Linux-Help/selinux-ossec
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Updated unconfined method to solid defined method, thanks to grift

Browse source
This commit is contained in:
Eric Renfro 2015-11-23 10:28:49 -05:00
parent f8e58c8491
commit edf4a3bc73
1 changed files with 22 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

32
ossec.te
View file

@ -1,5 +1,5 @@
policy_module(ossec,1.0.157) policy_module(ossec,1.0.161)
######################################## ########################################
# #
@ -8,6 +8,7 @@ policy_module(ossec,1.0.157)
type ossec_t; type ossec_t;
type ossec_bin_t; type ossec_bin_t;
files_type(ossec_bin_t)
type ossec_maild_t; type ossec_maild_t;
type ossec_maild_exec_t; type ossec_maild_exec_t;
@ -83,16 +84,27 @@ files_type(ossec_stats_t)
type ossec_queue_t; type ossec_queue_t;
files_type(ossec_queue_t) files_type(ossec_queue_t)
#type ossec_ar_t;
#files_type(ossec_ar_t);
#type ossec_ar_bin_t;
#files_type(ossec_ar_bin_t);
#type ossec_ar_exec_t;
#files_type(ossec_ar_exec_t);
type ossec_script_t; type ossec_script_t;
type ossec_script_exec_t; type ossec_script_exec_t;
files_type(ossec_script_t) files_type(ossec_script_t)
role system_r types ossec_script_t;
domain_type(ossec_script_t) domain_type(ossec_script_t)
domain_entry_file(ossec_script_t, ossec_script_exec_t) domain_entry_file(ossec_script_t, ossec_script_exec_t)
domtrans_pattern(ossec_execd_t, ossec_script_exec_t, ossec_script_t)
role system_r types ossec_script_t;
unconfined_domain(ossec_script_t) unconfined_domain(ossec_script_t)
#unconfined_run(ossec_script_exec_t, ossec_script_t) #unconfined_run(ossec_script_exec_t, ossec_script_t)
type_transition ossec_execd_t ossec_script_exec_t:process unconfined_t; #type_transition ossec_execd_t ossec_script_exec_t:process unconfined_t;
#files_type(ossec_script_exec_t) #files_type(ossec_script_exec_t)
#domain_type(ossec_script_exec_t) #domain_type(ossec_script_exec_t)
@ -245,11 +257,12 @@ allow ossec_execd_t self:unix_dgram_socket { create bind getopt read write };
dev_read_urand(ossec_execd_t) dev_read_urand(ossec_execd_t)
# Run autoresponce unconstrained # Run autoresponce unconstrained
allow ossec_execd_t unconfined_t:process { transition rlimitinh siginh noatsecure }; allow ossec_execd_t ossec_script_t:process { rlimitinh siginh noatsecure };
allow unconfined_t ossec_script_exec_t:file { entrypoint }; #allow ossec_execd_t unconfined_t:process { transition rlimitinh siginh noatsecure };
#allow unconfined_t ossec_script_exec_t:file { entrypoint };
#unconfined_domtrans(ossec_script_t) ##unconfined_domtrans(ossec_script_t)
#unconfined_run(ossec_execd_t, ossec_script_t) ##unconfined_run(ossec_execd_t, ossec_script_t)
#============= ossec_analysisd_t ============== #============= ossec_analysisd_t ==============
@ -442,7 +455,7 @@ allow ossec_syscheckd_t self:unix_dgram_socket { create bind getopt connect writ
allow ossec_syscheckd_t ossec_analysisd_t:unix_dgram_socket { sendto }; allow ossec_syscheckd_t ossec_analysisd_t:unix_dgram_socket { sendto };
# Sockets # Sockets
allow ossec_syscheckd_t self:udp_socket { create connect read write }; allow ossec_syscheckd_t self:udp_socket { create connect read write bind };
allow ossec_syscheckd_t self:tcp_socket { create connect read write }; allow ossec_syscheckd_t self:tcp_socket { create connect read write };
#allow ossec_d_t smtp_port_t:tcp_socket { name_connect }; #allow ossec_d_t smtp_port_t:tcp_socket { name_connect };
@ -492,6 +505,7 @@ allow ossec_monitord_t ossec_analysisd_t:unix_dgram_socket { sendto };
#============= httpd_t ============== #============= httpd_t ==============
allow httpd_t ossec_log_t:dir { read }; allow httpd_t ossec_log_t:dir { read };
allow httpd_t ossec_log_t:file { open read getattr }; allow httpd_t ossec_log_t:file { open read getattr };
@ -501,5 +515,3 @@ allow httpd_t ossec_queue_t:file { open read getattr };
allow httpd_t ossec_stats_t:dir { read }; allow httpd_t ossec_stats_t:dir { read };
allow httpd_t ossec_stats_t:file { open read getattr }; allow httpd_t ossec_stats_t:file { open read getattr };