trunk: add kismet from dan.
This commit is contained in:
Chris PeBenito
parent
9968e25bf5
commit
ff79b83c51
|
|
@ -7,6 +7,8 @@
|
|||
- Add file for enabling policy capabilities.
|
||||
- Patch to fix leaky interface/template call depth calculator from Vaclav
|
||||
Ovsik.
|
||||
- Added modules:
|
||||
kismet (Dan Walsh)
|
||||
|
||||
* Wed Apr 02 2008 Chris PeBenito <selinux@tresys.com> - 20080402
|
||||
- Add core Security Enhanced X Windows support.
|
||||
|
|
|
|||
|
|
@ -0,0 +1,4 @@
|
|||
/usr/bin/kismet -- gen_context(system_u:object_r:kismet_exec_t,s0)
|
||||
/var/lib/kismet(/.*)? gen_context(system_u:object_r:kismet_var_lib_t,s0)
|
||||
/var/log/kismet(/.*)? gen_context(system_u:object_r:kismet_log_t,s0)
|
||||
/var/run/kismet_server.pid -- gen_context(system_u:object_r:kismet_var_run_t,s0)
|
||||
|
|
@ -0,0 +1,252 @@
|
|||
## <summary>Kismet is an 802.11 layer2 wireless network detector, sniffer, and intrusion detection system.</summary>
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Execute a domain transition to run kismet.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed to transition.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`kismet_domtrans',`
|
||||
gen_require(`
|
||||
type kismet_t, kismet_exec_t;
|
||||
')
|
||||
|
||||
domtrans_pattern($1, kismet_exec_t, kismet_t)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Execute kismet in the kismet domain, and
|
||||
## allow the specified role the kismet domain.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access
|
||||
## </summary>
|
||||
## </param>
|
||||
## <param name="role">
|
||||
## <summary>
|
||||
## The role to be allowed the kismet domain.
|
||||
## </summary>
|
||||
## </param>
|
||||
## <param name="terminal">
|
||||
## <summary>
|
||||
## The type of the role's terminal.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`kismet_run',`
|
||||
gen_require(`
|
||||
type kismet_t;
|
||||
')
|
||||
|
||||
kismet_domtrans($1)
|
||||
role $2 types kismet_t;
|
||||
allow kismet_t $3:chr_file rw_term_perms;
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Read kismet PID files.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`kismet_read_pid_files',`
|
||||
gen_require(`
|
||||
type kismet_var_run_t;
|
||||
')
|
||||
|
||||
allow $1 kismet_var_run_t:file read_file_perms;
|
||||
files_search_pids($1)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Manage kismet var_run files.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`kismet_manage_pid_files',`
|
||||
gen_require(`
|
||||
type kismet_var_run_t;
|
||||
')
|
||||
|
||||
allow $1 kismet_var_run_t:file manage_file_perms;
|
||||
files_search_pids($1)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Search kismet lib directories.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`kismet_search_lib',`
|
||||
gen_require(`
|
||||
type kismet_var_lib_t;
|
||||
')
|
||||
|
||||
allow $1 kismet_var_lib_t:dir search_dir_perms;
|
||||
files_search_var_lib($1)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Read kismet lib files.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`kismet_read_lib_files',`
|
||||
gen_require(`
|
||||
type kismet_var_lib_t;
|
||||
')
|
||||
|
||||
allow $1 kismet_var_lib_t:file read_file_perms;
|
||||
allow $1 kismet_var_lib_t:dir list_dir_perms;
|
||||
files_search_var_lib($1)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Create, read, write, and delete
|
||||
## kismet lib files.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`kismet_manage_lib_files',`
|
||||
gen_require(`
|
||||
type kismet_var_lib_t;
|
||||
')
|
||||
|
||||
manage_files_pattern($1, kismet_var_lib_t, kismet_var_lib_t)
|
||||
files_search_var_lib($1)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Manage kismet var_lib files.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`kismet_manage_lib',`
|
||||
gen_require(`
|
||||
type kismet_var_lib_t;
|
||||
')
|
||||
|
||||
manage_dirs_pattern($1, kismet_var_lib_t, kismet_var_lib_t)
|
||||
manage_files_pattern($1, kismet_var_lib_t, kismet_var_lib_t)
|
||||
manage_lnk_files_pattern($1, kismet_var_lib_t, kismet_var_lib_t)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Allow the specified domain to read kismet's log files.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
## <rolecap/>
|
||||
#
|
||||
interface(`kismet_read_log',`
|
||||
gen_require(`
|
||||
type kismet_log_t;
|
||||
')
|
||||
|
||||
logging_search_logs($1)
|
||||
read_files_pattern($1, kismet_log_t, kismet_log_t)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Allow the specified domain to append
|
||||
## kismet log files.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed to transition.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`kismet_append_log',`
|
||||
gen_require(`
|
||||
type var_log_t, kismet_log_t;
|
||||
')
|
||||
|
||||
logging_search_logs($1)
|
||||
append_files_pattern($1, kismet_log_t, kismet_log_t)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Allow domain to manage kismet log files
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain to not audit.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`kismet_manage_log',`
|
||||
gen_require(`
|
||||
type kismet_log_t;
|
||||
')
|
||||
|
||||
manage_dirs_pattern($1, kismet_log_t, kismet_log_t)
|
||||
manage_files_pattern($1, kismet_log_t, kismet_log_t)
|
||||
manage_lnk_files_pattern($1, kismet_log_t, kismet_log_t)
|
||||
logging_search_logs($1)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## All of the rules required to administrate an kismet environment
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
## <rolecap/>
|
||||
#
|
||||
interface(`kismet_admin',`
|
||||
gen_require(`
|
||||
type kismet_t;
|
||||
')
|
||||
|
||||
ps_process_pattern($1, kismet_t)
|
||||
allow $1 kismet_t:process { ptrace signal_perms };
|
||||
|
||||
kismet_manage_pids($1)
|
||||
kismet_manage_var_lib($1)
|
||||
kismet_manage_log($1)
|
||||
')
|
||||
|
|
@ -0,0 +1,51 @@
|
|||
|
||||
policy_module(kismet, 1.0.0)
|
||||
|
||||
########################################
|
||||
#
|
||||
# Declarations
|
||||
#
|
||||
|
||||
type kismet_t;
|
||||
type kismet_exec_t;
|
||||
application_domain(kismet_t, kismet_exec_t)
|
||||
role system_r types kismet_t;
|
||||
|
||||
type kismet_var_run_t;
|
||||
files_pid_file(kismet_var_run_t)
|
||||
|
||||
type kismet_var_lib_t;
|
||||
files_type(kismet_var_lib_t)
|
||||
|
||||
type kismet_log_t;
|
||||
logging_log_file(kismet_log_t)
|
||||
|
||||
########################################
|
||||
#
|
||||
# kismet local policy
|
||||
#
|
||||
|
||||
allow kismet_t self:capability { net_admin setuid setgid };
|
||||
|
||||
manage_files_pattern(kismet_t, kismet_log_t, kismet_log_t)
|
||||
allow kismet_t kismet_log_t:dir setattr;
|
||||
logging_log_filetrans(kismet_t, kismet_log_t, { file dir })
|
||||
|
||||
allow kismet_t kismet_var_lib_t:file manage_file_perms;
|
||||
allow kismet_t kismet_var_lib_t:dir manage_dir_perms;
|
||||
files_var_lib_filetrans(kismet_t, kismet_var_lib_t, { file dir })
|
||||
|
||||
allow kismet_t kismet_var_run_t:file manage_file_perms;
|
||||
allow kismet_t kismet_var_run_t:dir manage_dir_perms;
|
||||
files_pid_filetrans(kismet_t, kismet_var_run_t, { file dir })
|
||||
|
||||
corecmd_exec_bin(kismet_t)
|
||||
|
||||
auth_use_nsswitch(kismet_t)
|
||||
|
||||
files_read_etc_files(kismet_t)
|
||||
|
||||
libs_use_ld_so(kismet_t)
|
||||
libs_use_shared_libs(kismet_t)
|
||||
|
||||
miscfiles_read_localization(kismet_t)
|
||||
Loading…
Reference in New Issue