Progress up to mostly functional. Problems with clients connecting, and syscheckd

.gitignore

@@ -1,4 +1,4 @@
 Makefile
 tmp
 *.pp
-.*.swp
+

ossec.fc

@@ -8,53 +8,32 @@
 #/var/log/mlogc/data(/.*)?               gen_context(system_u:object_r:mlogc_log_t,s0)
 
 /var/ossec/logs(/.*)?                     gen_context(system_u:object_r:ossec_log_t,s0)
-/var/ossec/stats(/.*)?                    gen_context(system_u:object_r:ossec_stats_t,s0)
-/var/ossec/agentless(/.*)?                gen_context(system_u:object_r:ossec_var_t,s0)
-
 /var/ossec/queue(/.*)?                    gen_context(system_u:object_r:ossec_queue_t,s0)
-/var/ossec/queue/rids(/.*)?               gen_context(system_u:object_r:ossec_remoted_file_t,s0)
+/var/ossec/stats(/.*)?                    gen_context(system_u:object_r:ossec_stats_t,s0)
-/var/ossec/queue/agent-info(/.*)?         gen_context(system_u:object_r:ossec_remoted_file_t,s0)
-/var/ossec/queue/fts(/.*)?                gen_context(system_u:object_r:ossec_analysisd_file_t,s0)
-/var/ossec/queue/syscheck(/.*)?           gen_context(system_u:object_r:ossec_analysisd_file_t,s0)
-/var/ossec/queue/rootcheck(/.*)?          gen_context(system_u:object_r:ossec_analysisd_file_t,s0)
-/var/ossec/queue/alerts/execq          -s gen_context(system_u:object_r:ossec_execd_sock_t,s0)
-/var/ossec/queue/alerts/ar             -s gen_context(system_u:object_r:ossec_remoted_sock_t,s0)
-/var/ossec/queue/ossec/queue           -s gen_context(system_u:object_r:ossec_analysisd_sock_t,s0)
-#/var/ossec/queue/fts/hostinfo          -- gen_context(system_u:object_r:ossec_analysisd_file_t,s0)
-#/var/ossec/queue/fts/fts-queue         -- gen_context(system_u:object_r:ossec_analysisd_file_t,s0)
-#/var/ossec/queue/fts/ig-queue          -- gen_context(system_u:object_r:ossec_analysisd_file_t,s0)
-
-/var/ossec/var/run(/.*)?                  gen_context(system_u:object_r:ossec_var_run_t,s0)
-/var/ossec/var/execd\.sqlite           -- gen_context(system_u:object_r:ossec_execd_file_t,s0)
-/var/ossec/var/execd\.sqlite-journal   -- gen_context(system_u:object_r:ossec_execd_journal_t,s0)
-#/var/ossec/var/execd\.sqlite(-.*)?     -- gen_context(system_u:object_r:ossec_execd_file_t,s0)
 /var/ossec/var(/.*)?                      gen_context(system_u:object_r:ossec_var_t,s0)
+/var/ossec/agentless(/.*)?                gen_context(system_u:object_r:ossec_var_t,s0)
 
 /var/ossec/tmp(/.*)?                      gen_context(system_u:object_r:ossec_tmp_t,s0)
 
 /var/ossec/etc(/.*)?                      gen_context(system_u:object_r:ossec_etc_t,s0)
-/var/ossec/etc/shared/ar\.conf         -- gen_context(system_u:object_r:ossec_analysisd_configfile_t,s0)
+/var/ossec/etc/shared(/.*)?               gen_context(system_u:object_r:ossec_etc_share_t,s0)
-/var/ossec/etc/shared/merged\.mg       -- gen_context(system_u:object_r:ossec_remoted_configfile_t,s0)
-#/var/ossec/etc/shared(/.*)?               gen_context(system_u:object_r:ossec_etc_share_t,s0)
 /var/ossec/rules(/.*)?                    gen_context(system_u:object_r:ossec_rule_t,s0)
 
-#/var/ossec/active-response/bin(/.*)? --   gen_context(system_u:object_r:ossec_script_exec_t,s0)
+/var/ossec/active-response(/.*)?          gen_context(system_u:object_r:ossec_script_t,s0)
-#/var/ossec/active-response(/.*)?          gen_context(system_u:object_r:ossec_script_t,s0)
-/var/ossec/active-response/bin(/.*)? --   gen_context(system_u:object_r:ossec_ar_exec_t,s0)
-/var/ossec/active-response(/.*)?          gen_context(system_u:object_r:ossec_ar_bin_t,s0)
 
 /etc/init.d/ossec-hids           --       gen_context(system_u:object_r:ossec_initrc_exec_t,s0)
-/var/ossec/bin/ossec-control     --       gen_context(system_u:object_r:ossec_initrc_exec_t,s0)
+/var/ossec/bin/ossec-control     --       gen_context(system_u:object_r:ossec_exec_t,s0)
+#/var/ossec/bin/ossec-server.sh   --       gen_context(system_u:object_r:ossec_exec_t,s0)
 /var/ossec/bin/ossec-server.sh   --       gen_context(system_u:object_r:ossec_initrc_exec_t,s0)
-/var/ossec/bin/ossec-maild       --       gen_context(system_u:object_r:ossec_maild_exec_t,s0)
+/var/ossec/bin/ossec-maild                gen_context(system_u:object_r:ossec_exec_t,s0)
-/var/ossec/bin/ossec-execd       --       gen_context(system_u:object_r:ossec_execd_exec_t,s0)
+/var/ossec/bin/ossec-execd                gen_context(system_u:object_r:ossec_exec_t,s0)
-/var/ossec/bin/ossec-analysisd   --       gen_context(system_u:object_r:ossec_analysisd_exec_t,s0)
+/var/ossec/bin/ossec-analysisd            gen_context(system_u:object_r:ossec_exec_t,s0)
-/var/ossec/bin/ossec-logcollector --      gen_context(system_u:object_r:ossec_logcollector_exec_t,s0)
+/var/ossec/bin/ossec-logcollector         gen_context(system_u:object_r:ossec_exec_t,s0)
-/var/ossec/bin/ossec-remoted     --       gen_context(system_u:object_r:ossec_remoted_exec_t,s0)
+/var/ossec/bin/ossec-remoted              gen_context(system_u:object_r:ossec_exec_t,s0)
-/var/ossec/bin/ossec-syscheckd   --       gen_context(system_u:object_r:ossec_syscheckd_exec_t,s0)
+/var/ossec/bin/ossec-syscheckd            gen_context(system_u:object_r:ossec_exec_t,s0)
-/var/ossec/bin/ossec-monitord    --       gen_context(system_u:object_r:ossec_monitord_exec_t,s0)
+/var/ossec/bin/ossec-monitord             gen_context(system_u:object_r:ossec_exec_t,s0)
-/var/ossec/bin/ossec-dbd         --       gen_context(system_u:object_r:ossec_dbd_exec_t,s0)
+/var/ossec/bin/ossec-dbd                  gen_context(system_u:object_r:ossec_exec_t,s0)
-/var/ossec/bin/ossec-csyslogd    --       gen_context(system_u:object_r:ossec_csyslogd_exec_t,s0)
+/var/ossec/bin/ossec-csyslogd             gen_context(system_u:object_r:ossec_exec_t,s0)
-/var/ossec/bin/ossec-agentlessd  --       gen_context(system_u:object_r:ossec_agentlessd_exec_t,s0)
+/var/ossec/bin/ossec-agentlessd           gen_context(system_u:object_r:ossec_exec_t,s0)
 /var/ossec/bin(/.*)?                      gen_context(system_u:object_r:bin_t,s0)
 

ossec.if

@@ -52,18 +52,13 @@ interface(`ossec_domtrans',`
 ##      </summary>
 ## </param>
 #
-interface(`ossec_read_logs',`
+interface(`ossec_read_log',`
         gen_require(`
-                type var_t;
                 type ossec_log_t;
         ')
 
-        allow $1 var_t:dir search_dir_perms;
+        logging_search_logs($1)
-        #read_files_pattern($1, ossec_log_t, ossec_log_t)
+        allow $1 ossec_log_t:file read_file_perms;
-        read_files_pattern($1, ossec_log_t, logfile)
-        #allow $1 ossec_log_t:dir search_dir_perms
-        #logging_search_logs($1)
-        #allow $1 ossec_log_t:file read_file_perms;
 ')
 
 ########################################
@@ -76,187 +71,22 @@ interface(`ossec_read_logs',`
 ##      </summary>
 ## </param>
 #
-#interface(`ossec_write_log',`
+interface(`ossec_write_log',`
-#        gen_require(`
-#                type ossec_log_t;
-#        ')
-#
-#        allow $1 ossec_log_t:file write;
-#')
-
-
-interface(`ossec_read_config',`
         gen_require(`
-        type var_t;
+                type ossec_log_t;
-		type ossec_etc_t;
         ')
 
-    allow $1 var_t:dir search_dir_perms;
+        allow $1 ossec_log_t:file write;
-    #allow $1 ossec_etc_t:dir search_dir_perms;
-	read_lnk_files_pattern($1, ossec_etc_t, configfile)
-    files_read_config_files($1, ossec_etc_t)
 ')
 
-#interface(`ossec_read_shared_config',`
-#	gen_require(`
-#        type var_t;
-#		type ossec_etc_t;
-#		#type ossec_etc_share_t;
-#	')
-#
-#	allow $1 var_t:dir search_dir_perms;
-#    allow $1 ossec_etc_t:dir search_dir_perms;
-#    #allow $1 ossec_etc_share_t:dir search_dir_perms;
-#    allow $1 ossec_etc_share_t:file read_file_perms;
-#    #allow $1 ossec_analysisd_file_t:file read_file_perms;
-#	#search_dirs_pattern($1, ossec_etc_t, ossec_etc_t)
-#	#search_dirs_pattern($1, ossec_etc_share_t, ossec_etc_share_t)
-#	#read_files_pattern($1, ossec_etc_share_t, ossec_etc_share_t)
-#')
 
-#interface(`ossec_manage_shared_config',`
-#	gen_require(`
-#		type ossec_etc_t;
-#		type ossec_etc_share_t;
-#	')
-#
-#	search_dirs_pattern($1, ossec_etc_t, ossec_etc_t)
-#	search_dirs_pattern($1, ossec_etc_share_t, ossec_etc_share_t)
-#	manage_files_pattern($1, ossec_etc_share_t, ossec_etc_share_t)
-#')
-
-interface(`ossec_pid_filetrans',`
-	gen_require(`
-        type var_t;
-		type ossec_var_t, ossec_var_run_t;
-	')
-
-    allow $1 var_t:dir search_dir_perms;
-	allow $1 ossec_var_t:dir search_dir_perms;
-	allow $1 ossec_var_run_t:lnk_file read_lnk_file_perms;
-	filetrans_pattern($1, ossec_var_run_t, $2, $3, $4)
-')
 
 interface(`ossec_log_filetrans',`
         gen_require(`
-        type var_t;
+                type ossec_log_t;
-		type ossec_var_t, ossec_log_t;
         ')
 
 	allow $1 var_t:dir search_dir_perms;
-	allow $1 ossec_log_t:dir search_dir_perms;
         filetrans_pattern($1, ossec_log_t, $2, $3, $4)
 ')
 
-interface(`ossec_read_stats',`
-    gen_require(`
-        type var_t;
-        type ossec_stats_t;
-    ')
-
-    allow $1 var_t:dir search_dir_perms;
-    read_files_pattern($1, ossec_stats_t, ossec_stats_t)
-')
-
-interface(`ossec_manage_stats',`
-    gen_require(`
-        type var_t;
-        type ossec_stats_t;
-    ')
-
-    allow $1 var_t:dir search_dir_perms;
-    append_files_pattern($1, ossec_stats_t, ossec_stats_t)
-')
-
-interface(`ossec_read_queue',`
-    gen_require(`
-        type var_t;
-        type ossec_queue_t;
-    ')
-
-    allow $1 var_t:dir search_dir_perms;
-    allow $1 ossec_queue_t:dir list_dir_perms;
-    allow $1 ossec_queue_t:file read_file_perms;
-    allow $1 ossec_remoted_file_t:dir list_dir_perms;
-    allow $1 ossec_remoted_file_t:file read_file_perms;
-    allow $1 ossec_analysisd_file_t:dir list_dir_perms;
-    allow $1 ossec_analysisd_file_t:file read_file_perms;
-    #read_files_pattern($1, ossec_queue_t, ossec_queue_t)
-')
-
-########################################
-## <summary>
-##      Create objects in the spool directory
-##      with a private type with a type transition.
-## </summary>
-## <param name="domain">
-##      <summary>
-##      Domain allowed access.
-##      </summary>
-## </param>
-## <param name="file">
-##      <summary>
-##      Type to which the created node will be transitioned.
-##      </summary>
-## </param>
-## <param name="class">
-##      <summary>
-##      Object class(es) (single or set including {}) for which this
-##      the transition will occur.
-##      </summary>
-## </param>
-## <param name="name" optional="true">
-##      <summary>
-##      The name of the object being created.
-##      </summary>
-## </param>
-#
-interface(`ossec_queue_filetrans',`
-    gen_require(`
-        type var_t;
-        type ossec_queue_t;
-    ')
-
-    allow $1 var_t:dir search_dir_perms;
-    allow $1 ossec_queue_t:dir search_dir_perms;
-    filetrans_pattern($1, ossec_queue_t, $2, $3, $4)
-')
-
-########################################
-## <summary>
-##      Create objects in the tmp directory
-##      with a private type with a type transition.
-## </summary>
-## <param name="domain">
-##      <summary>
-##      Domain allowed access.
-##      </summary>
-## </param>
-## <param name="file">
-##      <summary>
-##      Type to which the created node will be transitioned.
-##      </summary>
-## </param>
-## <param name="class">
-##      <summary>
-##      Object class(es) (single or set including {}) for which this
-##      the transition will occur.
-##      </summary>
-## </param>
-## <param name="name" optional="true">
-##      <summary>
-##      The name of the object being created.
-##      </summary>
-## </param>
-#
-interface(`ossec_tmp_filetrans',`
-    gen_require(`
-        type var_t;
-        type ossec_tmp_t;
-    ')
-
-    allow $1 var_t:dir search_dir_perms;
-    allow $1 ossec_tmp_t:dir search_dir_perms;
-    filetrans_pattern($1, ossec_tmp_t, $2, $3, $4)
-')
-

ossec.te

@@ -1,155 +1,91 @@
 
-policy_module(ossec,1.1.0)
+policy_module(ossec,1.0.45)
 
 ########################################
 #
 # Declarations
 #
 
-###
+type ossec_t;
-# Active-Response Domain and File Types
+type ossec_bin_t;
-type ossec_ar_t;
+type ossec_exec_t;
-type ossec_ar_exec_t;
+#role system_r types ossec_t;
-domain_type(ossec_ar_t)
+#domain_type(ossec_t)
-domain_entry_file(ossec_ar_t, ossec_ar_exec_t)
+#domain_entry_file(ossec_t, ossec_exec_t)
-domtrans_pattern(ossec_execd_t, ossec_ar_exec_t, ossec_ar_t)
+init_daemon_domain(ossec_t, ossec_exec_t)
-role system_r types ossec_ar_t;
-files_type(ossec_ar_exec_t);
 
-type ossec_ar_bin_t;
+optional_policy(`
-files_type(ossec_ar_bin_t);
+        ossec_domtrans(httpd_t)
+')
 
-unconfined_domain(ossec_ar_t)
-###
-
-# ossec-agentlessd daemon
-type ossec_agentlessd_t;
-type ossec_agentlessd_exec_t;
-init_daemon_domain(ossec_agentlessd_t, ossec_agentlessd_exec_t)
-
-# ossec-analysisd daemon
-type ossec_analysisd_t;
-type ossec_analysisd_exec_t;
-init_daemon_domain(ossec_analysisd_t, ossec_analysisd_exec_t)
-
-type ossec_analysisd_configfile_t;
-files_config_file(ossec_analysisd_configfile_t)
-
-type ossec_analysisd_file_t;
-files_type(ossec_analysisd_file_t)
-
-type ossec_analysisd_sock_t;
-files_type(ossec_analysisd_sock_t)
-
-# ossec-csyslogd daemon
-type ossec_csyslogd_t;
-type ossec_csyslogd_exec_t;
-init_daemon_domain(ossec_csyslogd_t, ossec_csyslogd_exec_t)
-
-# ossec-dbd daemon
-type ossec_dbd_t;
-type ossec_dbd_exec_t;
-init_daemon_domain(ossec_dbd_t, ossec_dbd_exec_t)
-
-# ossec etc dir
-type ossec_etc_t;
-files_config_file(ossec_etc_t)
-
-# ossec-execd daemon
-type ossec_execd_t;
-type ossec_execd_exec_t;
-init_daemon_domain(ossec_execd_t, ossec_execd_exec_t)
-
-type ossec_execd_file_t;
-files_type(ossec_execd_file_t)
-
-type ossec_execd_journal_t;
-files_type(ossec_execd_journal_t)
-
-type ossec_execd_sock_t;
-files_type(ossec_execd_sock_t)
-
-# ossec_initrc
 type ossec_initrc_exec_t;
 init_script_file(ossec_initrc_exec_t)
 
-# ossec-logcollector daemon
-type ossec_logcollector_t;
-type ossec_logcollector_exec_t;
-init_daemon_domain(ossec_logcollector_t, ossec_logcollector_exec_t)
-
-# ossec logs dir
-type ossec_log_t;
-logging_log_file(ossec_log_t)
-
-# ossec-maild daemon
-type ossec_maild_t;
-type ossec_maild_exec_t;
-init_daemon_domain(ossec_maild_t, ossec_maild_exec_t)
-
-# ossec-monitord daemon
-type ossec_monitord_t;
-type ossec_monitord_exec_t;
-init_daemon_domain(ossec_monitord_t, ossec_monitord_exec_t)
-
-# ossec-remoted daemon
-type ossec_remoted_t;
-type ossec_remoted_exec_t;
-init_daemon_domain(ossec_remoted_t, ossec_remoted_exec_t)
-
-type ossec_remoted_configfile_t;
-files_config_file(ossec_remoted_configfile_t);
-
-type ossec_remoted_file_t;
-files_type(ossec_remoted_file_t)
-
-type ossec_remoted_sock_t;
-files_type(ossec_remoted_sock_t)
-
-# ossec-syscheckd daemon
-type ossec_syscheckd_t;
-type ossec_syscheckd_exec_t;
-init_daemon_domain(ossec_syscheckd_t, ossec_syscheckd_exec_t)
-
-
-# ossec bin dir
-type ossec_bin_t;
-files_type(ossec_bin_t)
-
-# ossec queue dir
-type ossec_queue_t;
-files_type(ossec_queue_t)
-
-# ossec rules dir
-type ossec_rule_t;
-files_config_file(ossec_rule_t)
-
-# ossec stats dir
-type ossec_stats_t;
-files_type(ossec_stats_t)
-
-# ossec tmp dir
-type ossec_tmp_t;
-files_tmp_file(ossec_tmp_t)
-
-# ossec var run dir
 type ossec_var_t;
 files_type(ossec_var_t)
 
 type ossec_var_run_t;
 files_pid_file(ossec_var_run_t)
 
+type ossec_tmp_t;
+files_tmp_file(ossec_tmp_t)
+
+type ossec_log_t;
+logging_log_file(ossec_log_t)
+
+type ossec_etc_t;
+files_config_file(ossec_etc_t)
+
+type ossec_etc_share_t;
+files_config_file(ossec_etc_share_t)
+
+type ossec_rule_t;
+files_config_file(ossec_rule_t)
+
+type ossec_stats_t;
+files_type(ossec_stats_t)
+
+type ossec_queue_t;
+files_type(ossec_queue_t)
+
+type ossec_script_t;
+files_type(ossec_script_t)
+
+type ossec_port_t;
+corenet_port(ossec_port_t)
+#create_port_type_interfaces(ossec_port_t, tcp,1514,s0, udp,1514,s0)
+#create_packet_interfaces($1_client)
+#create_packet_interfaces($1_server)
+#network_port(ossec_port_t, tcp,1514,s0)
+#network_port(ossec, tcp,1514,s0, udp,1514,s0)
 
 require {
+	type ossec_t;
+	type ossec_initrc_exec_t;
+	type ossec_var_run_t;
+	type ossec_bin_t;
+	type ossec_exec_t;
+	type ossec_var_t;
+	type ossec_tmp_t;
+	type ossec_log_t;
+	type ossec_etc_t;
+	type ossec_etc_share_t;
+	type ossec_rule_t;
+	type ossec_stats_t;
+	type ossec_queue_t;
+	type ossec_script_t;
+	type ossec_port_t;
 	type httpd_t;
-	type hi_reserved_port_t;
+	type initrc_t;
-
+	type node_t;
-	class file { rename read lock create write getattr unlink open append entrypoint };
+	class file { rename read lock create write getattr unlink open append };
-	#class dir { write getattr read remove_name create add_name };
+	class dir { write getattr read remove_name create add_name };
-	class process { setsched transition rlimitinh siginh noatsecure };
 	class capability { dac_override dac_read_search setuid setgid fsetid sys_chroot sys_nice };
 	class tcp_socket { create name_bind name_connect };
 	class udp_socket { create bind name_bind node_bind };
+	class unix_dgram_socket { create bind getopt connect sendto };
+	class sock_file { unlink };
+	class process { setsched };
 }
 
 
@@ -159,164 +95,82 @@ require {
 #
 
 
-allow ossec_analysisd_t ossec_log_t:file { create_file_perms append_file_perms read link unlink };
+#============= ossec_t ==============
-allow ossec_analysisd_t ossec_var_run_t:file manage_file_perms;
+auth_read_passwd(ossec_t)
-allow ossec_analysisd_t self:capability { dac_override dac_read_search fsetid setuid setgid sys_chroot };
-allow ossec_analysisd_t self:unix_dgram_socket create_stream_socket_perms;
 
-allow ossec_execd_t ossec_ar_t:process { rlimitinh siginh noatsecure };
+# Read /proc/meminfo
-allow ossec_execd_t ossec_execd_file_t:file { create_file_perms rw_file_perms };
+kernel_read_system_state(ossec_t)
-allow ossec_execd_t ossec_execd_journal_t:file manage_file_perms;
-allow ossec_execd_t ossec_log_t:file { create_file_perms append_file_perms read };
-allow ossec_execd_t ossec_var_run_t:file manage_file_perms;
-allow ossec_execd_t self:capability { dac_override dac_read_search setgid };
-allow ossec_execd_t self:unix_dgram_socket create_stream_socket_perms;
 
-allow ossec_logcollector_t ossec_log_t:file { create_file_perms append_file_perms read };
+# Read urandom
-allow ossec_logcollector_t ossec_var_run_t:file manage_file_perms;
+dev_read_urand(ossec_t)
-allow ossec_logcollector_t self:capability { dac_override dac_read_search };
-allow ossec_logcollector_t self:unix_dgram_socket create_socket_perms;
 
-allow ossec_maild_t ossec_log_t:file { create_file_perms append_file_perms read };
+# init
-allow ossec_maild_t ossec_var_run_t:file manage_file_perms;
+allow ossec_t self:capability { dac_override dac_read_search setuid setgid fsetid sys_chroot sys_nice };
-allow ossec_maild_t self:capability { dac_override dac_read_search setuid setgid sys_chroot };
+allow ossec_t self:process { setsched };
-allow ossec_maild_t self:tcp_socket create_socket_perms;
 
-allow ossec_monitord_t ossec_log_t:file { create_file_perms append_file_perms write read };
+# etc dir
-allow ossec_monitord_t ossec_remoted_file_t:file getattr_file_perms;
+#files_read_etc_files(ossec_t)
-allow ossec_monitord_t ossec_var_run_t:file manage_file_perms;
+sysnet_read_config(ossec_t)
-allow ossec_monitord_t self:capability { dac_override dac_read_search setuid setgid sys_chroot };
-allow ossec_monitord_t self:unix_dgram_socket create_socket_perms;
 
-allow ossec_remoted_t ossec_log_t:file { create_file_perms append_file_perms read };
+# var dir
-allow ossec_remoted_t ossec_var_run_t:file manage_file_perms;
+rw_dirs_pattern(ossec_t, ossec_var_t, ossec_var_t)
-allow ossec_remoted_t self:capability { dac_override dac_read_search setuid setgid sys_chroot };
+#rw_files_pattern(ossec_t, ossec_var_t, ossec_var_t)
-allow ossec_remoted_t self:udp_socket create_stream_socket_perms;
+#create_files_pattern(ossec_t, ossec_var_t, ossec_var_t)
-allow ossec_remoted_t self:unix_dgram_socket create_stream_socket_perms;
+manage_files_pattern(ossec_t, ossec_var_t, ossec_var_t)
+manage_sock_files_pattern(ossec_t, ossec_var_t, ossec_var_t)
 
-allow ossec_syscheckd_t hi_reserved_port_t:tcp_socket name_bind;
+# queue dir
-allow ossec_syscheckd_t hi_reserved_port_t:udp_socket name_bind;
+rw_dirs_pattern(ossec_t, ossec_queue_t, ossec_queue_t)
-allow ossec_syscheckd_t ossec_log_t:file { create_file_perms append_file_perms read };
+rw_files_pattern(ossec_t, ossec_queue_t, ossec_queue_t)
-allow ossec_syscheckd_t ossec_queue_t:dir { create_dir_perms rw_dir_perms };
+manage_sock_files_pattern(ossec_t, ossec_queue_t, ossec_queue_t)
-allow ossec_syscheckd_t ossec_queue_t:file { create_file_perms rename_file_perms write_file_perms };
+
-allow ossec_syscheckd_t ossec_var_run_t:file manage_file_perms;
+# stats dir
-allow ossec_syscheckd_t self:capability { dac_override dac_read_search kill setuid setgid sys_chroot sys_nice };
+rw_dirs_pattern(ossec_t, ossec_stats_t, ossec_stats_t)
-allow ossec_syscheckd_t self:process { setsched };
+rw_files_pattern(ossec_t, ossec_stats_t, ossec_stats_t)
-allow ossec_syscheckd_t self:tcp_socket create_socket_perms;
+
-allow ossec_syscheckd_t self:udp_socket create_socket_perms;
+# rules dir
-allow ossec_syscheckd_t self:unix_dgram_socket create_socket_perms;
+read_files_pattern(ossec_t, ossec_rule_t, ossec_rule_t)
+
+# logs
+#logging_log_filetrans(ossec_t, ossec_log_t, file)
+#create_files_pattern(ossec_t, ossec_log_t, ossec_log_t)
+#read_files_pattern(ossec_t, ossec_log_t, ossec_log_t)
+#append_files_pattern(ossec_t, ossec_log_t, ossec_log_t)
+#delete_files_pattern(ossec_t, ossec_log_t, ossec_log_t)
+manage_files_pattern(ossec_t, ossec_log_t, ossec_log_t)
+ossec_log_filetrans(ossec_t, ossec_log_t, file)
+
+# system logs
+logging_read_all_logs(ossec_t)
 
 
-auth_read_passwd(ossec_analysisd_t)
+# Allow reading ossec config
-auth_read_passwd(ossec_execd_t)
+allow ossec_t ossec_etc_t:dir list_dir_perms;
-auth_read_passwd(ossec_maild_t)
+read_files_pattern(ossec_t, ossec_etc_t, ossec_etc_t)
-auth_read_passwd(ossec_monitord_t)
+read_lnk_files_pattern(ossec_t, ossec_etc_t, ossec_etc_t)
-auth_read_passwd(ossec_remoted_t)
 
-corecmd_exec_bin(ossec_syscheckd_t)
+# Allow rw etc/shared
-corecmd_exec_shell(ossec_execd_t)
+rw_dirs_pattern(ossec_t, ossec_etc_share_t, ossec_etc_share_t);
-corecmd_exec_shell(ossec_syscheckd_t)
+manage_files_pattern(ossec_t, ossec_etc_share_t, ossec_etc_share_t);
 
-corenet_tcp_bind_generic_node(ossec_syscheckd_t)
+# Sockets
-corenet_tcp_bind_generic_port(ossec_syscheckd_t)
+allow ossec_t self:udp_socket { create bind node_bind };
-corenet_tcp_bind_reserved_port(ossec_syscheckd_t)
+allow ossec_t node_t:udp_socket { node_bind };
-corenet_tcp_connect_smtp_port(ossec_maild_t)
+allow ossec_t ossec_port_t:udp_socket { create_socket_perms create name_bind };
+#allow ossec_t self:udp_socket { create_socket_perms name_bind };
+#allow ossec_t self:udp_socket name_bind;
 
-corenet_udp_bind_all_unreserved_ports(ossec_remoted_t)
+allow ossec_t self:unix_dgram_socket { create bind getopt connect sendto };
-corenet_udp_bind_generic_node(ossec_remoted_t)
-corenet_udp_bind_generic_node(ossec_syscheckd_t)
-corenet_udp_bind_generic_port(ossec_syscheckd_t)
-corenet_udp_bind_reserved_port(ossec_syscheckd_t)
 
-dev_getattr_all(ossec_syscheckd_t)
+#============= httpd_t ==============
-dev_read_urand(ossec_execd_t)
+allow httpd_t ossec_log_t:dir { read };
+allow httpd_t ossec_log_t:file { open read getattr };
 
-dgram_send_pattern(ossec_analysisd_t, ossec_queue_t, ossec_execd_sock_t, ossec_execd_t)
+allow httpd_t ossec_queue_t:dir { read };
-dgram_send_pattern(ossec_analysisd_t, ossec_queue_t, ossec_remoted_sock_t, ossec_remoted_t)
+allow httpd_t ossec_queue_t:file { open read getattr };
-dgram_send_pattern(ossec_logcollector_t, ossec_queue_t, ossec_analysisd_sock_t, ossec_analysisd_t)
-dgram_send_pattern(ossec_monitord_t, ossec_queue_t, ossec_analysisd_sock_t, ossec_analysisd_t)
-dgram_send_pattern(ossec_remoted_t, ossec_queue_t, ossec_analysisd_sock_t, ossec_analysisd_t)
-dgram_send_pattern(ossec_syscheckd_t, ossec_queue_t, ossec_analysisd_sock_t, ossec_analysisd_t)
 
-domain_read_all_domains_state(ossec_syscheckd_t)
+allow httpd_t ossec_stats_t:dir { read };
-domain_dontaudit_getsession_all_domains(ossec_syscheckd_t)
+allow httpd_t ossec_stats_t:file { open read getattr };
-domain_getsession_all_domains(ossec_syscheckd_t)
-domain_getpgid_all_domains(ossec_syscheckd_t)
-domain_dontaudit_signull_all_domains(ossec_syscheckd_t)
 
-files_dontaudit_getattr_all_sockets(ossec_syscheckd_t)
-files_read_all_files(ossec_syscheckd_t)
-files_read_all_symlinks(ossec_syscheckd_t)
 
-filetrans_pattern(ossec_execd_t, ossec_var_t, ossec_execd_journal_t, file, "execd.sqlite-journal");
-
-list_dirs_pattern(ossec_monitord_t, ossec_queue_t, ossec_remoted_file_t)
-
-logging_read_all_logs(ossec_logcollector_t)
-
-manage_files_pattern(ossec_analysisd_t, ossec_analysisd_file_t, ossec_analysisd_file_t)
-manage_files_pattern(ossec_analysisd_t, ossec_etc_t, ossec_analysisd_configfile_t)
-manage_files_pattern(ossec_analysisd_t, ossec_stats_t, ossec_stats_t)
-manage_files_pattern(ossec_remoted_t, ossec_etc_t, ossec_remoted_configfile_t)
-
-manage_lnk_files_pattern(ossec_syscheckd_t, ossec_tmp_t, ossec_tmp_t)
-
-manage_sock_files_pattern(ossec_analysisd_t, ossec_queue_t, ossec_analysisd_sock_t)
-manage_sock_files_pattern(ossec_execd_t, ossec_queue_t, ossec_execd_sock_t)
-manage_sock_files_pattern(ossec_remoted_t, ossec_queue_t, ossec_remoted_sock_t)
-
-ossec_log_filetrans(ossec_analysisd_t, ossec_log_t, file)
-ossec_log_filetrans(ossec_execd_t, ossec_log_t, file)
-ossec_log_filetrans(ossec_logcollector_t, ossec_log_t, file)
-ossec_log_filetrans(ossec_maild_t, ossec_log_t, file)
-ossec_log_filetrans(ossec_monitord_t, ossec_log_t, file)
-ossec_log_filetrans(ossec_remoted_t, ossec_log_t, file)
-ossec_log_filetrans(ossec_syscheckd_t, ossec_log_t, file)
-
-ossec_pid_filetrans(ossec_analysisd_t, ossec_var_run_t, file)
-ossec_pid_filetrans(ossec_execd_t, ossec_var_run_t, file)
-ossec_pid_filetrans(ossec_logcollector_t, ossec_var_run_t, file)
-ossec_pid_filetrans(ossec_maild_t, ossec_var_run_t, file)
-ossec_pid_filetrans(ossec_monitord_t, ossec_var_run_t, file)
-ossec_pid_filetrans(ossec_remoted_t, ossec_var_run_t, file)
-ossec_pid_filetrans(ossec_syscheckd_t, ossec_var_run_t, file)
-
-ossec_queue_filetrans(ossec_analysisd_t, ossec_analysisd_file_t, file)
-ossec_queue_filetrans(ossec_analysisd_t, ossec_analysisd_sock_t, sock_file)
-ossec_queue_filetrans(ossec_execd_t, ossec_execd_sock_t, sock_file)
-ossec_queue_filetrans(ossec_remoted_t, ossec_remoted_sock_t, sock_file)
-ossec_queue_filetrans(ossec_syscheckd_t, ossec_queue_t, file)
-
-ossec_read_config(ossec_analysisd_t)
-ossec_read_config(ossec_execd_t)
-ossec_read_config(ossec_logcollector_t)
-ossec_read_config(ossec_maild_t)
-ossec_read_config(ossec_monitord_t)
-ossec_read_config(ossec_remoted_t)
-ossec_read_config(ossec_syscheckd_t)
-
-ossec_read_logs(httpd_t)
-ossec_read_queue(httpd_t)
-ossec_read_stats(httpd_t)
-
-ossec_tmp_filetrans(ossec_syscheckd_t, ossec_tmp_t, lnk_file)
-
-read_files_pattern(ossec_analysisd_t, ossec_rule_t, ossec_rule_t)
-
-rw_files_pattern(ossec_remoted_t, ossec_remoted_file_t, ossec_remoted_file_t)
-
-search_dirs_pattern(ossec_analysisd_t, ossec_rule_t, ossec_rule_t)
-search_dirs_pattern(ossec_execd_t, ossec_ar_bin_t, ossec_ar_bin_t)
-
-seutil_read_bin_policy(ossec_syscheckd_t)
-
-sysnet_read_config(ossec_analysisd_t)
-sysnet_read_config(ossec_execd_t)
-sysnet_read_config(ossec_logcollector_t)
-sysnet_read_config(ossec_maild_t)
-sysnet_read_config(ossec_monitord_t)
-sysnet_read_config(ossec_remoted_t)
-sysnet_read_config(ossec_syscheckd_t)
-
-userdom_search_user_tmp_dirs(ossec_syscheckd_t)