Completely reformatted the style based on what I understand of the style guide thus far

.gitignore

@@ -1,4 +1,4 @@
 Makefile
 tmp
 *.pp
-
+.*.swp

ossec.fc

@@ -8,32 +8,53 @@
 #/var/log/mlogc/data(/.*)?               gen_context(system_u:object_r:mlogc_log_t,s0)
 
 /var/ossec/logs(/.*)?                     gen_context(system_u:object_r:ossec_log_t,s0)
-/var/ossec/queue(/.*)?                    gen_context(system_u:object_r:ossec_queue_t,s0)
 /var/ossec/stats(/.*)?                    gen_context(system_u:object_r:ossec_stats_t,s0)
-/var/ossec/var(/.*)?                      gen_context(system_u:object_r:ossec_var_t,s0)
 /var/ossec/agentless(/.*)?                gen_context(system_u:object_r:ossec_var_t,s0)
 
+/var/ossec/queue(/.*)?                    gen_context(system_u:object_r:ossec_queue_t,s0)
+/var/ossec/queue/rids(/.*)?               gen_context(system_u:object_r:ossec_remoted_file_t,s0)
+/var/ossec/queue/agent-info(/.*)?         gen_context(system_u:object_r:ossec_remoted_file_t,s0)
+/var/ossec/queue/fts(/.*)?                gen_context(system_u:object_r:ossec_analysisd_file_t,s0)
+/var/ossec/queue/syscheck(/.*)?           gen_context(system_u:object_r:ossec_analysisd_file_t,s0)
+/var/ossec/queue/rootcheck(/.*)?          gen_context(system_u:object_r:ossec_analysisd_file_t,s0)
+/var/ossec/queue/alerts/execq          -s gen_context(system_u:object_r:ossec_execd_sock_t,s0)
+/var/ossec/queue/alerts/ar             -s gen_context(system_u:object_r:ossec_remoted_sock_t,s0)
+/var/ossec/queue/ossec/queue           -s gen_context(system_u:object_r:ossec_analysisd_sock_t,s0)
+#/var/ossec/queue/fts/hostinfo          -- gen_context(system_u:object_r:ossec_analysisd_file_t,s0)
+#/var/ossec/queue/fts/fts-queue         -- gen_context(system_u:object_r:ossec_analysisd_file_t,s0)
+#/var/ossec/queue/fts/ig-queue          -- gen_context(system_u:object_r:ossec_analysisd_file_t,s0)
+
+/var/ossec/var/run(/.*)?                  gen_context(system_u:object_r:ossec_var_run_t,s0)
+/var/ossec/var/execd\.sqlite           -- gen_context(system_u:object_r:ossec_execd_file_t,s0)
+/var/ossec/var/execd\.sqlite-journal   -- gen_context(system_u:object_r:ossec_execd_journal_t,s0)
+#/var/ossec/var/execd\.sqlite(-.*)?     -- gen_context(system_u:object_r:ossec_execd_file_t,s0)
+/var/ossec/var(/.*)?                      gen_context(system_u:object_r:ossec_var_t,s0)
+
 /var/ossec/tmp(/.*)?                      gen_context(system_u:object_r:ossec_tmp_t,s0)
 
 /var/ossec/etc(/.*)?                      gen_context(system_u:object_r:ossec_etc_t,s0)
-/var/ossec/etc/shared(/.*)?               gen_context(system_u:object_r:ossec_etc_share_t,s0)
+/var/ossec/etc/shared/ar\.conf         -- gen_context(system_u:object_r:ossec_analysisd_configfile_t,s0)
+/var/ossec/etc/shared/merged\.mg       -- gen_context(system_u:object_r:ossec_remoted_configfile_t,s0)
+#/var/ossec/etc/shared(/.*)?               gen_context(system_u:object_r:ossec_etc_share_t,s0)
 /var/ossec/rules(/.*)?                    gen_context(system_u:object_r:ossec_rule_t,s0)
 
-/var/ossec/active-response(/.*)?          gen_context(system_u:object_r:ossec_script_t,s0)
+#/var/ossec/active-response/bin(/.*)? --   gen_context(system_u:object_r:ossec_script_exec_t,s0)
+#/var/ossec/active-response(/.*)?          gen_context(system_u:object_r:ossec_script_t,s0)
+/var/ossec/active-response/bin(/.*)? --   gen_context(system_u:object_r:ossec_ar_exec_t,s0)
+/var/ossec/active-response(/.*)?          gen_context(system_u:object_r:ossec_ar_bin_t,s0)
 
 /etc/init.d/ossec-hids           --       gen_context(system_u:object_r:ossec_initrc_exec_t,s0)
-/var/ossec/bin/ossec-control     --       gen_context(system_u:object_r:ossec_exec_t,s0)
+/var/ossec/bin/ossec-control     --       gen_context(system_u:object_r:ossec_initrc_exec_t,s0)
-#/var/ossec/bin/ossec-server.sh   --       gen_context(system_u:object_r:ossec_exec_t,s0)
 /var/ossec/bin/ossec-server.sh   --       gen_context(system_u:object_r:ossec_initrc_exec_t,s0)
-/var/ossec/bin/ossec-maild                gen_context(system_u:object_r:ossec_exec_t,s0)
+/var/ossec/bin/ossec-maild       --       gen_context(system_u:object_r:ossec_maild_exec_t,s0)
-/var/ossec/bin/ossec-execd                gen_context(system_u:object_r:ossec_exec_t,s0)
+/var/ossec/bin/ossec-execd       --       gen_context(system_u:object_r:ossec_execd_exec_t,s0)
-/var/ossec/bin/ossec-analysisd            gen_context(system_u:object_r:ossec_exec_t,s0)
+/var/ossec/bin/ossec-analysisd   --       gen_context(system_u:object_r:ossec_analysisd_exec_t,s0)
-/var/ossec/bin/ossec-logcollector         gen_context(system_u:object_r:ossec_exec_t,s0)
+/var/ossec/bin/ossec-logcollector --      gen_context(system_u:object_r:ossec_logcollector_exec_t,s0)
-/var/ossec/bin/ossec-remoted              gen_context(system_u:object_r:ossec_exec_t,s0)
+/var/ossec/bin/ossec-remoted     --       gen_context(system_u:object_r:ossec_remoted_exec_t,s0)
-/var/ossec/bin/ossec-syscheckd            gen_context(system_u:object_r:ossec_exec_t,s0)
+/var/ossec/bin/ossec-syscheckd   --       gen_context(system_u:object_r:ossec_syscheckd_exec_t,s0)
-/var/ossec/bin/ossec-monitord             gen_context(system_u:object_r:ossec_exec_t,s0)
+/var/ossec/bin/ossec-monitord    --       gen_context(system_u:object_r:ossec_monitord_exec_t,s0)
-/var/ossec/bin/ossec-dbd                  gen_context(system_u:object_r:ossec_exec_t,s0)
+/var/ossec/bin/ossec-dbd         --       gen_context(system_u:object_r:ossec_dbd_exec_t,s0)
-/var/ossec/bin/ossec-csyslogd             gen_context(system_u:object_r:ossec_exec_t,s0)
+/var/ossec/bin/ossec-csyslogd    --       gen_context(system_u:object_r:ossec_csyslogd_exec_t,s0)
-/var/ossec/bin/ossec-agentlessd           gen_context(system_u:object_r:ossec_exec_t,s0)
+/var/ossec/bin/ossec-agentlessd  --       gen_context(system_u:object_r:ossec_agentlessd_exec_t,s0)
 /var/ossec/bin(/.*)?                      gen_context(system_u:object_r:bin_t,s0)
 

ossec.if

@@ -52,13 +52,18 @@ interface(`ossec_domtrans',`
 ##      </summary>
 ## </param>
 #
-interface(`ossec_read_log',`
+interface(`ossec_read_logs',`
         gen_require(`
+                type var_t;
                 type ossec_log_t;
         ')
 
-        logging_search_logs($1)
+        allow $1 var_t:dir search_dir_perms;
-        allow $1 ossec_log_t:file read_file_perms;
+        #read_files_pattern($1, ossec_log_t, ossec_log_t)
+        read_files_pattern($1, ossec_log_t, logfile)
+        #allow $1 ossec_log_t:dir search_dir_perms
+        #logging_search_logs($1)
+        #allow $1 ossec_log_t:file read_file_perms;
 ')
 
 ########################################
@@ -71,22 +76,187 @@ interface(`ossec_read_log',`
 ##      </summary>
 ## </param>
 #
-interface(`ossec_write_log',`
+#interface(`ossec_write_log',`
-        gen_require(`
+#        gen_require(`
-                type ossec_log_t;
+#                type ossec_log_t;
-        ')
+#        ')
+#
+#        allow $1 ossec_log_t:file write;
+#')
 
-        allow $1 ossec_log_t:file write;
+
+interface(`ossec_read_config',`
+	gen_require(`
+        type var_t;
+		type ossec_etc_t;
+	')
+
+    allow $1 var_t:dir search_dir_perms;
+    #allow $1 ossec_etc_t:dir search_dir_perms;
+	read_lnk_files_pattern($1, ossec_etc_t, configfile)
+    files_read_config_files($1, ossec_etc_t)
 ')
 
+#interface(`ossec_read_shared_config',`
+#	gen_require(`
+#        type var_t;
+#		type ossec_etc_t;
+#		#type ossec_etc_share_t;
+#	')
+#
+#	allow $1 var_t:dir search_dir_perms;
+#    allow $1 ossec_etc_t:dir search_dir_perms;
+#    #allow $1 ossec_etc_share_t:dir search_dir_perms;
+#    allow $1 ossec_etc_share_t:file read_file_perms;
+#    #allow $1 ossec_analysisd_file_t:file read_file_perms;
+#	#search_dirs_pattern($1, ossec_etc_t, ossec_etc_t)
+#	#search_dirs_pattern($1, ossec_etc_share_t, ossec_etc_share_t)
+#	#read_files_pattern($1, ossec_etc_share_t, ossec_etc_share_t)
+#')
 
+#interface(`ossec_manage_shared_config',`
+#	gen_require(`
+#		type ossec_etc_t;
+#		type ossec_etc_share_t;
+#	')
+#
+#	search_dirs_pattern($1, ossec_etc_t, ossec_etc_t)
+#	search_dirs_pattern($1, ossec_etc_share_t, ossec_etc_share_t)
+#	manage_files_pattern($1, ossec_etc_share_t, ossec_etc_share_t)
+#')
+
+interface(`ossec_pid_filetrans',`
+	gen_require(`
+        type var_t;
+		type ossec_var_t, ossec_var_run_t;
+	')
+
+    allow $1 var_t:dir search_dir_perms;
+	allow $1 ossec_var_t:dir search_dir_perms;
+	allow $1 ossec_var_run_t:lnk_file read_lnk_file_perms;
+	filetrans_pattern($1, ossec_var_run_t, $2, $3, $4)
+')
 
 interface(`ossec_log_filetrans',`
-        gen_require(`
+	gen_require(`
-                type ossec_log_t;
+        type var_t;
-        ')
+		type ossec_var_t, ossec_log_t;
+	')
 
-	allow $1 var_t:dir search_dir_perms;
+    allow $1 var_t:dir search_dir_perms;
-        filetrans_pattern($1, ossec_log_t, $2, $3, $4)
+	allow $1 ossec_log_t:dir search_dir_perms;
+	filetrans_pattern($1, ossec_log_t, $2, $3, $4)
+')
+
+interface(`ossec_read_stats',`
+    gen_require(`
+        type var_t;
+        type ossec_stats_t;
+    ')
+
+    allow $1 var_t:dir search_dir_perms;
+    read_files_pattern($1, ossec_stats_t, ossec_stats_t)
+')
+
+interface(`ossec_manage_stats',`
+    gen_require(`
+        type var_t;
+        type ossec_stats_t;
+    ')
+
+    allow $1 var_t:dir search_dir_perms;
+    append_files_pattern($1, ossec_stats_t, ossec_stats_t)
+')
+
+interface(`ossec_read_queue',`
+    gen_require(`
+        type var_t;
+        type ossec_queue_t;
+    ')
+
+    allow $1 var_t:dir search_dir_perms;
+    allow $1 ossec_queue_t:dir list_dir_perms;
+    allow $1 ossec_queue_t:file read_file_perms;
+    allow $1 ossec_remoted_file_t:dir list_dir_perms;
+    allow $1 ossec_remoted_file_t:file read_file_perms;
+    allow $1 ossec_analysisd_file_t:dir list_dir_perms;
+    allow $1 ossec_analysisd_file_t:file read_file_perms;
+    #read_files_pattern($1, ossec_queue_t, ossec_queue_t)
+')
+
+########################################
+## <summary>
+##      Create objects in the spool directory
+##      with a private type with a type transition.
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+## <param name="file">
+##      <summary>
+##      Type to which the created node will be transitioned.
+##      </summary>
+## </param>
+## <param name="class">
+##      <summary>
+##      Object class(es) (single or set including {}) for which this
+##      the transition will occur.
+##      </summary>
+## </param>
+## <param name="name" optional="true">
+##      <summary>
+##      The name of the object being created.
+##      </summary>
+## </param>
+#
+interface(`ossec_queue_filetrans',`
+    gen_require(`
+        type var_t;
+        type ossec_queue_t;
+    ')
+
+    allow $1 var_t:dir search_dir_perms;
+    allow $1 ossec_queue_t:dir search_dir_perms;
+    filetrans_pattern($1, ossec_queue_t, $2, $3, $4)
+')
+
+########################################
+## <summary>
+##      Create objects in the tmp directory
+##      with a private type with a type transition.
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+## <param name="file">
+##      <summary>
+##      Type to which the created node will be transitioned.
+##      </summary>
+## </param>
+## <param name="class">
+##      <summary>
+##      Object class(es) (single or set including {}) for which this
+##      the transition will occur.
+##      </summary>
+## </param>
+## <param name="name" optional="true">
+##      <summary>
+##      The name of the object being created.
+##      </summary>
+## </param>
+#
+interface(`ossec_tmp_filetrans',`
+    gen_require(`
+        type var_t;
+        type ossec_tmp_t;
+    ')
+
+    allow $1 var_t:dir search_dir_perms;
+    allow $1 ossec_tmp_t:dir search_dir_perms;
+    filetrans_pattern($1, ossec_tmp_t, $2, $3, $4)
 ')
 

ossec.te

@@ -1,91 +1,155 @@
 
-policy_module(ossec,1.0.45)
+policy_module(ossec,1.1.0)
 
 ########################################
 #
 # Declarations
 #
 
-type ossec_t;
+###
-type ossec_bin_t;
+# Active-Response Domain and File Types
-type ossec_exec_t;
+type ossec_ar_t;
-#role system_r types ossec_t;
+type ossec_ar_exec_t;
-#domain_type(ossec_t)
+domain_type(ossec_ar_t)
-#domain_entry_file(ossec_t, ossec_exec_t)
+domain_entry_file(ossec_ar_t, ossec_ar_exec_t)
-init_daemon_domain(ossec_t, ossec_exec_t)
+domtrans_pattern(ossec_execd_t, ossec_ar_exec_t, ossec_ar_t)
+role system_r types ossec_ar_t;
+files_type(ossec_ar_exec_t);
 
-optional_policy(`
+type ossec_ar_bin_t;
-        ossec_domtrans(httpd_t)
+files_type(ossec_ar_bin_t);
-')
 
+unconfined_domain(ossec_ar_t)
+###
+
+# ossec-agentlessd daemon
+type ossec_agentlessd_t;
+type ossec_agentlessd_exec_t;
+init_daemon_domain(ossec_agentlessd_t, ossec_agentlessd_exec_t)
+
+# ossec-analysisd daemon
+type ossec_analysisd_t;
+type ossec_analysisd_exec_t;
+init_daemon_domain(ossec_analysisd_t, ossec_analysisd_exec_t)
+
+type ossec_analysisd_configfile_t;
+files_config_file(ossec_analysisd_configfile_t)
+
+type ossec_analysisd_file_t;
+files_type(ossec_analysisd_file_t)
+
+type ossec_analysisd_sock_t;
+files_type(ossec_analysisd_sock_t)
+
+# ossec-csyslogd daemon
+type ossec_csyslogd_t;
+type ossec_csyslogd_exec_t;
+init_daemon_domain(ossec_csyslogd_t, ossec_csyslogd_exec_t)
+
+# ossec-dbd daemon
+type ossec_dbd_t;
+type ossec_dbd_exec_t;
+init_daemon_domain(ossec_dbd_t, ossec_dbd_exec_t)
+
+# ossec etc dir
+type ossec_etc_t;
+files_config_file(ossec_etc_t)
+
+# ossec-execd daemon
+type ossec_execd_t;
+type ossec_execd_exec_t;
+init_daemon_domain(ossec_execd_t, ossec_execd_exec_t)
+
+type ossec_execd_file_t;
+files_type(ossec_execd_file_t)
+
+type ossec_execd_journal_t;
+files_type(ossec_execd_journal_t)
+
+type ossec_execd_sock_t;
+files_type(ossec_execd_sock_t)
+
+# ossec_initrc
 type ossec_initrc_exec_t;
 init_script_file(ossec_initrc_exec_t)
 
+# ossec-logcollector daemon
+type ossec_logcollector_t;
+type ossec_logcollector_exec_t;
+init_daemon_domain(ossec_logcollector_t, ossec_logcollector_exec_t)
+
+# ossec logs dir
+type ossec_log_t;
+logging_log_file(ossec_log_t)
+
+# ossec-maild daemon
+type ossec_maild_t;
+type ossec_maild_exec_t;
+init_daemon_domain(ossec_maild_t, ossec_maild_exec_t)
+
+# ossec-monitord daemon
+type ossec_monitord_t;
+type ossec_monitord_exec_t;
+init_daemon_domain(ossec_monitord_t, ossec_monitord_exec_t)
+
+# ossec-remoted daemon
+type ossec_remoted_t;
+type ossec_remoted_exec_t;
+init_daemon_domain(ossec_remoted_t, ossec_remoted_exec_t)
+
+type ossec_remoted_configfile_t;
+files_config_file(ossec_remoted_configfile_t);
+
+type ossec_remoted_file_t;
+files_type(ossec_remoted_file_t)
+
+type ossec_remoted_sock_t;
+files_type(ossec_remoted_sock_t)
+
+# ossec-syscheckd daemon
+type ossec_syscheckd_t;
+type ossec_syscheckd_exec_t;
+init_daemon_domain(ossec_syscheckd_t, ossec_syscheckd_exec_t)
+
+
+# ossec bin dir
+type ossec_bin_t;
+files_type(ossec_bin_t)
+
+# ossec queue dir
+type ossec_queue_t;
+files_type(ossec_queue_t)
+
+# ossec rules dir
+type ossec_rule_t;
+files_config_file(ossec_rule_t)
+
+# ossec stats dir
+type ossec_stats_t;
+files_type(ossec_stats_t)
+
+# ossec tmp dir
+type ossec_tmp_t;
+files_tmp_file(ossec_tmp_t)
+
+# ossec var run dir
 type ossec_var_t;
 files_type(ossec_var_t)
 
 type ossec_var_run_t;
 files_pid_file(ossec_var_run_t)
 
-type ossec_tmp_t;
-files_tmp_file(ossec_tmp_t)
-
-type ossec_log_t;
-logging_log_file(ossec_log_t)
-
-type ossec_etc_t;
-files_config_file(ossec_etc_t)
-
-type ossec_etc_share_t;
-files_config_file(ossec_etc_share_t)
-
-type ossec_rule_t;
-files_config_file(ossec_rule_t)
-
-type ossec_stats_t;
-files_type(ossec_stats_t)
-
-type ossec_queue_t;
-files_type(ossec_queue_t)
-
-type ossec_script_t;
-files_type(ossec_script_t)
-
-type ossec_port_t;
-corenet_port(ossec_port_t)
-#create_port_type_interfaces(ossec_port_t, tcp,1514,s0, udp,1514,s0)
-#create_packet_interfaces($1_client)
-#create_packet_interfaces($1_server)
-#network_port(ossec_port_t, tcp,1514,s0)
-#network_port(ossec, tcp,1514,s0, udp,1514,s0)
 
 require {
-	type ossec_t;
-	type ossec_initrc_exec_t;
-	type ossec_var_run_t;
-	type ossec_bin_t;
-	type ossec_exec_t;
-	type ossec_var_t;
-	type ossec_tmp_t;
-	type ossec_log_t;
-	type ossec_etc_t;
-	type ossec_etc_share_t;
-	type ossec_rule_t;
-	type ossec_stats_t;
-	type ossec_queue_t;
-	type ossec_script_t;
-	type ossec_port_t;
 	type httpd_t;
-	type initrc_t;
+	type hi_reserved_port_t;
-	type node_t;
+
-	class file { rename read lock create write getattr unlink open append };
+	class file { rename read lock create write getattr unlink open append entrypoint };
-	class dir { write getattr read remove_name create add_name };
+	#class dir { write getattr read remove_name create add_name };
+	class process { setsched transition rlimitinh siginh noatsecure };
 	class capability { dac_override dac_read_search setuid setgid fsetid sys_chroot sys_nice };
 	class tcp_socket { create name_bind name_connect };
 	class udp_socket { create bind name_bind node_bind };
-	class unix_dgram_socket { create bind getopt connect sendto };
-	class sock_file { unlink };
-	class process { setsched };
 }
 
 
@@ -95,82 +159,164 @@ require {
 #
 
 
-#============= ossec_t ==============
+allow ossec_analysisd_t ossec_log_t:file { create_file_perms append_file_perms read link unlink };
-auth_read_passwd(ossec_t)
+allow ossec_analysisd_t ossec_var_run_t:file manage_file_perms;
+allow ossec_analysisd_t self:capability { dac_override dac_read_search fsetid setuid setgid sys_chroot };
+allow ossec_analysisd_t self:unix_dgram_socket create_stream_socket_perms;
 
-# Read /proc/meminfo
+allow ossec_execd_t ossec_ar_t:process { rlimitinh siginh noatsecure };
-kernel_read_system_state(ossec_t)
+allow ossec_execd_t ossec_execd_file_t:file { create_file_perms rw_file_perms };
+allow ossec_execd_t ossec_execd_journal_t:file manage_file_perms;
+allow ossec_execd_t ossec_log_t:file { create_file_perms append_file_perms read };
+allow ossec_execd_t ossec_var_run_t:file manage_file_perms;
+allow ossec_execd_t self:capability { dac_override dac_read_search setgid };
+allow ossec_execd_t self:unix_dgram_socket create_stream_socket_perms;
 
-# Read urandom
+allow ossec_logcollector_t ossec_log_t:file { create_file_perms append_file_perms read };
-dev_read_urand(ossec_t)
+allow ossec_logcollector_t ossec_var_run_t:file manage_file_perms;
+allow ossec_logcollector_t self:capability { dac_override dac_read_search };
+allow ossec_logcollector_t self:unix_dgram_socket create_socket_perms;
 
-# init
+allow ossec_maild_t ossec_log_t:file { create_file_perms append_file_perms read };
-allow ossec_t self:capability { dac_override dac_read_search setuid setgid fsetid sys_chroot sys_nice };
+allow ossec_maild_t ossec_var_run_t:file manage_file_perms;
-allow ossec_t self:process { setsched };
+allow ossec_maild_t self:capability { dac_override dac_read_search setuid setgid sys_chroot };
+allow ossec_maild_t self:tcp_socket create_socket_perms;
 
-# etc dir
+allow ossec_monitord_t ossec_log_t:file { create_file_perms append_file_perms write read };
-#files_read_etc_files(ossec_t)
+allow ossec_monitord_t ossec_remoted_file_t:file getattr_file_perms;
-sysnet_read_config(ossec_t)
+allow ossec_monitord_t ossec_var_run_t:file manage_file_perms;
+allow ossec_monitord_t self:capability { dac_override dac_read_search setuid setgid sys_chroot };
+allow ossec_monitord_t self:unix_dgram_socket create_socket_perms;
 
-# var dir
+allow ossec_remoted_t ossec_log_t:file { create_file_perms append_file_perms read };
-rw_dirs_pattern(ossec_t, ossec_var_t, ossec_var_t)
+allow ossec_remoted_t ossec_var_run_t:file manage_file_perms;
-#rw_files_pattern(ossec_t, ossec_var_t, ossec_var_t)
+allow ossec_remoted_t self:capability { dac_override dac_read_search setuid setgid sys_chroot };
-#create_files_pattern(ossec_t, ossec_var_t, ossec_var_t)
+allow ossec_remoted_t self:udp_socket create_stream_socket_perms;
-manage_files_pattern(ossec_t, ossec_var_t, ossec_var_t)
+allow ossec_remoted_t self:unix_dgram_socket create_stream_socket_perms;
-manage_sock_files_pattern(ossec_t, ossec_var_t, ossec_var_t)
 
-# queue dir
+allow ossec_syscheckd_t hi_reserved_port_t:tcp_socket name_bind;
-rw_dirs_pattern(ossec_t, ossec_queue_t, ossec_queue_t)
+allow ossec_syscheckd_t hi_reserved_port_t:udp_socket name_bind;
-rw_files_pattern(ossec_t, ossec_queue_t, ossec_queue_t)
+allow ossec_syscheckd_t ossec_log_t:file { create_file_perms append_file_perms read };
-manage_sock_files_pattern(ossec_t, ossec_queue_t, ossec_queue_t)
+allow ossec_syscheckd_t ossec_queue_t:dir { create_dir_perms rw_dir_perms };
-
+allow ossec_syscheckd_t ossec_queue_t:file { create_file_perms rename_file_perms write_file_perms };
-# stats dir
+allow ossec_syscheckd_t ossec_var_run_t:file manage_file_perms;
-rw_dirs_pattern(ossec_t, ossec_stats_t, ossec_stats_t)
+allow ossec_syscheckd_t self:capability { dac_override dac_read_search kill setuid setgid sys_chroot sys_nice };
-rw_files_pattern(ossec_t, ossec_stats_t, ossec_stats_t)
+allow ossec_syscheckd_t self:process { setsched };
-
+allow ossec_syscheckd_t self:tcp_socket create_socket_perms;
-# rules dir
+allow ossec_syscheckd_t self:udp_socket create_socket_perms;
-read_files_pattern(ossec_t, ossec_rule_t, ossec_rule_t)
+allow ossec_syscheckd_t self:unix_dgram_socket create_socket_perms;
-
-# logs
-#logging_log_filetrans(ossec_t, ossec_log_t, file)
-#create_files_pattern(ossec_t, ossec_log_t, ossec_log_t)
-#read_files_pattern(ossec_t, ossec_log_t, ossec_log_t)
-#append_files_pattern(ossec_t, ossec_log_t, ossec_log_t)
-#delete_files_pattern(ossec_t, ossec_log_t, ossec_log_t)
-manage_files_pattern(ossec_t, ossec_log_t, ossec_log_t)
-ossec_log_filetrans(ossec_t, ossec_log_t, file)
-
-# system logs
-logging_read_all_logs(ossec_t)
 
 
-# Allow reading ossec config
+auth_read_passwd(ossec_analysisd_t)
-allow ossec_t ossec_etc_t:dir list_dir_perms;
+auth_read_passwd(ossec_execd_t)
-read_files_pattern(ossec_t, ossec_etc_t, ossec_etc_t)
+auth_read_passwd(ossec_maild_t)
-read_lnk_files_pattern(ossec_t, ossec_etc_t, ossec_etc_t)
+auth_read_passwd(ossec_monitord_t)
+auth_read_passwd(ossec_remoted_t)
 
-# Allow rw etc/shared
+corecmd_exec_bin(ossec_syscheckd_t)
-rw_dirs_pattern(ossec_t, ossec_etc_share_t, ossec_etc_share_t);
+corecmd_exec_shell(ossec_execd_t)
-manage_files_pattern(ossec_t, ossec_etc_share_t, ossec_etc_share_t);
+corecmd_exec_shell(ossec_syscheckd_t)
 
-# Sockets
+corenet_tcp_bind_generic_node(ossec_syscheckd_t)
-allow ossec_t self:udp_socket { create bind node_bind };
+corenet_tcp_bind_generic_port(ossec_syscheckd_t)
-allow ossec_t node_t:udp_socket { node_bind };
+corenet_tcp_bind_reserved_port(ossec_syscheckd_t)
-allow ossec_t ossec_port_t:udp_socket { create_socket_perms create name_bind };
+corenet_tcp_connect_smtp_port(ossec_maild_t)
-#allow ossec_t self:udp_socket { create_socket_perms name_bind };
-#allow ossec_t self:udp_socket name_bind;
 
-allow ossec_t self:unix_dgram_socket { create bind getopt connect sendto };
+corenet_udp_bind_all_unreserved_ports(ossec_remoted_t)
+corenet_udp_bind_generic_node(ossec_remoted_t)
+corenet_udp_bind_generic_node(ossec_syscheckd_t)
+corenet_udp_bind_generic_port(ossec_syscheckd_t)
+corenet_udp_bind_reserved_port(ossec_syscheckd_t)
 
-#============= httpd_t ==============
+dev_getattr_all(ossec_syscheckd_t)
-allow httpd_t ossec_log_t:dir { read };
+dev_read_urand(ossec_execd_t)
-allow httpd_t ossec_log_t:file { open read getattr };
 
-allow httpd_t ossec_queue_t:dir { read };
+dgram_send_pattern(ossec_analysisd_t, ossec_queue_t, ossec_execd_sock_t, ossec_execd_t)
-allow httpd_t ossec_queue_t:file { open read getattr };
+dgram_send_pattern(ossec_analysisd_t, ossec_queue_t, ossec_remoted_sock_t, ossec_remoted_t)
+dgram_send_pattern(ossec_logcollector_t, ossec_queue_t, ossec_analysisd_sock_t, ossec_analysisd_t)
+dgram_send_pattern(ossec_monitord_t, ossec_queue_t, ossec_analysisd_sock_t, ossec_analysisd_t)
+dgram_send_pattern(ossec_remoted_t, ossec_queue_t, ossec_analysisd_sock_t, ossec_analysisd_t)
+dgram_send_pattern(ossec_syscheckd_t, ossec_queue_t, ossec_analysisd_sock_t, ossec_analysisd_t)
 
-allow httpd_t ossec_stats_t:dir { read };
+domain_read_all_domains_state(ossec_syscheckd_t)
-allow httpd_t ossec_stats_t:file { open read getattr };
+domain_dontaudit_getsession_all_domains(ossec_syscheckd_t)
+domain_getsession_all_domains(ossec_syscheckd_t)
+domain_getpgid_all_domains(ossec_syscheckd_t)
+domain_dontaudit_signull_all_domains(ossec_syscheckd_t)
 
+files_dontaudit_getattr_all_sockets(ossec_syscheckd_t)
+files_read_all_files(ossec_syscheckd_t)
+files_read_all_symlinks(ossec_syscheckd_t)
 
+filetrans_pattern(ossec_execd_t, ossec_var_t, ossec_execd_journal_t, file, "execd.sqlite-journal");
+
+list_dirs_pattern(ossec_monitord_t, ossec_queue_t, ossec_remoted_file_t)
+
+logging_read_all_logs(ossec_logcollector_t)
+
+manage_files_pattern(ossec_analysisd_t, ossec_analysisd_file_t, ossec_analysisd_file_t)
+manage_files_pattern(ossec_analysisd_t, ossec_etc_t, ossec_analysisd_configfile_t)
+manage_files_pattern(ossec_analysisd_t, ossec_stats_t, ossec_stats_t)
+manage_files_pattern(ossec_remoted_t, ossec_etc_t, ossec_remoted_configfile_t)
+
+manage_lnk_files_pattern(ossec_syscheckd_t, ossec_tmp_t, ossec_tmp_t)
+
+manage_sock_files_pattern(ossec_analysisd_t, ossec_queue_t, ossec_analysisd_sock_t)
+manage_sock_files_pattern(ossec_execd_t, ossec_queue_t, ossec_execd_sock_t)
+manage_sock_files_pattern(ossec_remoted_t, ossec_queue_t, ossec_remoted_sock_t)
+
+ossec_log_filetrans(ossec_analysisd_t, ossec_log_t, file)
+ossec_log_filetrans(ossec_execd_t, ossec_log_t, file)
+ossec_log_filetrans(ossec_logcollector_t, ossec_log_t, file)
+ossec_log_filetrans(ossec_maild_t, ossec_log_t, file)
+ossec_log_filetrans(ossec_monitord_t, ossec_log_t, file)
+ossec_log_filetrans(ossec_remoted_t, ossec_log_t, file)
+ossec_log_filetrans(ossec_syscheckd_t, ossec_log_t, file)
+
+ossec_pid_filetrans(ossec_analysisd_t, ossec_var_run_t, file)
+ossec_pid_filetrans(ossec_execd_t, ossec_var_run_t, file)
+ossec_pid_filetrans(ossec_logcollector_t, ossec_var_run_t, file)
+ossec_pid_filetrans(ossec_maild_t, ossec_var_run_t, file)
+ossec_pid_filetrans(ossec_monitord_t, ossec_var_run_t, file)
+ossec_pid_filetrans(ossec_remoted_t, ossec_var_run_t, file)
+ossec_pid_filetrans(ossec_syscheckd_t, ossec_var_run_t, file)
+
+ossec_queue_filetrans(ossec_analysisd_t, ossec_analysisd_file_t, file)
+ossec_queue_filetrans(ossec_analysisd_t, ossec_analysisd_sock_t, sock_file)
+ossec_queue_filetrans(ossec_execd_t, ossec_execd_sock_t, sock_file)
+ossec_queue_filetrans(ossec_remoted_t, ossec_remoted_sock_t, sock_file)
+ossec_queue_filetrans(ossec_syscheckd_t, ossec_queue_t, file)
+
+ossec_read_config(ossec_analysisd_t)
+ossec_read_config(ossec_execd_t)
+ossec_read_config(ossec_logcollector_t)
+ossec_read_config(ossec_maild_t)
+ossec_read_config(ossec_monitord_t)
+ossec_read_config(ossec_remoted_t)
+ossec_read_config(ossec_syscheckd_t)
+
+ossec_read_logs(httpd_t)
+ossec_read_queue(httpd_t)
+ossec_read_stats(httpd_t)
+
+ossec_tmp_filetrans(ossec_syscheckd_t, ossec_tmp_t, lnk_file)
+
+read_files_pattern(ossec_analysisd_t, ossec_rule_t, ossec_rule_t)
+
+rw_files_pattern(ossec_remoted_t, ossec_remoted_file_t, ossec_remoted_file_t)
+
+search_dirs_pattern(ossec_analysisd_t, ossec_rule_t, ossec_rule_t)
+search_dirs_pattern(ossec_execd_t, ossec_ar_bin_t, ossec_ar_bin_t)
+
+seutil_read_bin_policy(ossec_syscheckd_t)
+
+sysnet_read_config(ossec_analysisd_t)
+sysnet_read_config(ossec_execd_t)
+sysnet_read_config(ossec_logcollector_t)
+sysnet_read_config(ossec_maild_t)
+sysnet_read_config(ossec_monitord_t)
+sysnet_read_config(ossec_remoted_t)
+sysnet_read_config(ossec_syscheckd_t)
+
+userdom_search_user_tmp_dirs(ossec_syscheckd_t)