7d1f5642b0
Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible. Use permission sets where possible.
118 lines
3.2 KiB
Plaintext
118 lines
3.2 KiB
Plaintext
policy_module(snort, 1.9.1)
|
|
|
|
########################################
|
|
#
|
|
# Declarations
|
|
#
|
|
|
|
type snort_t;
|
|
type snort_exec_t;
|
|
init_daemon_domain(snort_t, snort_exec_t)
|
|
|
|
type snort_etc_t;
|
|
files_config_file(snort_etc_t)
|
|
|
|
type snort_initrc_exec_t;
|
|
init_script_file(snort_initrc_exec_t)
|
|
|
|
type snort_log_t;
|
|
logging_log_file(snort_log_t)
|
|
|
|
type snort_tmp_t;
|
|
files_tmp_file(snort_tmp_t)
|
|
|
|
type snort_var_run_t;
|
|
files_pid_file(snort_var_run_t)
|
|
|
|
########################################
|
|
#
|
|
# Local policy
|
|
#
|
|
|
|
allow snort_t self:capability { setgid setuid net_admin net_raw dac_override };
|
|
dontaudit snort_t self:capability sys_tty_config;
|
|
allow snort_t self:process signal_perms;
|
|
allow snort_t self:netlink_route_socket create_netlink_socket_perms;
|
|
allow snort_t self:tcp_socket create_stream_socket_perms;
|
|
allow snort_t self:udp_socket create_socket_perms;
|
|
allow snort_t self:packet_socket create_socket_perms;
|
|
allow snort_t self:socket create_socket_perms;
|
|
# Snort IPS node. unverified.
|
|
allow snort_t self:netlink_firewall_socket create_socket_perms;
|
|
|
|
allow snort_t snort_etc_t:dir list_dir_perms;
|
|
allow snort_t snort_etc_t:file read_file_perms;
|
|
allow snort_t snort_etc_t:lnk_file read_lnk_file_perms;
|
|
|
|
manage_files_pattern(snort_t, snort_log_t, snort_log_t)
|
|
create_dirs_pattern(snort_t, snort_log_t, snort_log_t)
|
|
logging_log_filetrans(snort_t, snort_log_t, { file dir })
|
|
|
|
manage_dirs_pattern(snort_t, snort_tmp_t, snort_tmp_t)
|
|
manage_files_pattern(snort_t, snort_tmp_t, snort_tmp_t)
|
|
files_tmp_filetrans(snort_t, snort_tmp_t, { file dir })
|
|
|
|
manage_files_pattern(snort_t, snort_var_run_t, snort_var_run_t)
|
|
files_pid_filetrans(snort_t, snort_var_run_t, file)
|
|
|
|
kernel_read_kernel_sysctls(snort_t)
|
|
kernel_read_sysctl(snort_t)
|
|
kernel_list_proc(snort_t)
|
|
kernel_read_proc_symlinks(snort_t)
|
|
kernel_request_load_module(snort_t)
|
|
kernel_dontaudit_read_system_state(snort_t)
|
|
kernel_read_network_state(snort_t)
|
|
|
|
corenet_all_recvfrom_unlabeled(snort_t)
|
|
corenet_all_recvfrom_netlabel(snort_t)
|
|
corenet_tcp_sendrecv_generic_if(snort_t)
|
|
corenet_udp_sendrecv_generic_if(snort_t)
|
|
corenet_raw_sendrecv_generic_if(snort_t)
|
|
corenet_tcp_sendrecv_generic_node(snort_t)
|
|
corenet_udp_sendrecv_generic_node(snort_t)
|
|
corenet_raw_sendrecv_generic_node(snort_t)
|
|
corenet_tcp_sendrecv_all_ports(snort_t)
|
|
corenet_udp_sendrecv_all_ports(snort_t)
|
|
corenet_tcp_connect_prelude_port(snort_t)
|
|
|
|
dev_read_sysfs(snort_t)
|
|
dev_read_rand(snort_t)
|
|
dev_read_urand(snort_t)
|
|
dev_read_usbmon_dev(snort_t)
|
|
# Red Hat bug 559861: Snort wants read, write, and ioctl on /dev/usbmon
|
|
# Snort uses libpcap, which can also monitor USB traffic. Maybe this is a side effect?
|
|
dev_rw_generic_usb_dev(snort_t)
|
|
|
|
domain_use_interactive_fds(snort_t)
|
|
|
|
files_read_etc_files(snort_t)
|
|
files_dontaudit_read_etc_runtime_files(snort_t)
|
|
|
|
fs_getattr_all_fs(snort_t)
|
|
fs_search_auto_mountpoints(snort_t)
|
|
|
|
init_read_utmp(snort_t)
|
|
|
|
logging_send_syslog_msg(snort_t)
|
|
|
|
miscfiles_read_localization(snort_t)
|
|
|
|
sysnet_read_config(snort_t)
|
|
# snorts must be able to resolve dns in case it wants to relay to a remote prelude-manager
|
|
sysnet_dns_name_resolve(snort_t)
|
|
|
|
userdom_dontaudit_use_unpriv_user_fds(snort_t)
|
|
userdom_dontaudit_search_user_home_dirs(snort_t)
|
|
|
|
optional_policy(`
|
|
prelude_manage_spool(snort_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
seutil_sigchld_newrole(snort_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
udev_read_db(snort_t)
|
|
')
|