148 lines
3.6 KiB
Plaintext
148 lines
3.6 KiB
Plaintext
|
#DESC CLAM - Anti-virus program
|
||
|
|
#
|
||
|
|
# Author: Brian May <bam@snoopy.apana.org.au>
|
||
|
|
# X-Debian-Packages: clamav
|
||
|
|
#
|
||
|
|
|
||
|
|
#################################
|
||
|
|
#
|
||
|
|
# Rules for the clamscan_t domain.
|
||
|
|
#
|
||
|
|
|
||
|
|
# Virus database
|
||
|
|
type clamav_var_lib_t, file_type, sysadmfile;
|
||
|
|
|
||
|
|
# clamscan_t is the domain of the clamscan virus scanner
|
||
|
|
type clamscan_exec_t, file_type, sysadmfile, exec_type;
|
||
|
|
|
||
|
|
##########
|
||
|
|
##########
|
||
|
|
|
||
|
|
#
|
||
|
|
# Freshclam
|
||
|
|
#
|
||
|
|
|
||
|
|
daemon_base_domain(freshclam, `, web_client_domain')
|
||
|
|
read_locale(freshclam_t)
|
||
|
|
|
||
|
|
# not sure why it needs this
|
||
|
|
read_sysctl(freshclam_t)
|
||
|
|
|
||
|
|
can_network_client_tcp(freshclam_t, http_port_t);
|
||
|
|
allow freshclam_t http_port_t:tcp_socket name_connect;
|
||
|
|
can_resolve(freshclam_t)
|
||
|
|
can_ypbind(freshclam_t)
|
||
|
|
|
||
|
|
# Access virus signatures
|
||
|
|
allow freshclam_t { var_t var_lib_t }:dir search;
|
||
|
|
rw_dir_create_file(freshclam_t, clamav_var_lib_t)
|
||
|
|
|
||
|
|
allow freshclam_t devtty_t:chr_file { read write };
|
||
|
|
allow freshclam_t devpts_t:dir search;
|
||
|
|
allow freshclam_t etc_t:file { getattr read };
|
||
|
|
allow freshclam_t proc_t:file { getattr read };
|
||
|
|
|
||
|
|
allow freshclam_t urandom_device_t:chr_file { getattr read };
|
||
|
|
dontaudit freshclam_t urandom_device_t:chr_file ioctl;
|
||
|
|
|
||
|
|
# for nscd
|
||
|
|
dontaudit freshclam_t var_run_t:dir search;
|
||
|
|
|
||
|
|
# setuid/getuid used (although maybe not required...)
|
||
|
|
allow freshclam_t self:capability { setgid setuid };
|
||
|
|
|
||
|
|
allow freshclam_t sbin_t:dir search;
|
||
|
|
|
||
|
|
# Allow notification to daemon that virus database has changed
|
||
|
|
can_clamd_connect(freshclam)
|
||
|
|
|
||
|
|
allow freshclam_t etc_runtime_t:file { read getattr };
|
||
|
|
allow freshclam_t self:unix_stream_socket create_stream_socket_perms;
|
||
|
|
allow freshclam_t self:unix_dgram_socket create_socket_perms;
|
||
|
|
allow freshclam_t self:fifo_file rw_file_perms;
|
||
|
|
|
||
|
|
# Log files for freshclam executable
|
||
|
|
logdir_domain(freshclam)
|
||
|
|
allow initrc_t freshclam_log_t:file append;
|
||
|
|
|
||
|
|
# Pid files for freshclam
|
||
|
|
allow initrc_t clamd_var_run_t:file { create setattr };
|
||
|
|
|
||
|
|
system_crond_entry(freshclam_exec_t, freshclam_t)
|
||
|
|
domain_auto_trans(logrotate_t, freshclam_exec_t, freshclam_t)
|
||
|
|
|
||
|
|
domain_auto_trans(sysadm_t, freshclam_exec_t, freshclam_t)
|
||
|
|
role sysadm_r types freshclam_t;
|
||
|
|
|
||
|
|
create_dir_file(freshclam_t, clamd_var_run_t)
|
||
|
|
|
||
|
|
##########
|
||
|
|
##########
|
||
|
|
|
||
|
|
#
|
||
|
|
# Clamscan
|
||
|
|
#
|
||
|
|
|
||
|
|
# macros/program/clamav_macros.te.
|
||
|
|
user_clamscan_domain(sysadm)
|
||
|
|
|
||
|
|
##########
|
||
|
|
##########
|
||
|
|
|
||
|
|
#
|
||
|
|
# Clamd
|
||
|
|
#
|
||
|
|
|
||
|
|
type clamd_sock_t, file_type, sysadmfile;
|
||
|
|
|
||
|
|
# clamd executable
|
||
|
|
daemon_domain(clamd)
|
||
|
|
|
||
|
|
tmp_domain(clamd)
|
||
|
|
|
||
|
|
# The dir containing the clamd log files is labelled freshclam_t
|
||
|
|
logdir_domain(clamd)
|
||
|
|
allow clamd_t freshclam_log_t:dir search;
|
||
|
|
|
||
|
|
allow clamd_t self:capability { kill setgid setuid dac_override };
|
||
|
|
|
||
|
|
# Give the clamd local communications socket a unique type
|
||
|
|
ifdef(`distro_debian', `
|
||
|
|
file_type_auto_trans(clamd_t, var_run_t, clamd_sock_t, sock_file)
|
||
|
|
')
|
||
|
|
ifdef(`distro_redhat', `
|
||
|
|
file_type_auto_trans(clamd_t, clamd_var_run_t, clamd_sock_t, sock_file)
|
||
|
|
')
|
||
|
|
|
||
|
|
# Clamd can be configured to listen on a TCP port.
|
||
|
|
can_network_server_tcp(clamd_t, clamd_port_t)
|
||
|
|
allow clamd_t clamd_port_t:tcp_socket name_bind;
|
||
|
|
can_resolve(clamd_t);
|
||
|
|
|
||
|
|
allow clamd_t var_lib_t:dir search;
|
||
|
|
r_dir_file(clamd_t, clamav_var_lib_t)
|
||
|
|
r_dir_file(clamd_t, etc_t)
|
||
|
|
# allow access /proc/sys/kernel/version
|
||
|
|
read_sysctl(clamd_t)
|
||
|
|
allow clamd_t self:unix_stream_socket create_stream_socket_perms;
|
||
|
|
allow clamd_t self:unix_dgram_socket create_stream_socket_perms;
|
||
|
|
allow clamd_t self:fifo_file rw_file_perms;
|
||
|
|
|
||
|
|
allow clamd_t { random_device_t urandom_device_t }:chr_file { getattr read };
|
||
|
|
dontaudit clamd_t { random_device_t urandom_device_t }:chr_file ioctl;
|
||
|
|
|
||
|
|
|
||
|
|
##########
|
||
|
|
##########
|
||
|
|
|
||
|
|
#
|
||
|
|
# Interaction with external programs
|
||
|
|
#
|
||
|
|
|
||
|
|
ifdef(`amavis.te',`
|
||
|
|
allow amavisd_t clamd_var_run_t:dir search;
|
||
|
|
allow amavisd_t clamd_t:unix_stream_socket connectto;
|
||
|
|
allow amavisd_t clamd_sock_t:sock_file write;
|
||
|
|
')
|
||
|
|
|