55 lines
1.4 KiB
Plaintext
55 lines
1.4 KiB
Plaintext
#DESC Nessus network scanning daemon
|
|
#
|
|
# Author: Russell Coker <russell@coker.com.au>
|
|
# X-Debian-Packages: nessus
|
|
#
|
|
|
|
#################################
|
|
#
|
|
# Rules for the nessusd_t domain.
|
|
#
|
|
# nessusd_exec_t is the type of the nessusd executable.
|
|
#
|
|
daemon_domain(nessusd)
|
|
|
|
etc_domain(nessusd)
|
|
type nessusd_db_t, file_type, sysadmfile;
|
|
|
|
allow nessusd_t nessus_port_t:tcp_socket name_bind;
|
|
|
|
#tmp_domain(nessusd)
|
|
|
|
# Use the network.
|
|
can_network(nessusd_t)
|
|
allow nessusd_t port_type:tcp_socket name_connect;
|
|
can_ypbind(nessusd_t)
|
|
allow nessusd_t self:unix_stream_socket create_socket_perms;
|
|
#allow nessusd_t self:unix_dgram_socket create_socket_perms;
|
|
|
|
# why ioctl on /dev/urandom?
|
|
allow nessusd_t random_device_t:chr_file { getattr read ioctl };
|
|
allow nessusd_t self:{ rawip_socket packet_socket } create_socket_perms;
|
|
allow nessusd_t self:capability net_raw;
|
|
|
|
# for nmap etc
|
|
allow nessusd_t { bin_t sbin_t }:dir search;
|
|
allow nessusd_t bin_t:lnk_file read;
|
|
can_exec(nessusd_t, bin_t)
|
|
allow nessusd_t self:fifo_file { getattr read write };
|
|
|
|
# allow user domains to connect to nessusd
|
|
can_tcp_connect(userdomain, nessusd_t)
|
|
|
|
allow nessusd_t self:process setsched;
|
|
|
|
allow nessusd_t proc_t:file { getattr read };
|
|
|
|
# Allow access to the nessusd authentication database
|
|
create_dir_file(nessusd_t, nessusd_db_t)
|
|
allow nessusd_t var_lib_t:dir r_dir_perms;
|
|
|
|
# read config files
|
|
allow nessusd_t { etc_t etc_runtime_t }:file r_file_perms;
|
|
|
|
logdir_domain(nessusd)
|