selinux-policy/policy/modules/services/fail2ban.te

policy_module(fail2ban, 1.4.0)

########################################
#
# Declarations
#

type fail2ban_t;
type fail2ban_exec_t;
init_daemon_domain(fail2ban_t, fail2ban_exec_t)

type fail2ban_initrc_exec_t;
init_script_file(fail2ban_initrc_exec_t)

# log files
type fail2ban_log_t;
logging_log_file(fail2ban_log_t)

type fail2ban_var_lib_t;
files_type(fail2ban_var_lib_t)

# pid files
type fail2ban_var_run_t;
files_pid_file(fail2ban_var_run_t)

########################################
#
# fail2ban local policy
#

allow fail2ban_t self:capability { sys_tty_config };
allow fail2ban_t self:process signal;
allow fail2ban_t self:fifo_file rw_fifo_file_perms;
allow fail2ban_t self:unix_stream_socket { connectto create_stream_socket_perms };
allow fail2ban_t self:unix_dgram_socket create_socket_perms;
allow fail2ban_t self:tcp_socket create_stream_socket_perms;

# log files
allow fail2ban_t fail2ban_log_t:dir setattr_dir_perms;
manage_files_pattern(fail2ban_t, fail2ban_log_t, fail2ban_log_t)
logging_log_filetrans(fail2ban_t, fail2ban_log_t, file)

manage_dirs_pattern(fail2ban_t, fail2ban_var_lib_t, fail2ban_var_lib_t)
manage_files_pattern(fail2ban_t, fail2ban_var_lib_t, fail2ban_var_lib_t)
files_var_lib_filetrans(fail2ban_t, fail2ban_var_lib_t, { dir file })

# pid file
manage_dirs_pattern(fail2ban_t, fail2ban_var_run_t, fail2ban_var_run_t)
manage_sock_files_pattern(fail2ban_t, fail2ban_var_run_t, fail2ban_var_run_t)
manage_files_pattern(fail2ban_t, fail2ban_var_run_t, fail2ban_var_run_t)
files_pid_filetrans(fail2ban_t, fail2ban_var_run_t, { dir file sock_file })

kernel_read_system_state(fail2ban_t)

corecmd_exec_bin(fail2ban_t)
corecmd_exec_shell(fail2ban_t)

corenet_all_recvfrom_unlabeled(fail2ban_t)
corenet_all_recvfrom_netlabel(fail2ban_t)
corenet_tcp_sendrecv_generic_if(fail2ban_t)
corenet_tcp_sendrecv_generic_node(fail2ban_t)
corenet_tcp_sendrecv_all_ports(fail2ban_t)
corenet_tcp_connect_whois_port(fail2ban_t)
corenet_sendrecv_whois_client_packets(fail2ban_t)

dev_read_urand(fail2ban_t)

domain_use_interactive_fds(fail2ban_t)

files_read_etc_files(fail2ban_t)
files_read_etc_runtime_files(fail2ban_t)
files_read_usr_files(fail2ban_t)
files_list_var(fail2ban_t)
files_search_var_lib(fail2ban_t)

fs_list_inotifyfs(fail2ban_t)
fs_getattr_all_fs(fail2ban_t)

auth_use_nsswitch(fail2ban_t)

logging_read_all_logs(fail2ban_t)
logging_send_syslog_msg(fail2ban_t)

miscfiles_read_localization(fail2ban_t)

mta_send_mail(fail2ban_t)

optional_policy(`
	apache_read_log(fail2ban_t)
')

optional_policy(`
	ftp_read_log(fail2ban_t)
')

optional_policy(`
	gnome_dontaudit_search_config(fail2ban_t)
')

optional_policy(`
	iptables_domtrans(fail2ban_t)
')
Bump module versions for release. 2010-05-24 19:32:01 +00:00			`policy_module(fail2ban, 1.4.0)`
add fail2ban from dan 2007-03-21 15:51:52 +00:00
			`########################################`
			`#`
			`# Declarations`
			`#`

			`type fail2ban_t;`
			`type fail2ban_exec_t;`
			`init_daemon_domain(fail2ban_t, fail2ban_exec_t)`

trunk: rename labeled init scripts with initrc convention. 2008-09-15 14:20:20 +00:00			`type fail2ban_initrc_exec_t;`
			`init_script_file(fail2ban_initrc_exec_t)`

add fail2ban from dan 2007-03-21 15:51:52 +00:00			`# log files`
			`type fail2ban_log_t;`
			`logging_log_file(fail2ban_log_t)`

trunk: 10 patches from dan. 2009-06-12 19:44:10 +00:00			`type fail2ban_var_lib_t;`
			`files_type(fail2ban_var_lib_t)`

add fail2ban from dan 2007-03-21 15:51:52 +00:00			`# pid files`
			`type fail2ban_var_run_t;`
			`files_pid_file(fail2ban_var_run_t)`

			`########################################`
			`#`
			`# fail2ban local policy`
			`#`

trunk: 10 patches from dan. 2009-06-12 19:44:10 +00:00			`allow fail2ban_t self:capability { sys_tty_config };`
add fail2ban from dan 2007-03-21 15:51:52 +00:00			`allow fail2ban_t self:process signal;`
			`allow fail2ban_t self:fifo_file rw_fifo_file_perms;`
trunk: fail2ban update from dan. 2008-09-05 14:17:18 +00:00			`allow fail2ban_t self:unix_stream_socket { connectto create_stream_socket_perms };`
Fail2ban patch from Dan Walsh. 2009-12-18 15:39:10 +00:00			`allow fail2ban_t self:unix_dgram_socket create_socket_perms;`
trunk: fail2ban update from dan. 2008-09-05 14:17:18 +00:00			`allow fail2ban_t self:tcp_socket create_stream_socket_perms;`
add fail2ban from dan 2007-03-21 15:51:52 +00:00
			`# log files`
Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. 2010-09-22 10:02:34 +00:00			`allow fail2ban_t fail2ban_log_t:dir setattr_dir_perms;`
trunk: massive whitespace cleanup from dominick grift. 2008-07-23 21:38:39 +00:00			`manage_files_pattern(fail2ban_t, fail2ban_log_t, fail2ban_log_t)`
			`logging_log_filetrans(fail2ban_t, fail2ban_log_t, file)`
add fail2ban from dan 2007-03-21 15:51:52 +00:00
trunk: 10 patches from dan. 2009-06-12 19:44:10 +00:00			`manage_dirs_pattern(fail2ban_t, fail2ban_var_lib_t, fail2ban_var_lib_t)`
			`manage_files_pattern(fail2ban_t, fail2ban_var_lib_t, fail2ban_var_lib_t)`
			`files_var_lib_filetrans(fail2ban_t, fail2ban_var_lib_t, { dir file })`

add fail2ban from dan 2007-03-21 15:51:52 +00:00			`# pid file`
trunk: 21 patches from dan. 2008-10-08 15:50:03 +00:00			`manage_dirs_pattern(fail2ban_t, fail2ban_var_run_t, fail2ban_var_run_t)`
trunk: fail2ban update from dan. 2008-09-05 14:17:18 +00:00			`manage_sock_files_pattern(fail2ban_t, fail2ban_var_run_t, fail2ban_var_run_t)`
trunk: massive whitespace cleanup from dominick grift. 2008-07-23 21:38:39 +00:00			`manage_files_pattern(fail2ban_t, fail2ban_var_run_t, fail2ban_var_run_t)`
trunk: 21 patches from dan. 2008-10-08 15:50:03 +00:00			`files_pid_filetrans(fail2ban_t, fail2ban_var_run_t, { dir file sock_file })`
add fail2ban from dan 2007-03-21 15:51:52 +00:00
			`kernel_read_system_state(fail2ban_t)`

			`corecmd_exec_bin(fail2ban_t)`
			`corecmd_exec_shell(fail2ban_t)`

trunk: fail2ban update from dan. 2008-09-05 14:17:18 +00:00			`corenet_all_recvfrom_unlabeled(fail2ban_t)`
			`corenet_all_recvfrom_netlabel(fail2ban_t)`
			`corenet_tcp_sendrecv_generic_if(fail2ban_t)`
trunk: Remove node definitions and change node usage to generic nodes. 2009-01-09 19:48:02 +00:00			`corenet_tcp_sendrecv_generic_node(fail2ban_t)`
trunk: fail2ban update from dan. 2008-09-05 14:17:18 +00:00			`corenet_tcp_sendrecv_all_ports(fail2ban_t)`
			`corenet_tcp_connect_whois_port(fail2ban_t)`
			`corenet_sendrecv_whois_client_packets(fail2ban_t)`

add fail2ban from dan 2007-03-21 15:51:52 +00:00			`dev_read_urand(fail2ban_t)`

			`domain_use_interactive_fds(fail2ban_t)`

			`files_read_etc_files(fail2ban_t)`
trunk: fail2ban update from dan. 2008-09-05 14:17:18 +00:00			`files_read_etc_runtime_files(fail2ban_t)`
add fail2ban from dan 2007-03-21 15:51:52 +00:00			`files_read_usr_files(fail2ban_t)`
trunk: fail2ban update from dan. 2008-09-05 14:17:18 +00:00			`files_list_var(fail2ban_t)`
			`files_search_var_lib(fail2ban_t)`

			`fs_list_inotifyfs(fail2ban_t)`
			`fs_getattr_all_fs(fail2ban_t)`

			`auth_use_nsswitch(fail2ban_t)`
add fail2ban from dan 2007-03-21 15:51:52 +00:00
trunk: fail2ban update from dan. 2008-09-05 14:17:18 +00:00			`logging_read_all_logs(fail2ban_t)`
Fail2ban patch from Dan Walsh. 2009-12-18 15:39:10 +00:00			`logging_send_syslog_msg(fail2ban_t)`
add fail2ban from dan 2007-03-21 15:51:52 +00:00
			`miscfiles_read_localization(fail2ban_t)`

trunk: fail2ban update from dan. 2008-09-05 14:17:18 +00:00			`mta_send_mail(fail2ban_t)`

add fail2ban from dan 2007-03-21 15:51:52 +00:00			optional_policy(`
			`apache_read_log(fail2ban_t)`
			`')`

			optional_policy(`
			`ftp_read_log(fail2ban_t)`
			`')`

UPdate for f14 policy 2010-08-26 13:41:21 +00:00			optional_policy(`
Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. Whitespace, newline and tab fixes. 2010-09-22 10:07:37 +00:00			`gnome_dontaudit_search_config(fail2ban_t)`
UPdate for f14 policy 2010-08-26 13:41:21 +00:00			`')`

add fail2ban from dan 2007-03-21 15:51:52 +00:00			optional_policy(`
			`iptables_domtrans(fail2ban_t)`
			`')`