Completely reformatted the style based on what I understand of the style guide thus far

Code cleanup
Finished detailing out the policy for syscheckd for rootcheck and syscheck successfully.
2016-07-31 19:23:16 -04:00 · 2016-07-31 18:27:30 -04:00 · 2016-07-31 11:38:56 -04:00 · 2016-07-30 16:37:59 -04:00 · 2015-11-25 22:30:50 -05:00 · 2015-11-25 17:30:42 -05:00
4 changed files with 513 additions and 57 deletions
--- a/.gitignore
+++ b/.gitignore
@ -1,4 +1,4 @@
 Makefile
 tmp
 *.pp
-
+.*.swp
--- a/ossec.fc
+++ b/ossec.fc
@ -8,18 +8,53 @@
 #/var/log/mlogc/data(/.*)?               gen_context(system_u:object_r:mlogc_log_t,s0)

 /var/ossec/logs(/.*)?                     gen_context(system_u:object_r:ossec_log_t,s0)
-/var/ossec/queue(/.*)?                    gen_context(system_u:object_r:ossec_queue_t,s0)
 /var/ossec/stats(/.*)?                    gen_context(system_u:object_r:ossec_stats_t,s0)
-/var/ossec/var(/.*)?                      gen_context(system_u:object_r:ossec_var_t,s0)
 /var/ossec/agentless(/.*)?                gen_context(system_u:object_r:ossec_var_t,s0)

+/var/ossec/queue(/.*)?                    gen_context(system_u:object_r:ossec_queue_t,s0)
+/var/ossec/queue/rids(/.*)?               gen_context(system_u:object_r:ossec_remoted_file_t,s0)
+/var/ossec/queue/agent-info(/.*)?         gen_context(system_u:object_r:ossec_remoted_file_t,s0)
+/var/ossec/queue/fts(/.*)?                gen_context(system_u:object_r:ossec_analysisd_file_t,s0)
+/var/ossec/queue/syscheck(/.*)?           gen_context(system_u:object_r:ossec_analysisd_file_t,s0)
+/var/ossec/queue/rootcheck(/.*)?          gen_context(system_u:object_r:ossec_analysisd_file_t,s0)
+/var/ossec/queue/alerts/execq          -s gen_context(system_u:object_r:ossec_execd_sock_t,s0)
+/var/ossec/queue/alerts/ar             -s gen_context(system_u:object_r:ossec_remoted_sock_t,s0)
+/var/ossec/queue/ossec/queue           -s gen_context(system_u:object_r:ossec_analysisd_sock_t,s0)
+#/var/ossec/queue/fts/hostinfo          -- gen_context(system_u:object_r:ossec_analysisd_file_t,s0)
+#/var/ossec/queue/fts/fts-queue         -- gen_context(system_u:object_r:ossec_analysisd_file_t,s0)
+#/var/ossec/queue/fts/ig-queue          -- gen_context(system_u:object_r:ossec_analysisd_file_t,s0)
+
+/var/ossec/var/run(/.*)?                  gen_context(system_u:object_r:ossec_var_run_t,s0)
+/var/ossec/var/execd\.sqlite           -- gen_context(system_u:object_r:ossec_execd_file_t,s0)
+/var/ossec/var/execd\.sqlite-journal   -- gen_context(system_u:object_r:ossec_execd_journal_t,s0)
+#/var/ossec/var/execd\.sqlite(-.*)?     -- gen_context(system_u:object_r:ossec_execd_file_t,s0)
+/var/ossec/var(/.*)?                      gen_context(system_u:object_r:ossec_var_t,s0)
+
 /var/ossec/tmp(/.*)?                      gen_context(system_u:object_r:ossec_tmp_t,s0)

 /var/ossec/etc(/.*)?                      gen_context(system_u:object_r:ossec_etc_t,s0)
+/var/ossec/etc/shared/ar\.conf         -- gen_context(system_u:object_r:ossec_analysisd_configfile_t,s0)
+/var/ossec/etc/shared/merged\.mg       -- gen_context(system_u:object_r:ossec_remoted_configfile_t,s0)
+#/var/ossec/etc/shared(/.*)?               gen_context(system_u:object_r:ossec_etc_share_t,s0)
 /var/ossec/rules(/.*)?                    gen_context(system_u:object_r:ossec_rule_t,s0)

+#/var/ossec/active-response/bin(/.*)? --   gen_context(system_u:object_r:ossec_script_exec_t,s0)
+#/var/ossec/active-response(/.*)?          gen_context(system_u:object_r:ossec_script_t,s0)
+/var/ossec/active-response/bin(/.*)? --   gen_context(system_u:object_r:ossec_ar_exec_t,s0)
+/var/ossec/active-response(/.*)?          gen_context(system_u:object_r:ossec_ar_bin_t,s0)
+
+/etc/init.d/ossec-hids           --       gen_context(system_u:object_r:ossec_initrc_exec_t,s0)
+/var/ossec/bin/ossec-control     --       gen_context(system_u:object_r:ossec_initrc_exec_t,s0)
+/var/ossec/bin/ossec-server.sh   --       gen_context(system_u:object_r:ossec_initrc_exec_t,s0)
+/var/ossec/bin/ossec-maild       --       gen_context(system_u:object_r:ossec_maild_exec_t,s0)
+/var/ossec/bin/ossec-execd       --       gen_context(system_u:object_r:ossec_execd_exec_t,s0)
+/var/ossec/bin/ossec-analysisd   --       gen_context(system_u:object_r:ossec_analysisd_exec_t,s0)
+/var/ossec/bin/ossec-logcollector --      gen_context(system_u:object_r:ossec_logcollector_exec_t,s0)
+/var/ossec/bin/ossec-remoted     --       gen_context(system_u:object_r:ossec_remoted_exec_t,s0)
+/var/ossec/bin/ossec-syscheckd   --       gen_context(system_u:object_r:ossec_syscheckd_exec_t,s0)
+/var/ossec/bin/ossec-monitord    --       gen_context(system_u:object_r:ossec_monitord_exec_t,s0)
+/var/ossec/bin/ossec-dbd         --       gen_context(system_u:object_r:ossec_dbd_exec_t,s0)
+/var/ossec/bin/ossec-csyslogd    --       gen_context(system_u:object_r:ossec_csyslogd_exec_t,s0)
+/var/ossec/bin/ossec-agentlessd  --       gen_context(system_u:object_r:ossec_agentlessd_exec_t,s0)
 /var/ossec/bin(/.*)?                      gen_context(system_u:object_r:bin_t,s0)
-/var/ossec/active-response(/.*)?          gen_context(system_u:object_r:ossec_script_t,s0)
-
-#/var/ossec/bin/ossec-control     --       gen_context(system_u:object_r:ossec_exec_t,s0)

--- a/ossec.if
+++ b/ossec.if
@ -52,13 +52,18 @@ interface(`ossec_domtrans',`
 ##      </summary>
 ## </param>
 #
-interface(`ossec_read_log',`
+interface(`ossec_read_logs',`
        gen_require(`
+                type var_t;
                type ossec_log_t;
        ')

-        logging_search_logs($1)
-        allow $1 ossec_log_t:file read_file_perms;
+        allow $1 var_t:dir search_dir_perms;
+        #read_files_pattern($1, ossec_log_t, ossec_log_t)
+        read_files_pattern($1, ossec_log_t, logfile)
+        #allow $1 ossec_log_t:dir search_dir_perms
+        #logging_search_logs($1)
+        #allow $1 ossec_log_t:file read_file_perms;
 ')

 ########################################
@ -71,11 +76,187 @@ interface(`ossec_read_log',`
 ##      </summary>
 ## </param>
 #
-interface(`ossec_write_log',`
+#interface(`ossec_write_log',`
+#        gen_require(`
+#                type ossec_log_t;
+#        ')
+#
+#        allow $1 ossec_log_t:file write;
+#')
+
+
+interface(`ossec_read_config',`
 	gen_require(`
-                type ossec_log_t;
+        type var_t;
+		type ossec_etc_t;
 	')

-        allow $1 ossec_log_t:file write;
+    allow $1 var_t:dir search_dir_perms;
+    #allow $1 ossec_etc_t:dir search_dir_perms;
+	read_lnk_files_pattern($1, ossec_etc_t, configfile)
+    files_read_config_files($1, ossec_etc_t)
+')
+
+#interface(`ossec_read_shared_config',`
+#	gen_require(`
+#        type var_t;
+#		type ossec_etc_t;
+#		#type ossec_etc_share_t;
+#	')
+#
+#	allow $1 var_t:dir search_dir_perms;
+#    allow $1 ossec_etc_t:dir search_dir_perms;
+#    #allow $1 ossec_etc_share_t:dir search_dir_perms;
+#    allow $1 ossec_etc_share_t:file read_file_perms;
+#    #allow $1 ossec_analysisd_file_t:file read_file_perms;
+#	#search_dirs_pattern($1, ossec_etc_t, ossec_etc_t)
+#	#search_dirs_pattern($1, ossec_etc_share_t, ossec_etc_share_t)
+#	#read_files_pattern($1, ossec_etc_share_t, ossec_etc_share_t)
+#')
+
+#interface(`ossec_manage_shared_config',`
+#	gen_require(`
+#		type ossec_etc_t;
+#		type ossec_etc_share_t;
+#	')
+#
+#	search_dirs_pattern($1, ossec_etc_t, ossec_etc_t)
+#	search_dirs_pattern($1, ossec_etc_share_t, ossec_etc_share_t)
+#	manage_files_pattern($1, ossec_etc_share_t, ossec_etc_share_t)
+#')
+
+interface(`ossec_pid_filetrans',`
+	gen_require(`
+        type var_t;
+		type ossec_var_t, ossec_var_run_t;
+	')
+
+    allow $1 var_t:dir search_dir_perms;
+	allow $1 ossec_var_t:dir search_dir_perms;
+	allow $1 ossec_var_run_t:lnk_file read_lnk_file_perms;
+	filetrans_pattern($1, ossec_var_run_t, $2, $3, $4)
+')
+
+interface(`ossec_log_filetrans',`
+	gen_require(`
+        type var_t;
+		type ossec_var_t, ossec_log_t;
+	')
+
+    allow $1 var_t:dir search_dir_perms;
+	allow $1 ossec_log_t:dir search_dir_perms;
+	filetrans_pattern($1, ossec_log_t, $2, $3, $4)
+')
+
+interface(`ossec_read_stats',`
+    gen_require(`
+        type var_t;
+        type ossec_stats_t;
+    ')
+
+    allow $1 var_t:dir search_dir_perms;
+    read_files_pattern($1, ossec_stats_t, ossec_stats_t)
+')
+
+interface(`ossec_manage_stats',`
+    gen_require(`
+        type var_t;
+        type ossec_stats_t;
+    ')
+
+    allow $1 var_t:dir search_dir_perms;
+    append_files_pattern($1, ossec_stats_t, ossec_stats_t)
+')
+
+interface(`ossec_read_queue',`
+    gen_require(`
+        type var_t;
+        type ossec_queue_t;
+    ')
+
+    allow $1 var_t:dir search_dir_perms;
+    allow $1 ossec_queue_t:dir list_dir_perms;
+    allow $1 ossec_queue_t:file read_file_perms;
+    allow $1 ossec_remoted_file_t:dir list_dir_perms;
+    allow $1 ossec_remoted_file_t:file read_file_perms;
+    allow $1 ossec_analysisd_file_t:dir list_dir_perms;
+    allow $1 ossec_analysisd_file_t:file read_file_perms;
+    #read_files_pattern($1, ossec_queue_t, ossec_queue_t)
+')
+
+########################################
+## <summary>
+##      Create objects in the spool directory
+##      with a private type with a type transition.
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+## <param name="file">
+##      <summary>
+##      Type to which the created node will be transitioned.
+##      </summary>
+## </param>
+## <param name="class">
+##      <summary>
+##      Object class(es) (single or set including {}) for which this
+##      the transition will occur.
+##      </summary>
+## </param>
+## <param name="name" optional="true">
+##      <summary>
+##      The name of the object being created.
+##      </summary>
+## </param>
+#
+interface(`ossec_queue_filetrans',`
+    gen_require(`
+        type var_t;
+        type ossec_queue_t;
+    ')
+
+    allow $1 var_t:dir search_dir_perms;
+    allow $1 ossec_queue_t:dir search_dir_perms;
+    filetrans_pattern($1, ossec_queue_t, $2, $3, $4)
+')
+
+########################################
+## <summary>
+##      Create objects in the tmp directory
+##      with a private type with a type transition.
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+## <param name="file">
+##      <summary>
+##      Type to which the created node will be transitioned.
+##      </summary>
+## </param>
+## <param name="class">
+##      <summary>
+##      Object class(es) (single or set including {}) for which this
+##      the transition will occur.
+##      </summary>
+## </param>
+## <param name="name" optional="true">
+##      <summary>
+##      The name of the object being created.
+##      </summary>
+## </param>
+#
+interface(`ossec_tmp_filetrans',`
+    gen_require(`
+        type var_t;
+        type ossec_tmp_t;
+    ')
+
+    allow $1 var_t:dir search_dir_perms;
+    allow $1 ossec_tmp_t:dir search_dir_perms;
+    filetrans_pattern($1, ossec_tmp_t, $2, $3, $4)
 ')

--- a/ossec.te
+++ b/ossec.te
@ -1,61 +1,155 @@

-policy_module(ossec,1.0.10)
+policy_module(ossec,1.1.0)

 ########################################
 #
 # Declarations
 #

-type ossec_t;
-type ossec_bin_t;
-type ossec_exec_t;
-role system_r types ossec_t;
-domain_type(ossec_t)
-domain_entry_file(ossec_t, ossec_exec_t)
+###
+# Active-Response Domain and File Types
+type ossec_ar_t;
+type ossec_ar_exec_t;
+domain_type(ossec_ar_t)
+domain_entry_file(ossec_ar_t, ossec_ar_exec_t)
+domtrans_pattern(ossec_execd_t, ossec_ar_exec_t, ossec_ar_t)
+role system_r types ossec_ar_t;
+files_type(ossec_ar_exec_t);

-optional_policy(`
-        ossec_domtrans(httpd_t)
-')
+type ossec_ar_bin_t;
+files_type(ossec_ar_bin_t);

-type ossec_var_t;
-files_type(ossec_var_t)
+unconfined_domain(ossec_ar_t)
+###

-type ossec_tmp_t;
-files_tmp_file(ossec_tmp_t)
+# ossec-agentlessd daemon
+type ossec_agentlessd_t;
+type ossec_agentlessd_exec_t;
+init_daemon_domain(ossec_agentlessd_t, ossec_agentlessd_exec_t)

-type ossec_log_t;
-logging_log_file(ossec_log_t)
+# ossec-analysisd daemon
+type ossec_analysisd_t;
+type ossec_analysisd_exec_t;
+init_daemon_domain(ossec_analysisd_t, ossec_analysisd_exec_t)

+type ossec_analysisd_configfile_t;
+files_config_file(ossec_analysisd_configfile_t)
+
+type ossec_analysisd_file_t;
+files_type(ossec_analysisd_file_t)
+
+type ossec_analysisd_sock_t;
+files_type(ossec_analysisd_sock_t)
+
+# ossec-csyslogd daemon
+type ossec_csyslogd_t;
+type ossec_csyslogd_exec_t;
+init_daemon_domain(ossec_csyslogd_t, ossec_csyslogd_exec_t)
+
+# ossec-dbd daemon
+type ossec_dbd_t;
+type ossec_dbd_exec_t;
+init_daemon_domain(ossec_dbd_t, ossec_dbd_exec_t)
+
+# ossec etc dir
 type ossec_etc_t;
 files_config_file(ossec_etc_t)

-type ossec_rule_t;
-files_config_file(ossec_rule_t)
+# ossec-execd daemon
+type ossec_execd_t;
+type ossec_execd_exec_t;
+init_daemon_domain(ossec_execd_t, ossec_execd_exec_t)

-type ossec_stats_t;
-files_type(ossec_stats_t)
+type ossec_execd_file_t;
+files_type(ossec_execd_file_t)

+type ossec_execd_journal_t;
+files_type(ossec_execd_journal_t)
+
+type ossec_execd_sock_t;
+files_type(ossec_execd_sock_t)
+
+# ossec_initrc
+type ossec_initrc_exec_t;
+init_script_file(ossec_initrc_exec_t)
+
+# ossec-logcollector daemon
+type ossec_logcollector_t;
+type ossec_logcollector_exec_t;
+init_daemon_domain(ossec_logcollector_t, ossec_logcollector_exec_t)
+
+# ossec logs dir
+type ossec_log_t;
+logging_log_file(ossec_log_t)
+
+# ossec-maild daemon
+type ossec_maild_t;
+type ossec_maild_exec_t;
+init_daemon_domain(ossec_maild_t, ossec_maild_exec_t)
+
+# ossec-monitord daemon
+type ossec_monitord_t;
+type ossec_monitord_exec_t;
+init_daemon_domain(ossec_monitord_t, ossec_monitord_exec_t)
+
+# ossec-remoted daemon
+type ossec_remoted_t;
+type ossec_remoted_exec_t;
+init_daemon_domain(ossec_remoted_t, ossec_remoted_exec_t)
+
+type ossec_remoted_configfile_t;
+files_config_file(ossec_remoted_configfile_t);
+
+type ossec_remoted_file_t;
+files_type(ossec_remoted_file_t)
+
+type ossec_remoted_sock_t;
+files_type(ossec_remoted_sock_t)
+
+# ossec-syscheckd daemon
+type ossec_syscheckd_t;
+type ossec_syscheckd_exec_t;
+init_daemon_domain(ossec_syscheckd_t, ossec_syscheckd_exec_t)
+
+
+# ossec bin dir
+type ossec_bin_t;
+files_type(ossec_bin_t)
+
+# ossec queue dir
 type ossec_queue_t;
 files_type(ossec_queue_t)

-type ossec_script_t;
-files_type(ossec_script_t)
+# ossec rules dir
+type ossec_rule_t;
+files_config_file(ossec_rule_t)
+
+# ossec stats dir
+type ossec_stats_t;
+files_type(ossec_stats_t)
+
+# ossec tmp dir
+type ossec_tmp_t;
+files_tmp_file(ossec_tmp_t)
+
+# ossec var run dir
+type ossec_var_t;
+files_type(ossec_var_t)
+
+type ossec_var_run_t;
+files_pid_file(ossec_var_run_t)
+

 require {
-	type ossec_t;
-	type ossec_bin_t;
-	type ossec_exec_t;
-	type ossec_var_t;
-	type ossec_tmp_t;
-	type ossec_log_t;
-	type ossec_etc_t;
-	type ossec_rule_t;
-	type ossec_stats_t;
-	type ossec_queue_t;
-	type ossec_script_t;
 	type httpd_t;
-	class file { rename read lock create write getattr unlink open append };
-	class dir { write getattr read remove_name create add_name };
+	type hi_reserved_port_t;
+
+	class file { rename read lock create write getattr unlink open append entrypoint };
+	#class dir { write getattr read remove_name create add_name };
+	class process { setsched transition rlimitinh siginh noatsecure };
+	class capability { dac_override dac_read_search setuid setgid fsetid sys_chroot sys_nice };
+	class tcp_socket { create name_bind name_connect };
+	class udp_socket { create bind name_bind node_bind };
 }


@ -65,18 +159,164 @@ require {
 #


-#============= ossec_t ==============
+allow ossec_analysisd_t ossec_log_t:file { create_file_perms append_file_perms read link unlink };
+allow ossec_analysisd_t ossec_var_run_t:file manage_file_perms;
+allow ossec_analysisd_t self:capability { dac_override dac_read_search fsetid setuid setgid sys_chroot };
+allow ossec_analysisd_t self:unix_dgram_socket create_stream_socket_perms;
+
+allow ossec_execd_t ossec_ar_t:process { rlimitinh siginh noatsecure };
+allow ossec_execd_t ossec_execd_file_t:file { create_file_perms rw_file_perms };
+allow ossec_execd_t ossec_execd_journal_t:file manage_file_perms;
+allow ossec_execd_t ossec_log_t:file { create_file_perms append_file_perms read };
+allow ossec_execd_t ossec_var_run_t:file manage_file_perms;
+allow ossec_execd_t self:capability { dac_override dac_read_search setgid };
+allow ossec_execd_t self:unix_dgram_socket create_stream_socket_perms;
+
+allow ossec_logcollector_t ossec_log_t:file { create_file_perms append_file_perms read };
+allow ossec_logcollector_t ossec_var_run_t:file manage_file_perms;
+allow ossec_logcollector_t self:capability { dac_override dac_read_search };
+allow ossec_logcollector_t self:unix_dgram_socket create_socket_perms;
+
+allow ossec_maild_t ossec_log_t:file { create_file_perms append_file_perms read };
+allow ossec_maild_t ossec_var_run_t:file manage_file_perms;
+allow ossec_maild_t self:capability { dac_override dac_read_search setuid setgid sys_chroot };
+allow ossec_maild_t self:tcp_socket create_socket_perms;
+
+allow ossec_monitord_t ossec_log_t:file { create_file_perms append_file_perms write read };
+allow ossec_monitord_t ossec_remoted_file_t:file getattr_file_perms;
+allow ossec_monitord_t ossec_var_run_t:file manage_file_perms;
+allow ossec_monitord_t self:capability { dac_override dac_read_search setuid setgid sys_chroot };
+allow ossec_monitord_t self:unix_dgram_socket create_socket_perms;
+
+allow ossec_remoted_t ossec_log_t:file { create_file_perms append_file_perms read };
+allow ossec_remoted_t ossec_var_run_t:file manage_file_perms;
+allow ossec_remoted_t self:capability { dac_override dac_read_search setuid setgid sys_chroot };
+allow ossec_remoted_t self:udp_socket create_stream_socket_perms;
+allow ossec_remoted_t self:unix_dgram_socket create_stream_socket_perms;
+
+allow ossec_syscheckd_t hi_reserved_port_t:tcp_socket name_bind;
+allow ossec_syscheckd_t hi_reserved_port_t:udp_socket name_bind;
+allow ossec_syscheckd_t ossec_log_t:file { create_file_perms append_file_perms read };
+allow ossec_syscheckd_t ossec_queue_t:dir { create_dir_perms rw_dir_perms };
+allow ossec_syscheckd_t ossec_queue_t:file { create_file_perms rename_file_perms write_file_perms };
+allow ossec_syscheckd_t ossec_var_run_t:file manage_file_perms;
+allow ossec_syscheckd_t self:capability { dac_override dac_read_search kill setuid setgid sys_chroot sys_nice };
+allow ossec_syscheckd_t self:process { setsched };
+allow ossec_syscheckd_t self:tcp_socket create_socket_perms;
+allow ossec_syscheckd_t self:udp_socket create_socket_perms;
+allow ossec_syscheckd_t self:unix_dgram_socket create_socket_perms;


-#============= httpd_t ==============
-allow httpd_t ossec_log_t:dir { read };
-allow httpd_t ossec_log_t:file { open read getattr };
+auth_read_passwd(ossec_analysisd_t)
+auth_read_passwd(ossec_execd_t)
+auth_read_passwd(ossec_maild_t)
+auth_read_passwd(ossec_monitord_t)
+auth_read_passwd(ossec_remoted_t)

-allow httpd_t ossec_queue_t:dir { read };
-allow httpd_t ossec_queue_t:file { open read getattr };
+corecmd_exec_bin(ossec_syscheckd_t)
+corecmd_exec_shell(ossec_execd_t)
+corecmd_exec_shell(ossec_syscheckd_t)

-allow httpd_t ossec_stats_t:dir { read };
-allow httpd_t ossec_stats_t:file { open read getattr };
+corenet_tcp_bind_generic_node(ossec_syscheckd_t)
+corenet_tcp_bind_generic_port(ossec_syscheckd_t)
+corenet_tcp_bind_reserved_port(ossec_syscheckd_t)
+corenet_tcp_connect_smtp_port(ossec_maild_t)

+corenet_udp_bind_all_unreserved_ports(ossec_remoted_t)
+corenet_udp_bind_generic_node(ossec_remoted_t)
+corenet_udp_bind_generic_node(ossec_syscheckd_t)
+corenet_udp_bind_generic_port(ossec_syscheckd_t)
+corenet_udp_bind_reserved_port(ossec_syscheckd_t)

+dev_getattr_all(ossec_syscheckd_t)
+dev_read_urand(ossec_execd_t)
+
+dgram_send_pattern(ossec_analysisd_t, ossec_queue_t, ossec_execd_sock_t, ossec_execd_t)
+dgram_send_pattern(ossec_analysisd_t, ossec_queue_t, ossec_remoted_sock_t, ossec_remoted_t)
+dgram_send_pattern(ossec_logcollector_t, ossec_queue_t, ossec_analysisd_sock_t, ossec_analysisd_t)
+dgram_send_pattern(ossec_monitord_t, ossec_queue_t, ossec_analysisd_sock_t, ossec_analysisd_t)
+dgram_send_pattern(ossec_remoted_t, ossec_queue_t, ossec_analysisd_sock_t, ossec_analysisd_t)
+dgram_send_pattern(ossec_syscheckd_t, ossec_queue_t, ossec_analysisd_sock_t, ossec_analysisd_t)
+
+domain_read_all_domains_state(ossec_syscheckd_t)
+domain_dontaudit_getsession_all_domains(ossec_syscheckd_t)
+domain_getsession_all_domains(ossec_syscheckd_t)
+domain_getpgid_all_domains(ossec_syscheckd_t)
+domain_dontaudit_signull_all_domains(ossec_syscheckd_t)
+
+files_dontaudit_getattr_all_sockets(ossec_syscheckd_t)
+files_read_all_files(ossec_syscheckd_t)
+files_read_all_symlinks(ossec_syscheckd_t)
+
+filetrans_pattern(ossec_execd_t, ossec_var_t, ossec_execd_journal_t, file, "execd.sqlite-journal");
+
+list_dirs_pattern(ossec_monitord_t, ossec_queue_t, ossec_remoted_file_t)
+
+logging_read_all_logs(ossec_logcollector_t)
+
+manage_files_pattern(ossec_analysisd_t, ossec_analysisd_file_t, ossec_analysisd_file_t)
+manage_files_pattern(ossec_analysisd_t, ossec_etc_t, ossec_analysisd_configfile_t)
+manage_files_pattern(ossec_analysisd_t, ossec_stats_t, ossec_stats_t)
+manage_files_pattern(ossec_remoted_t, ossec_etc_t, ossec_remoted_configfile_t)
+
+manage_lnk_files_pattern(ossec_syscheckd_t, ossec_tmp_t, ossec_tmp_t)
+
+manage_sock_files_pattern(ossec_analysisd_t, ossec_queue_t, ossec_analysisd_sock_t)
+manage_sock_files_pattern(ossec_execd_t, ossec_queue_t, ossec_execd_sock_t)
+manage_sock_files_pattern(ossec_remoted_t, ossec_queue_t, ossec_remoted_sock_t)
+
+ossec_log_filetrans(ossec_analysisd_t, ossec_log_t, file)
+ossec_log_filetrans(ossec_execd_t, ossec_log_t, file)
+ossec_log_filetrans(ossec_logcollector_t, ossec_log_t, file)
+ossec_log_filetrans(ossec_maild_t, ossec_log_t, file)
+ossec_log_filetrans(ossec_monitord_t, ossec_log_t, file)
+ossec_log_filetrans(ossec_remoted_t, ossec_log_t, file)
+ossec_log_filetrans(ossec_syscheckd_t, ossec_log_t, file)
+
+ossec_pid_filetrans(ossec_analysisd_t, ossec_var_run_t, file)
+ossec_pid_filetrans(ossec_execd_t, ossec_var_run_t, file)
+ossec_pid_filetrans(ossec_logcollector_t, ossec_var_run_t, file)
+ossec_pid_filetrans(ossec_maild_t, ossec_var_run_t, file)
+ossec_pid_filetrans(ossec_monitord_t, ossec_var_run_t, file)
+ossec_pid_filetrans(ossec_remoted_t, ossec_var_run_t, file)
+ossec_pid_filetrans(ossec_syscheckd_t, ossec_var_run_t, file)
+
+ossec_queue_filetrans(ossec_analysisd_t, ossec_analysisd_file_t, file)
+ossec_queue_filetrans(ossec_analysisd_t, ossec_analysisd_sock_t, sock_file)
+ossec_queue_filetrans(ossec_execd_t, ossec_execd_sock_t, sock_file)
+ossec_queue_filetrans(ossec_remoted_t, ossec_remoted_sock_t, sock_file)
+ossec_queue_filetrans(ossec_syscheckd_t, ossec_queue_t, file)
+
+ossec_read_config(ossec_analysisd_t)
+ossec_read_config(ossec_execd_t)
+ossec_read_config(ossec_logcollector_t)
+ossec_read_config(ossec_maild_t)
+ossec_read_config(ossec_monitord_t)
+ossec_read_config(ossec_remoted_t)
+ossec_read_config(ossec_syscheckd_t)
+
+ossec_read_logs(httpd_t)
+ossec_read_queue(httpd_t)
+ossec_read_stats(httpd_t)
+
+ossec_tmp_filetrans(ossec_syscheckd_t, ossec_tmp_t, lnk_file)
+
+read_files_pattern(ossec_analysisd_t, ossec_rule_t, ossec_rule_t)
+
+rw_files_pattern(ossec_remoted_t, ossec_remoted_file_t, ossec_remoted_file_t)
+
+search_dirs_pattern(ossec_analysisd_t, ossec_rule_t, ossec_rule_t)
+search_dirs_pattern(ossec_execd_t, ossec_ar_bin_t, ossec_ar_bin_t)
+
+seutil_read_bin_policy(ossec_syscheckd_t)
+
+sysnet_read_config(ossec_analysisd_t)
+sysnet_read_config(ossec_execd_t)
+sysnet_read_config(ossec_logcollector_t)
+sysnet_read_config(ossec_maild_t)
+sysnet_read_config(ossec_monitord_t)
+sysnet_read_config(ossec_remoted_t)
+sysnet_read_config(ossec_syscheckd_t)
+
+userdom_search_user_tmp_dirs(ossec_syscheckd_t)
Author	SHA1	Message	Date
Eric Renfro	66ef615fde	Completely reformatted the style based on what I understand of the style guide thus far	2016-07-31 19:23:16 -04:00
Eric Renfro	fb51062e5d	Code cleanup	2016-07-31 18:27:30 -04:00
Eric Renfro	39e18d655f	Finished detailing out the policy for syscheckd for rootcheck and syscheck successfully.	2016-07-31 11:38:56 -04:00
Eric Renfro	c1c499a09c	Updated policy to fix syscheckd denials	2016-07-30 16:37:59 -04:00
Eric Renfro	46fae0874d	Minor cleanup.	2015-11-25 22:30:50 -05:00
Eric Renfro	df1baf710e	Confined the queue directory and sock files.	2015-11-25 17:30:42 -05:00
Eric Renfro	aeb1ee4e6b	Lots of cleanup, interfaces.	2015-11-25 10:49:08 -05:00
Eric Renfro	991f7835d9	Cleanup, refinement, suggestions from grift.	2015-11-24 15:34:00 -05:00
Eric Renfro	9f2084c8f7	Cleanup finished for now.	2015-11-24 01:53:43 -05:00
Eric Renfro	b7b823d365	Fine tuning policy and cleanup	2015-11-24 01:27:25 -05:00
Eric Renfro	944fcedf8d	Changed ossec_scripts_t domain to ossec_ar_t domain and started using interfaces for etc	2015-11-23 23:32:34 -05:00
Eric Renfro	7a6f7d3a04	Added interfaces for etc and etc_shared	2015-11-23 19:04:56 -05:00
Eric Renfro	edf4a3bc73	Updated unconfined method to solid defined method, thanks to grift	2015-11-23 10:28:49 -05:00
Eric Renfro	f8e58c8491	Added unconfined scripts support	2015-11-23 02:36:37 -05:00
Eric Renfro	5eb312d450	Added all ossec components, just fine tuning remaining	2015-11-23 00:09:36 -05:00
Eric Renfro	16d399e40f	Added support for ossec-analysisd completed	2015-11-22 16:13:53 -05:00