From 4f7b413cdc4b54f1d2b83fa2340647d83702f06a Mon Sep 17 00:00:00 2001 From: Jeremy Solt Date: Thu, 8 Apr 2010 10:28:53 -0400 Subject: [PATCH] Ntop policy from Dan Walsh Added alias for ntop_http_content_t in apache Pulled in ntop port from corenetwork patch --- policy/modules/kernel/corenetwork.te.in | 1 + policy/modules/services/apache.te | 1 + policy/modules/services/ntop.te | 34 +++++++++++++++++-------- 3 files changed, 25 insertions(+), 11 deletions(-) diff --git a/policy/modules/kernel/corenetwork.te.in b/policy/modules/kernel/corenetwork.te.in index 48baaa19..0da42157 100644 --- a/policy/modules/kernel/corenetwork.te.in +++ b/policy/modules/kernel/corenetwork.te.in @@ -146,6 +146,7 @@ network_port(nessus, tcp,1241,s0) network_port(netsupport, tcp,5404,s0, udp,5404,s0, tcp,5405,s0, udp,5405,s0) network_port(nmbd, udp,137,s0, udp,138,s0) network_port(ntp, udp,123,s0) +network_port(ntop, tcp,3000,s0, udp,3000,s0, tcp,3001,s0, udp,3001,s0) network_port(ocsp, tcp,9080,s0) network_port(openvpn, tcp,1194,s0, udp,1194,s0) network_port(pegasus_http, tcp,5988,s0) diff --git a/policy/modules/services/apache.te b/policy/modules/services/apache.te index 39585ecb..e0779a0f 100644 --- a/policy/modules/services/apache.te +++ b/policy/modules/services/apache.te @@ -217,6 +217,7 @@ files_tmp_file(httpd_suexec_tmp_t) # setup the system domain for system CGI scripts apache_content_template(sys) +typealias httpd_sys_content_t alias ntop_http_content_t; type httpd_tmp_t; files_tmp_file(httpd_tmp_t) diff --git a/policy/modules/services/ntop.te b/policy/modules/services/ntop.te index 45d23d5b..b9210ed7 100644 --- a/policy/modules/services/ntop.te +++ b/policy/modules/services/ntop.te @@ -11,12 +11,12 @@ type ntop_exec_t; init_daemon_domain(ntop_t, ntop_exec_t) application_domain(ntop_t, ntop_exec_t) +type ntop_initrc_exec_t; +init_script_file(ntop_initrc_exec_t) + type ntop_etc_t; files_config_file(ntop_etc_t) -type ntop_http_content_t; -files_type(ntop_http_content_t) - type ntop_tmp_t; files_tmp_file(ntop_tmp_t) @@ -37,26 +37,28 @@ allow ntop_t self:process signal_perms; allow ntop_t self:fifo_file rw_fifo_file_perms; allow ntop_t self:tcp_socket create_stream_socket_perms; allow ntop_t self:udp_socket create_socket_perms; +allow ntop_t self:unix_dgram_socket create_socket_perms; +allow ntop_t self:unix_stream_socket create_stream_socket_perms; allow ntop_t self:packet_socket create_socket_perms; +allow ntop_t self:socket create_socket_perms; allow ntop_t ntop_etc_t:dir list_dir_perms; read_files_pattern(ntop_t, ntop_etc_t, ntop_etc_t) read_lnk_files_pattern(ntop_t, ntop_etc_t, ntop_etc_t) -allow ntop_t ntop_http_content_t:dir list_dir_perms; -read_files_pattern(ntop_t, ntop_http_content_t, ntop_http_content_t) - manage_dirs_pattern(ntop_t, ntop_tmp_t, ntop_tmp_t) manage_files_pattern(ntop_t, ntop_tmp_t, ntop_tmp_t) files_tmp_filetrans(ntop_t, ntop_tmp_t, { file dir }) -create_dirs_pattern(ntop_t, ntop_var_lib_t, ntop_var_lib_t) -manage_files_pattern(ntop_t, ntop_var_lib_t, ntop_var_lib_t) -files_var_lib_filetrans(ntop_t, ntop_var_lib_t, file) +manage_dirs_pattern(ntop_t, ntop_var_lib_t, ntop_var_lib_t) +manage_files_pattern(ntop_t, ntop_var_lib_t, ntop_var_lib_t) +files_var_lib_filetrans(ntop_t, ntop_var_lib_t, { file dir } ) manage_files_pattern(ntop_t, ntop_var_run_t, ntop_var_run_t) files_pid_filetrans(ntop_t, ntop_var_run_t, file) +kernel_request_load_module(ntop_t) +kernel_read_system_state(ntop_t) kernel_read_network_state(ntop_t) kernel_read_kernel_sysctls(ntop_t) kernel_list_proc(ntop_t) @@ -72,25 +74,35 @@ corenet_udp_sendrecv_generic_node(ntop_t) corenet_raw_sendrecv_generic_node(ntop_t) corenet_tcp_sendrecv_all_ports(ntop_t) corenet_udp_sendrecv_all_ports(ntop_t) +corenet_tcp_bind_ntop_port(ntop_t) +corenet_tcp_connect_ntop_port(ntop_t) +corenet_tcp_connect_http_port(ntop_t) dev_read_sysfs(ntop_t) +dev_rw_generic_usb_dev(ntop_t) domain_use_interactive_fds(ntop_t) files_read_etc_files(ntop_t) +files_read_usr_files(ntop_t) fs_getattr_all_fs(ntop_t) fs_search_auto_mountpoints(ntop_t) +auth_use_nsswitch(ntop_t) + logging_send_syslog_msg(ntop_t) miscfiles_read_localization(ntop_t) - -sysnet_read_config(ntop_t) +miscfiles_read_fonts(ntop_t) userdom_dontaudit_use_unpriv_user_fds(ntop_t) userdom_dontaudit_search_user_home_dirs(ntop_t) +optional_policy(` + apache_read_sys_content(ntop_t) +') + optional_policy(` seutil_sigchld_newrole(ntop_t) ')