rpms/selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity

snort patch from dan.

Browse Source
This commit is contained in:
Chris PeBenito 2009-07-27 16:04:10 -04:00
parent 5f6c30f8bd
commit ebf3ec9063
2 changed files with 10 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
policy/modules/services/snort.if
View File

@ -38,7 +38,7 @@ interface(`snort_domtrans',`
interface(`snort_admin',` interface(`snort_admin',`
gen_require(` gen_require(`
type snort_t, snort_var_run_t, snort_log_t; type snort_t, snort_var_run_t, snort_log_t;
type snort_initrc_exec_t; type snort_etc_t, snort_initrc_exec_t;
') ')
allow $1 snort_t:process { ptrace signal_perms }; allow $1 snort_t:process { ptrace signal_perms };

10
policy/modules/services/snort.te
View File

@ -1,5 +1,5 @@
policy_module(snort, 1.7.1) policy_module(snort, 1.7.2)
######################################## ########################################
# #
@ -56,6 +56,7 @@ manage_files_pattern(snort_t, snort_var_run_t, snort_var_run_t)
files_pid_filetrans(snort_t, snort_var_run_t, file) files_pid_filetrans(snort_t, snort_var_run_t, file)
kernel_read_kernel_sysctls(snort_t) kernel_read_kernel_sysctls(snort_t)
kernel_read_sysctl(snort_t)
kernel_list_proc(snort_t) kernel_list_proc(snort_t)
kernel_read_proc_symlinks(snort_t) kernel_read_proc_symlinks(snort_t)
kernel_dontaudit_read_system_state(snort_t) kernel_dontaudit_read_system_state(snort_t)
@ -70,6 +71,7 @@ corenet_udp_sendrecv_generic_node(snort_t)
corenet_raw_sendrecv_generic_node(snort_t) corenet_raw_sendrecv_generic_node(snort_t)
corenet_tcp_sendrecv_all_ports(snort_t) corenet_tcp_sendrecv_all_ports(snort_t)
corenet_udp_sendrecv_all_ports(snort_t) corenet_udp_sendrecv_all_ports(snort_t)
corenet_tcp_connect_prelude_port(snort_t)
dev_read_sysfs(snort_t) dev_read_sysfs(snort_t)
dev_read_rand(snort_t) dev_read_rand(snort_t)
@ -90,10 +92,16 @@ logging_send_syslog_msg(snort_t)
miscfiles_read_localization(snort_t) miscfiles_read_localization(snort_t)
sysnet_read_config(snort_t) sysnet_read_config(snort_t)
# snorts must be able to resolve dns in case it wants to relay to a remote prelude-manager
sysnet_dns_name_resolve(snort_t)
userdom_dontaudit_use_unpriv_user_fds(snort_t) userdom_dontaudit_use_unpriv_user_fds(snort_t)
userdom_dontaudit_search_user_home_dirs(snort_t) userdom_dontaudit_search_user_home_dirs(snort_t)
optional_policy(`
prelude_manage_spool(snort_t)
')
optional_policy(` optional_policy(`
seutil_sigchld_newrole(snort_t) seutil_sigchld_newrole(snort_t)
') ')