policy_module(ossec,1.0.165) ######################################## # # Declarations # # ossec bin dir type ossec_bin_t; files_type(ossec_bin_t) # ossec-maild daemon type ossec_maild_t; type ossec_maild_exec_t; init_daemon_domain(ossec_maild_t, ossec_maild_exec_t) # ossec-execd daemon type ossec_execd_t; type ossec_execd_exec_t; init_daemon_domain(ossec_execd_t, ossec_execd_exec_t) # ossec-analysisd daemon type ossec_analysisd_t; type ossec_analysisd_exec_t; init_daemon_domain(ossec_analysisd_t, ossec_analysisd_exec_t) # ossec-logcollector daemon type ossec_logcollector_t; type ossec_logcollector_exec_t; init_daemon_domain(ossec_logcollector_t, ossec_logcollector_exec_t) # ossec-remoted daemon type ossec_remoted_t; type ossec_remoted_exec_t; init_daemon_domain(ossec_remoted_t, ossec_remoted_exec_t) # ossec-syscheckd daemon type ossec_syscheckd_t; type ossec_syscheckd_exec_t; init_daemon_domain(ossec_syscheckd_t, ossec_syscheckd_exec_t) # ossec-monitord daemon type ossec_monitord_t; type ossec_monitord_exec_t; init_daemon_domain(ossec_monitord_t, ossec_monitord_exec_t) # ossec-dbd daemon type ossec_dbd_t; type ossec_dbd_exec_t; init_daemon_domain(ossec_dbd_t, ossec_dbd_exec_t) # ossec-csyslogd daemon type ossec_csyslogd_t; type ossec_csyslogd_exec_t; init_daemon_domain(ossec_csyslogd_t, ossec_csyslogd_exec_t) # ossec-agentlessd daemon type ossec_agentlessd_t; type ossec_agentlessd_exec_t; init_daemon_domain(ossec_agentlessd_t, ossec_agentlessd_exec_t) # initrc type ossec_initrc_exec_t; init_script_file(ossec_initrc_exec_t) optional_policy(` ossec_domtrans(httpd_t) ') # ossec var dir type ossec_var_t; files_type(ossec_var_t) # ossec var run dir type ossec_var_run_t; files_pid_file(ossec_var_run_t) # ossec tmp dir type ossec_tmp_t; files_tmp_file(ossec_tmp_t) # ossec logs dir type ossec_log_t; logging_log_file(ossec_log_t) # ossec etc dir type ossec_etc_t; files_config_file(ossec_etc_t) # ossec etc share dir type ossec_etc_share_t; files_config_file(ossec_etc_share_t) # ossec rules dir type ossec_rule_t; files_config_file(ossec_rule_t) # ossec stats dir type ossec_stats_t; files_type(ossec_stats_t) # ossec queue dir type ossec_queue_t; files_type(ossec_queue_t) ### # Active-Response Domain and File Types type ossec_ar_t; type ossec_ar_bin_t; files_type(ossec_ar_bin_t); type ossec_ar_exec_t; files_type(ossec_ar_exec_t); domain_type(ossec_ar_t) domain_entry_file(ossec_ar_t, ossec_ar_exec_t) domtrans_pattern(ossec_execd_t, ossec_ar_exec_t, ossec_ar_t) role system_r types ossec_ar_t; unconfined_domain(ossec_ar_t) ### #type ossec_script_t; #type ossec_script_exec_t; #files_type(ossec_script_t) #domain_type(ossec_script_t) #domain_entry_file(ossec_script_t, ossec_script_exec_t) #domtrans_pattern(ossec_execd_t, ossec_script_exec_t, ossec_script_t) #role system_r types ossec_script_t; #unconfined_domain(ossec_script_t) ##unconfined_run(ossec_script_exec_t, ossec_script_t) ##type_transition ossec_execd_t ossec_script_exec_t:process unconfined_t; ##files_type(ossec_script_exec_t) ##domain_type(ossec_script_exec_t) ##domain_entry_file(ossec_script_exec_t, ossec_execd_t) ###domtrans_pattern(unconfined_t, ossec_script_exec_t, ossec_execd_t) ##unconfined_domain(ossec_script_exec_t) ##unconfined_shell_domtrans(ossec_script_exec_t) ##unconfined_run(ossec_execd_t, system_r) ##unconfined_run(ossec_script_exec_t, ossec_script_t) require { type ossec_bin_t; type ossec_maild_t; type ossec_maild_exec_t; type ossec_execd_t; type ossec_execd_exec_t; type ossec_analysisd_t; type ossec_analysisd_exec_t; type ossec_logcollector_t; type ossec_logcollector_exec_t; type ossec_remoted_t; type ossec_remoted_exec_t; type ossec_syscheckd_t; type ossec_syscheckd_exec_t; type ossec_monitord_t; type ossec_monitord_exec_t; type ossec_dbd_t; type ossec_dbd_exec_t; type ossec_csyslogd_t; type ossec_csyslogd_exec_t; type ossec_agentlessd_t; type ossec_agentlessd_exec_t; type ossec_var_t; type ossec_tmp_t; type ossec_log_t; type ossec_etc_t; type ossec_rule_t; type ossec_stats_t; type ossec_queue_t; type ossec_ar_t; type ossec_ar_bin_t; type ossec_ar_exec_t; type httpd_t; type httpd_log_t; type unreserved_port_t; type smtp_port_t; type node_t; type shell_exec_t; type unconfined_t; class file { rename read lock create write getattr unlink open append entrypoint }; class dir { write getattr read remove_name create add_name }; class process { setsched transition rlimitinh siginh noatsecure }; class capability { dac_override dac_read_search setuid setgid fsetid sys_chroot sys_nice }; class tcp_socket { create name_bind name_connect }; class udp_socket { create bind name_bind node_bind }; } ######################################## # # ossec local policy # #============= ossec_maild_t ============== auth_read_passwd(ossec_maild_t) # init allow ossec_maild_t self:capability { dac_override dac_read_search setuid setgid sys_chroot }; # etc dir ossec_read_config(ossec_maild_t) #search_dirs_pattern(ossec_maild_t, ossec_etc_t, ossec_etc_t) #read_lnk_files_pattern(ossec_maild_t, ossec_etc_t, ossec_etc_t) #read_files_pattern(ossec_maild_t, ossec_etc_t, ossec_etc_t) #sysnet_read_config(ossec_maild_t) # var dir search_dirs_pattern(ossec_maild_t, ossec_var_t, ossec_var_t) # var run dir manage_dirs_pattern(ossec_maild_t, ossec_var_run_t, ossec_var_run_t) manage_files_pattern(ossec_maild_t, ossec_var_run_t, ossec_var_run_t) # logs search_dirs_pattern(ossec_maild_t, ossec_log_t, ossec_log_t) read_files_pattern(ossec_maild_t, ossec_log_t, ossec_log_t) allow ossec_maild_t ossec_log_t:file { create_file_perms append_file_perms }; logging_log_filetrans(ossec_maild_t, ossec_log_t, file) # Sockets allow ossec_maild_t self:tcp_socket { create connect read write }; allow ossec_maild_t smtp_port_t:tcp_socket { name_connect }; #============= ossec_execd_t ============== # init auth_read_passwd(ossec_execd_t) allow ossec_execd_t self:capability { dac_override dac_read_search setgid }; # etc dir ossec_read_config(ossec_execd_t) #search_dirs_pattern(ossec_execd_t, ossec_etc_t, ossec_etc_t) #read_lnk_files_pattern(ossec_execd_t, ossec_etc_t, ossec_etc_t) #read_files_pattern(ossec_execd_t, ossec_etc_t, ossec_etc_t) ##sysnet_read_config(ossec_execd_t) # etc share dir search_dirs_pattern(ossec_execd_t, ossec_etc_share_t, ossec_etc_share_t) read_files_pattern(ossec_execd_t, ossec_etc_share_t, ossec_etc_share_t) #manage_files_pattern(ossec_execd_t, ossec_etc_share_t, ossec_etc_share_t) # var dir #search_dirs_pattern(ossec_execd_t, ossec_var_t, ossec_var_t) rw_dirs_pattern(ossec_execd_t, ossec_var_t, ossec_var_t) #rw_files_pattern(ossec_execd_t, ossec_var_t, ossec_var_t) #create_files_pattern(ossec_execd_t, ossec_var_t, ossec_var_t) manage_files_pattern(ossec_execd_t, ossec_var_t, ossec_var_t) # var run dir manage_dirs_pattern(ossec_execd_t, ossec_var_run_t, ossec_var_run_t) manage_files_pattern(ossec_execd_t, ossec_var_run_t, ossec_var_run_t) # queue dir rw_dirs_pattern(ossec_execd_t, ossec_queue_t, ossec_queue_t) manage_sock_files_pattern(ossec_execd_t, ossec_queue_t, ossec_queue_t); # logs search_dirs_pattern(ossec_execd_t, ossec_log_t, ossec_log_t) read_files_pattern(ossec_execd_t, ossec_log_t, ossec_log_t) allow ossec_execd_t ossec_log_t:file { create_file_perms append_file_perms }; logging_log_filetrans(ossec_execd_t, ossec_log_t, file) # script dir search_dirs_pattern(ossec_execd_t, ossec_ar_bin_t, ossec_ar_bin_t) #search_dirs_pattern(ossec_execd_t, ossec_script_t, ossec_script_t) #read_files_pattern(ossec_execd_t, ossec_script_exec_t, ossec_script_exec_t) #exec_files_pattern(ossec_execd_t, ossec_script_exec_t, ossec_script_exec_t) exec_files_pattern(ossec_execd_t, shell_exec_t, shell_exec_t) # dgram socket allow ossec_execd_t self:unix_dgram_socket { create bind getopt read write }; # Read urandom dev_read_urand(ossec_execd_t) # Run autoresponce unconstrained allow ossec_execd_t ossec_ar_t:process { rlimitinh siginh noatsecure }; #allow ossec_execd_t ossec_script_t:process { rlimitinh siginh noatsecure }; ##allow ossec_execd_t unconfined_t:process { transition rlimitinh siginh noatsecure }; ##allow unconfined_t ossec_script_exec_t:file { entrypoint }; ###unconfined_domtrans(ossec_script_t) ###unconfined_run(ossec_execd_t, ossec_script_t) #============= ossec_analysisd_t ============== # init auth_read_passwd(ossec_analysisd_t) allow ossec_analysisd_t self:capability { dac_override dac_read_search fsetid setuid setgid sys_chroot }; # etc dir ossec_read_config(ossec_analysisd_t) #search_dirs_pattern(ossec_analysisd_t, ossec_etc_t, ossec_etc_t) #read_lnk_files_pattern(ossec_analysisd_t, ossec_etc_t, ossec_etc_t) #read_files_pattern(ossec_analysisd_t, ossec_etc_t, ossec_etc_t) ##sysnet_read_config(ossec_maild_t) # etc share dir search_dirs_pattern(ossec_analysisd_t, ossec_etc_share_t, ossec_etc_share_t) manage_files_pattern(ossec_analysisd_t, ossec_etc_share_t, ossec_etc_share_t) # var dir search_dirs_pattern(ossec_analysisd_t, ossec_var_t, ossec_var_t) #rw_dirs_pattern(ossec_execd_t, ossec_var_t, ossec_var_t) ##rw_files_pattern(ossec_execd_t, ossec_var_t, ossec_var_t) ##create_files_pattern(ossec_execd_t, ossec_var_t, ossec_var_t) ##manage_files_pattern(ossec_execd_t, ossec_var_t, ossec_var_t) # var run dir manage_dirs_pattern(ossec_analysisd_t, ossec_var_run_t, ossec_var_run_t) manage_files_pattern(ossec_analysisd_t, ossec_var_run_t, ossec_var_run_t) # queue dir rw_dirs_pattern(ossec_analysisd_t, ossec_queue_t, ossec_queue_t) rw_files_pattern(ossec_analysisd_t, ossec_queue_t, ossec_queue_t) manage_sock_files_pattern(ossec_analysisd_t, ossec_queue_t, ossec_queue_t) # stats dir rw_dirs_pattern(ossec_analysisd_t, ossec_stats_t, ossec_stats_t) rw_files_pattern(ossec_analysisd_t, ossec_stats_t, ossec_stats_t) create_files_pattern(ossec_analysisd_t, ossec_stats_t, ossec_stats_t) append_files_pattern(ossec_analysisd_t, ossec_stats_t, ossec_stats_t) # logs #search_dirs_pattern(ossec_analysisd_t, ossec_log_t, ossec_log_t) add_entry_dirs_pattern(ossec_analysisd_t, ossec_log_t, ossec_log_t) manage_files_pattern(ossec_analysisd_t, ossec_log_t, ossec_log_t) #read_files_pattern(ossec_analysisd_t, ossec_log_t, ossec_log_t) #delete_files_pattern(ossec_analysisd_t, ossec_log_t, ossec_log_t) #allow ossec_analysisd_t ossec_log_t:file { create_file_perms append_file_perms }; logging_log_filetrans(ossec_analysisd_t, ossec_log_t, file) # rules dir search_dirs_pattern(ossec_analysisd_t, ossec_rule_t, ossec_rule_t) read_files_pattern(ossec_analysisd_t, ossec_rule_t, ossec_rule_t) # dgram socket allow ossec_analysisd_t self:unix_dgram_socket { create bind getopt connect read write }; allow ossec_analysisd_t ossec_execd_t:unix_dgram_socket { sendto }; allow ossec_analysisd_t ossec_remoted_t:unix_dgram_socket { sendto }; #============= ossec_logcollector_t ============== # init ##auth_read_passwd(ossec_execd_t) allow ossec_logcollector_t self:capability { dac_override dac_read_search }; # etc dir ossec_read_config(ossec_logcollector_t) #search_dirs_pattern(ossec_logcollector_t, ossec_etc_t, ossec_etc_t) #read_lnk_files_pattern(ossec_logcollector_t, ossec_etc_t, ossec_etc_t) #read_files_pattern(ossec_logcollector_t, ossec_etc_t, ossec_etc_t) # var dir search_dirs_pattern(ossec_logcollector_t, ossec_var_t, ossec_var_t) # var run dir manage_dirs_pattern(ossec_logcollector_t, ossec_var_run_t, ossec_var_run_t) manage_files_pattern(ossec_logcollector_t, ossec_var_run_t, ossec_var_run_t) # queue dir search_dirs_pattern(ossec_logcollector_t, ossec_queue_t, ossec_queue_t) #rw_dirs_pattern(ossec_analysisd_t, ossec_queue_t, ossec_queue_t) #rw_files_pattern(ossec_analysisd_t, ossec_queue_t, ossec_queue_t) manage_sock_files_pattern(ossec_logcollector_t, ossec_queue_t, ossec_queue_t) # logs search_dirs_pattern(ossec_logcollector_t, ossec_log_t, ossec_log_t) #add_entry_dirs_pattern(ossec_analysisd_t, ossec_log_t, ossec_log_t) #manage_files_pattern(ossec_analysisd_t, ossec_log_t, ossec_log_t) read_files_pattern(ossec_logcollector_t, ossec_log_t, ossec_log_t) ##delete_files_pattern(ossec_analysisd_t, ossec_log_t, ossec_log_t) ##allow ossec_analysisd_t ossec_log_t:file { create_file_perms append_file_perms }; logging_log_filetrans(ossec_logcollector_t, ossec_log_t, file) search_dirs_pattern(ossec_logcollector_t, httpd_log_t, httpd_log_t) read_files_pattern(ossec_logcollector_t, httpd_log_t, httpd_log_t) read_files_pattern(ossec_logcollector_t, var_log_t, var_log_t) # dgram socket allow ossec_logcollector_t self:unix_dgram_socket { create bind getopt connect write }; allow ossec_logcollector_t ossec_analysisd_t:unix_dgram_socket { sendto }; #============= ossec_remoted_t ============== # init auth_read_passwd(ossec_remoted_t) allow ossec_remoted_t self:capability { dac_override dac_read_search setuid setgid sys_chroot }; # etc dir ossec_read_config(ossec_remoted_t) #search_dirs_pattern(ossec_remoted_t, ossec_etc_t, ossec_etc_t) #read_lnk_files_pattern(ossec_remoted_t, ossec_etc_t, ossec_etc_t) #read_files_pattern(ossec_remoted_t, ossec_etc_t, ossec_etc_t) # etc share dir search_dirs_pattern(ossec_remoted_t, ossec_etc_share_t, ossec_etc_share_t) read_files_pattern(ossec_remoted_t, ossec_etc_share_t, ossec_etc_share_t) manage_files_pattern(ossec_remoted_t, ossec_etc_share_t, ossec_etc_share_t) # var dir search_dirs_pattern(ossec_remoted_t, ossec_var_t, ossec_var_t) # var run dir manage_dirs_pattern(ossec_remoted_t, ossec_var_run_t, ossec_var_run_t) manage_files_pattern(ossec_remoted_t, ossec_var_run_t, ossec_var_run_t) # queue dir search_dirs_pattern(ossec_remoted_t, ossec_queue_t, ossec_queue_t) ##rw_dirs_pattern(ossec_analysisd_t, ossec_queue_t, ossec_queue_t) rw_files_pattern(ossec_remoted_t, ossec_queue_t, ossec_queue_t) manage_sock_files_pattern(ossec_remoted_t, ossec_queue_t, ossec_queue_t) # logs search_dirs_pattern(ossec_remoted_t, ossec_log_t, ossec_log_t) #add_entry_dirs_pattern(ossec_analysisd_t, ossec_log_t, ossec_log_t) #manage_files_pattern(ossec_analysisd_t, ossec_log_t, ossec_log_t) read_files_pattern(ossec_remoted_t, ossec_log_t, ossec_log_t) ##delete_files_pattern(ossec_analysisd_t, ossec_log_t, ossec_log_t) ##allow ossec_analysisd_t ossec_log_t:file { create_file_perms append_file_perms }; logging_log_filetrans(ossec_remoted_t, ossec_log_t, file) # Sockets allow ossec_remoted_t self:udp_socket { create bind read write }; allow ossec_remoted_t unreserved_port_t:udp_socket { name_bind }; allow ossec_remoted_t node_t:udp_socket { node_bind }; allow ossec_remoted_t self:tcp_socket { create bind }; #allow ossec_remoted_t unreserved_port_t:tcp_socket { name_bind }; #allow ossec_remoted_t node_t:tcp_socket { node_bind }; # dgram socket allow ossec_remoted_t self:unix_dgram_socket { create bind getopt connect read write }; allow ossec_remoted_t ossec_analysisd_t:unix_dgram_socket { sendto }; #============= ossec_syscheckd_t ============== # init #auth_read_passwd(ossec_syschecld_t) allow ossec_syscheckd_t self:capability { dac_override dac_read_search setuid setgid sys_chroot sys_nice }; allow ossec_syscheckd_t self:process { setsched }; # etc dir ossec_read_config(ossec_syscheckd_t) #search_dirs_pattern(ossec_syscheckd_t, ossec_etc_t, ossec_etc_t) #read_lnk_files_pattern(ossec_syscheckd_t, ossec_etc_t, ossec_etc_t) #read_files_pattern(ossec_syscheckd_t, ossec_etc_t, ossec_etc_t) # var dir search_dirs_pattern(ossec_syscheckd_t, ossec_var_t, ossec_var_t) # var run dir manage_dirs_pattern(ossec_syscheckd_t, ossec_var_run_t, ossec_var_run_t) manage_files_pattern(ossec_syscheckd_t, ossec_var_run_t, ossec_var_run_t) # queue dir search_dirs_pattern(ossec_syscheckd_t, ossec_queue_t, ossec_queue_t) ##rw_dirs_pattern(ossec_analysisd_t, ossec_queue_t, ossec_queue_t) #rw_files_pattern(ossec_remoted_t, ossec_queue_t, ossec_queue_t) manage_sock_files_pattern(ossec_syscheckd_t, ossec_queue_t, ossec_queue_t) # logs search_dirs_pattern(ossec_syscheckd_t, ossec_log_t, ossec_log_t) #add_entry_dirs_pattern(ossec_analysisd_t, ossec_log_t, ossec_log_t) #manage_files_pattern(ossec_analysisd_t, ossec_log_t, ossec_log_t) read_files_pattern(ossec_syscheckd_t, ossec_log_t, ossec_log_t) ##delete_files_pattern(ossec_analysisd_t, ossec_log_t, ossec_log_t) ##allow ossec_analysisd_t ossec_log_t:file { create_file_perms append_file_perms }; logging_log_filetrans(ossec_syscheckd_t, ossec_log_t, file) # dgram socket allow ossec_syscheckd_t self:unix_dgram_socket { create bind getopt connect write }; allow ossec_syscheckd_t ossec_analysisd_t:unix_dgram_socket { sendto }; # Sockets allow ossec_syscheckd_t self:udp_socket { create connect read write bind }; allow ossec_syscheckd_t self:tcp_socket { create connect read write }; #allow ossec_d_t smtp_port_t:tcp_socket { name_connect }; # all the things files_read_all_files(ossec_syscheckd_t) files_read_all_symlinks(ossec_syscheckd_t) kernel_getattr_proc_files(ossec_syscheckd_t) #============= ossec-monitord_t ============== # init auth_read_passwd(ossec_monitord_t) allow ossec_monitord_t self:capability { dac_override dac_read_search setuid setgid sys_chroot }; # etc dir ossec_read_config(ossec_monitord_t) #search_dirs_pattern(ossec_monitord_t, ossec_etc_t, ossec_etc_t) #read_lnk_files_pattern(ossec_monitord_t, ossec_etc_t, ossec_etc_t) #read_files_pattern(ossec_monitord_t, ossec_etc_t, ossec_etc_t) # var dir search_dirs_pattern(ossec_monitord_t, ossec_var_t, ossec_var_t) # var run dir manage_dirs_pattern(ossec_monitord_t, ossec_var_run_t, ossec_var_run_t) manage_files_pattern(ossec_monitord_t, ossec_var_run_t, ossec_var_run_t) # queue dir search_dirs_pattern(ossec_monitord_t, ossec_queue_t, ossec_queue_t) ##rw_dirs_pattern(ossec_analysisd_t, ossec_queue_t, ossec_queue_t) #rw_files_pattern(ossec_monitord_t, ossec_queue_t, ossec_queue_t) read_files_pattern(ossec_monitord_t, ossec_queue_t, ossec_queue_t) manage_sock_files_pattern(ossec_monitord_t, ossec_queue_t, ossec_queue_t) # logs rw_dirs_pattern(ossec_monitord_t, ossec_log_t, ossec_log_t) #add_entry_dirs_pattern(ossec_analysisd_t, ossec_log_t, ossec_log_t) #manage_files_pattern(ossec_analysisd_t, ossec_log_t, ossec_log_t) rw_files_pattern(ossec_monitord_t, ossec_log_t, ossec_log_t) ##delete_files_pattern(ossec_analysisd_t, ossec_log_t, ossec_log_t) ##allow ossec_analysisd_t ossec_log_t:file { create_file_perms append_file_perms }; logging_log_filetrans(ossec_monitord_t, ossec_log_t, file) # dgram socket allow ossec_monitord_t self:unix_dgram_socket { create bind getopt connect write }; allow ossec_monitord_t ossec_analysisd_t:unix_dgram_socket { sendto }; #============= httpd_t ============== allow httpd_t ossec_log_t:dir { read }; allow httpd_t ossec_log_t:file { open read getattr }; allow httpd_t ossec_queue_t:dir { read }; allow httpd_t ossec_queue_t:file { open read getattr }; allow httpd_t ossec_stats_t:dir { read }; allow httpd_t ossec_stats_t:file { open read getattr };