossec_monitord_t ossec_analysisd_t:unix_dgram_socket { sendto }; #============= httpd_t ============== + allow httpd_t ossec_log_t:dir { read }; allow httpd_t ossec_log_t:file { open read getattr }; @@ -501,5 +515,3 @@ allow httpd_t ossec_queue_t:file { open read getattr }; allow httpd_t ossec_stats_t:dir { read }; allow httpd_t ossec_stats_t:file { open read getattr }; - -