selinux-policy/policy/modules/services/snort.te

policy_module(snort, 1.9.1)

########################################
#
# Declarations
#

type snort_t;
type snort_exec_t;
init_daemon_domain(snort_t, snort_exec_t)

type snort_etc_t;
files_config_file(snort_etc_t)

type snort_initrc_exec_t;
init_script_file(snort_initrc_exec_t)

type snort_log_t;
logging_log_file(snort_log_t)

type snort_tmp_t;
files_tmp_file(snort_tmp_t)

type snort_var_run_t;
files_pid_file(snort_var_run_t)

########################################
#
# Local policy
#

allow snort_t self:capability { setgid setuid net_admin net_raw dac_override };
dontaudit snort_t self:capability sys_tty_config;
allow snort_t self:process signal_perms;
allow snort_t self:netlink_route_socket create_netlink_socket_perms;
allow snort_t self:tcp_socket create_stream_socket_perms;
allow snort_t self:udp_socket create_socket_perms;
allow snort_t self:packet_socket create_socket_perms;
allow snort_t self:socket create_socket_perms;
# Snort IPS node. unverified.
allow snort_t self:netlink_firewall_socket create_socket_perms;

allow snort_t snort_etc_t:dir list_dir_perms;
allow snort_t snort_etc_t:file read_file_perms;
allow snort_t snort_etc_t:lnk_file read_lnk_file_perms;

manage_files_pattern(snort_t, snort_log_t, snort_log_t)
create_dirs_pattern(snort_t, snort_log_t, snort_log_t)
logging_log_filetrans(snort_t, snort_log_t, { file dir })

manage_dirs_pattern(snort_t, snort_tmp_t, snort_tmp_t)
manage_files_pattern(snort_t, snort_tmp_t, snort_tmp_t)
files_tmp_filetrans(snort_t, snort_tmp_t, { file dir })

manage_files_pattern(snort_t, snort_var_run_t, snort_var_run_t)
files_pid_filetrans(snort_t, snort_var_run_t, file)

kernel_read_kernel_sysctls(snort_t)
kernel_read_sysctl(snort_t)
kernel_list_proc(snort_t)
kernel_read_proc_symlinks(snort_t)
kernel_request_load_module(snort_t)
kernel_dontaudit_read_system_state(snort_t)
kernel_read_network_state(snort_t)

corenet_all_recvfrom_unlabeled(snort_t)
corenet_all_recvfrom_netlabel(snort_t)
corenet_tcp_sendrecv_generic_if(snort_t)
corenet_udp_sendrecv_generic_if(snort_t)
corenet_raw_sendrecv_generic_if(snort_t)
corenet_tcp_sendrecv_generic_node(snort_t)
corenet_udp_sendrecv_generic_node(snort_t)
corenet_raw_sendrecv_generic_node(snort_t)
corenet_tcp_sendrecv_all_ports(snort_t)
corenet_udp_sendrecv_all_ports(snort_t)
corenet_tcp_connect_prelude_port(snort_t)

dev_read_sysfs(snort_t)
dev_read_rand(snort_t)
dev_read_urand(snort_t)
dev_read_usbmon_dev(snort_t)
# Red Hat bug 559861: Snort wants read, write, and ioctl on /dev/usbmon
# Snort uses libpcap, which can also monitor USB traffic. Maybe this is a side effect?
dev_rw_generic_usb_dev(snort_t)

domain_use_interactive_fds(snort_t)

files_read_etc_files(snort_t)
files_dontaudit_read_etc_runtime_files(snort_t)

fs_getattr_all_fs(snort_t)
fs_search_auto_mountpoints(snort_t)

init_read_utmp(snort_t)

logging_send_syslog_msg(snort_t)

miscfiles_read_localization(snort_t)

sysnet_read_config(snort_t)
# snorts must be able to resolve dns in case it wants to relay to a remote prelude-manager
sysnet_dns_name_resolve(snort_t)

userdom_dontaudit_use_unpriv_user_fds(snort_t)
userdom_dontaudit_search_user_home_dirs(snort_t)

optional_policy(`
	prelude_manage_spool(snort_t)
')

optional_policy(`
	seutil_sigchld_newrole(snort_t)
')

optional_policy(`
	udev_read_db(snort_t)
')
Module version bump for c17ad38 5271920 2a2b6a7 01c4413 c4fbfae a831710 67effb0 483be01 c6c63f6 b0d8d59 5b082e4 b8097d6 689d954 5afc3d3 f3c5e77 a59e50c cf87233 17759c7 dc1db54 e9bf16d 4f95198 bf40792 622c63b c20842c dc7cc4d 792d448 2010-09-15 14:42:34 +00:00			`policy_module(snort, 1.9.1)`
add snort, bug 1546 2006-04-05 18:53:26 +00:00
			`########################################`
			`#`
			`# Declarations`
			`#`

			`type snort_t;`
			`type snort_exec_t;`
trunk: massive whitespace cleanup from dominick grift. 2008-07-23 21:38:39 +00:00			`init_daemon_domain(snort_t, snort_exec_t)`
add snort, bug 1546 2006-04-05 18:53:26 +00:00
			`type snort_etc_t;`
trunk: 3 patches from dan. 2008-10-09 18:06:24 +00:00			`files_config_file(snort_etc_t)`

			`type snort_initrc_exec_t;`
			`init_script_file(snort_initrc_exec_t)`
add snort, bug 1546 2006-04-05 18:53:26 +00:00
			`type snort_log_t;`
			`logging_log_file(snort_log_t)`

			`type snort_tmp_t;`
			`files_tmp_file(snort_tmp_t)`

			`type snort_var_run_t;`
			`files_pid_file(snort_var_run_t)`

			`########################################`
			`#`
			`# Local policy`
			`#`

			`allow snort_t self:capability { setgid setuid net_admin net_raw dac_override };`
			`dontaudit snort_t self:capability sys_tty_config;`
			`allow snort_t self:process signal_perms;`
Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. 2010-09-24 07:28:34 +00:00			`allow snort_t self:netlink_route_socket create_netlink_socket_perms;`
add snort, bug 1546 2006-04-05 18:53:26 +00:00			`allow snort_t self:tcp_socket create_stream_socket_perms;`
			`allow snort_t self:udp_socket create_socket_perms;`
			`allow snort_t self:packet_socket create_socket_perms;`
snort patch from Dan Walsh Didn't rearrange all the kernel calls, but did add the kernel_request_load_module. Didn't include the usbmod (doesn't exist in refpolicy at this time). Included the generic usb device permissions because snort uses libpcap, which can also be used to monitor USB traffic, so this may be a side effect. From the red hat bug (559861), it sounds as though snort was failing without these permissions, so it doesn't look like a dontaudit would work. 2010-03-31 18:16:34 +00:00			`allow snort_t self:socket create_socket_perms;`
trunk: 3 patches from dan. 2008-10-09 18:06:24 +00:00			`# Snort IPS node. unverified.`
Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. 2010-09-24 07:28:34 +00:00			`allow snort_t self:netlink_firewall_socket create_socket_perms;`
add snort, bug 1546 2006-04-05 18:53:26 +00:00
merge policy patterns to trunk 2006-12-12 20:08:08 +00:00			`allow snort_t snort_etc_t:dir list_dir_perms;`
			`allow snort_t snort_etc_t:file read_file_perms;`
Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. 2010-09-24 07:28:34 +00:00			`allow snort_t snort_etc_t:lnk_file read_lnk_file_perms;`
add snort, bug 1546 2006-04-05 18:53:26 +00:00
trunk: massive whitespace cleanup from dominick grift. 2008-07-23 21:38:39 +00:00			`manage_files_pattern(snort_t, snort_log_t, snort_log_t)`
			`create_dirs_pattern(snort_t, snort_log_t, snort_log_t)`
			`logging_log_filetrans(snort_t, snort_log_t, { file dir })`
add snort, bug 1546 2006-04-05 18:53:26 +00:00
trunk: massive whitespace cleanup from dominick grift. 2008-07-23 21:38:39 +00:00			`manage_dirs_pattern(snort_t, snort_tmp_t, snort_tmp_t)`
			`manage_files_pattern(snort_t, snort_tmp_t, snort_tmp_t)`
add snort, bug 1546 2006-04-05 18:53:26 +00:00			`files_tmp_filetrans(snort_t, snort_tmp_t, { file dir })`

trunk: massive whitespace cleanup from dominick grift. 2008-07-23 21:38:39 +00:00			`manage_files_pattern(snort_t, snort_var_run_t, snort_var_run_t)`
			`files_pid_filetrans(snort_t, snort_var_run_t, file)`
add snort, bug 1546 2006-04-05 18:53:26 +00:00
			`kernel_read_kernel_sysctls(snort_t)`
snort patch from dan. 2009-07-27 20:04:10 +00:00			`kernel_read_sysctl(snort_t)`
add snort, bug 1546 2006-04-05 18:53:26 +00:00			`kernel_list_proc(snort_t)`
			`kernel_read_proc_symlinks(snort_t)`
snort patch from Dan Walsh Didn't rearrange all the kernel calls, but did add the kernel_request_load_module. Didn't include the usbmod (doesn't exist in refpolicy at this time). Included the generic usb device permissions because snort uses libpcap, which can also be used to monitor USB traffic, so this may be a side effect. From the red hat bug (559861), it sounds as though snort was failing without these permissions, so it doesn't look like a dontaudit would work. 2010-03-31 18:16:34 +00:00			`kernel_request_load_module(snort_t)`
add snort, bug 1546 2006-04-05 18:53:26 +00:00			`kernel_dontaudit_read_system_state(snort_t)`
snort patch from Dan Walsh 2010-09-02 19:42:51 +00:00			`kernel_read_network_state(snort_t)`
add snort, bug 1546 2006-04-05 18:53:26 +00:00
trunk: Unified labeled networking policy from Paul Moore. The latest revision of the labeled policy patches which enable both labeled and unlabeled policy support for NetLabel. This revision takes into account Chris' feedback from the first version and reduces the number of interface calls in each domain down to two at present: one for unlabeled access, one for NetLabel access. The older, transport layer specific interfaces, are still present for use by third-party modules but are not used in the default policy modules. trunk: Use netmsg initial SID for MLS-only Netlabel packets, from Paul Moore. This patch changes the policy to use the netmsg initial SID as the "base" SID/context for NetLabel packets which only have MLS security attributes. Currently we use the unlabeled initial SID which makes it very difficult to distinquish between actual unlabeled packets and those packets which have MLS security attributes. 2007-06-27 15:23:21 +00:00			`corenet_all_recvfrom_unlabeled(snort_t)`
			`corenet_all_recvfrom_netlabel(snort_t)`
add snort, bug 1546 2006-04-05 18:53:26 +00:00			`corenet_tcp_sendrecv_generic_if(snort_t)`
			`corenet_udp_sendrecv_generic_if(snort_t)`
			`corenet_raw_sendrecv_generic_if(snort_t)`
trunk: Remove node definitions and change node usage to generic nodes. 2009-01-09 19:48:02 +00:00			`corenet_tcp_sendrecv_generic_node(snort_t)`
			`corenet_udp_sendrecv_generic_node(snort_t)`
			`corenet_raw_sendrecv_generic_node(snort_t)`
add snort, bug 1546 2006-04-05 18:53:26 +00:00			`corenet_tcp_sendrecv_all_ports(snort_t)`
			`corenet_udp_sendrecv_all_ports(snort_t)`
snort patch from dan. 2009-07-27 20:04:10 +00:00			`corenet_tcp_connect_prelude_port(snort_t)`
add snort, bug 1546 2006-04-05 18:53:26 +00:00
			`dev_read_sysfs(snort_t)`
trunk: 3 patches from dan. 2008-10-09 18:06:24 +00:00			`dev_read_rand(snort_t)`
			`dev_read_urand(snort_t)`
snort patch from Dan Walsh 2010-09-02 19:42:51 +00:00			`dev_read_usbmon_dev(snort_t)`
snort patch from Dan Walsh Didn't rearrange all the kernel calls, but did add the kernel_request_load_module. Didn't include the usbmod (doesn't exist in refpolicy at this time). Included the generic usb device permissions because snort uses libpcap, which can also be used to monitor USB traffic, so this may be a side effect. From the red hat bug (559861), it sounds as though snort was failing without these permissions, so it doesn't look like a dontaudit would work. 2010-03-31 18:16:34 +00:00			`# Red Hat bug 559861: Snort wants read, write, and ioctl on /dev/usbmon`
			`# Snort uses libpcap, which can also monitor USB traffic. Maybe this is a side effect?`
			`dev_rw_generic_usb_dev(snort_t)`
add snort, bug 1546 2006-04-05 18:53:26 +00:00
			`domain_use_interactive_fds(snort_t)`

			`files_read_etc_files(snort_t)`
			`files_dontaudit_read_etc_runtime_files(snort_t)`

			`fs_getattr_all_fs(snort_t)`
			`fs_search_auto_mountpoints(snort_t)`

trunk: 3 patches from dan. 2008-10-09 18:06:24 +00:00			`init_read_utmp(snort_t)`

add snort, bug 1546 2006-04-05 18:53:26 +00:00			`logging_send_syslog_msg(snort_t)`

			`miscfiles_read_localization(snort_t)`

			`sysnet_read_config(snort_t)`
snort patch from dan. 2009-07-27 20:04:10 +00:00			`# snorts must be able to resolve dns in case it wants to relay to a remote prelude-manager`
			`sysnet_dns_name_resolve(snort_t)`
add snort, bug 1546 2006-04-05 18:53:26 +00:00
			`userdom_dontaudit_use_unpriv_user_fds(snort_t)`
trunk: merge UBAC. 2008-11-05 16:10:46 +00:00			`userdom_dontaudit_search_user_home_dirs(snort_t)`
add snort, bug 1546 2006-04-05 18:53:26 +00:00
snort patch from dan. 2009-07-27 20:04:10 +00:00			optional_policy(`
			`prelude_manage_spool(snort_t)`
			`')`

add snort, bug 1546 2006-04-05 18:53:26 +00:00			optional_policy(`
			`seutil_sigchld_newrole(snort_t)`
			`')`

			optional_policy(`
			`udev_read_db(snort_t)`
			`')`