policy/modules/apps/wireshark.te

   1 policy_module(wireshark, 2.1.1)
   2
   3 ########################################
   4 #
   5 # Declarations
   6 #
   7
   8 type wireshark_t;
   9 type wireshark_exec_t;
  10 typealias wireshark_t alias { user_wireshark_t staff_wireshark_t sysadm_wireshark_t };
  11 typealias wireshark_t alias { auditadm_wireshark_t secadm_wireshark_t };
  12 application_domain(wireshark_t, wireshark_exec_t)
  13 ubac_constrained(wireshark_t)
  14
  15 type wireshark_home_t;
  16 typealias wireshark_home_t alias { user_wireshark_home_t staff_wireshark_home_t sysadm_wireshark_home_t };
  17 typealias wireshark_home_t alias { auditadm_wireshark_home_t secadm_wireshark_home_t };
  18 userdom_user_home_content(wireshark_home_t)
  19
  20 type wireshark_tmp_t;
  21 typealias wireshark_tmp_t alias { user_wireshark_tmp_t staff_wireshark_tmp_t sysadm_wireshark_tmp_t };
  22 typealias wireshark_tmp_t alias { auditadm_wireshark_tmp_t secadm_wireshark_tmp_t };
  23 files_tmp_file(wireshark_tmp_t)
  24 ubac_constrained(wireshark_tmp_t)
  25
  26 type wireshark_tmpfs_t;
  27 typealias wireshark_tmpfs_t alias { user_wireshark_tmpfs_t staff_wireshark_tmpfs_t sysadm_wireshark_tmpfs_t };
  28 typealias wireshark_tmpfs_t alias { auditadm_wireshark_tmpfs_t secadm_wireshark_tmpfs_t };
  29 files_tmpfs_file(wireshark_tmpfs_t)
  30 ubac_constrained(wireshark_tmpfs_t)
  31
  32 ##############################
  33 #
  34 # Local Policy
  35 #
  36
  37 allow wireshark_t self:capability { net_admin net_raw setgid };
  38 allow wireshark_t self:process { signal getsched };
  39 allow wireshark_t self:fifo_file { getattr read write };
  40 allow wireshark_t self:shm destroy;
  41 allow wireshark_t self:shm create_shm_perms;
  42 allow wireshark_t self:netlink_route_socket { nlmsg_read create_socket_perms };
  43 allow wireshark_t self:packet_socket { setopt bind ioctl getopt create read };
  44 allow wireshark_t self:tcp_socket create_socket_perms;
  45 allow wireshark_t self:udp_socket create_socket_perms;
  46
  47 # Re-execute itself (why?)
  48 can_exec(wireshark_t, wireshark_exec_t)
  49 corecmd_search_bin(wireshark_t)
  50
  51 # /home/.wireshark
  52 manage_dirs_pattern(wireshark_t, wireshark_home_t, wireshark_home_t)
  53 manage_files_pattern(wireshark_t, wireshark_home_t, wireshark_home_t)
  54 manage_lnk_files_pattern(wireshark_t, wireshark_home_t, wireshark_home_t)
  55 userdom_user_home_dir_filetrans(wireshark_t, wireshark_home_t, dir)
  56
  57 # Store temporary files
  58 manage_dirs_pattern(wireshark_t, wireshark_tmp_t, wireshark_tmp_t)
  59 manage_files_pattern(wireshark_t, wireshark_tmp_t, wireshark_tmp_t)
  60 files_tmp_filetrans(wireshark_t, wireshark_tmp_t, { dir file })
  61
  62 manage_dirs_pattern(wireshark_t, wireshark_tmpfs_t, wireshark_tmpfs_t)
  63 manage_files_pattern(wireshark_t, wireshark_tmpfs_t, wireshark_tmpfs_t)
  64 manage_lnk_files_pattern(wireshark_t, wireshark_tmpfs_t, wireshark_tmpfs_t)
  65 manage_sock_files_pattern(wireshark_t, wireshark_tmpfs_t, wireshark_tmpfs_t)
  66 manage_fifo_files_pattern(wireshark_t, wireshark_tmpfs_t, wireshark_tmpfs_t)
  67 fs_tmpfs_filetrans(wireshark_t, wireshark_tmpfs_t,{ dir file lnk_file sock_file fifo_file })
  68
  69 kernel_read_kernel_sysctls(wireshark_t)
  70 kernel_read_system_state(wireshark_t)
  71 kernel_read_sysctl(wireshark_t)
  72
  73 corenet_tcp_connect_generic_port(wireshark_t)
  74 corenet_tcp_sendrecv_generic_if(wireshark_t)
  75
  76 dev_read_urand(wireshark_t)
  77
  78 files_read_etc_files(wireshark_t)
  79 files_read_usr_files(wireshark_t)
  80
  81 fs_list_inotifyfs(wireshark_t)
  82 fs_search_auto_mountpoints(wireshark_t)
  83
  84 libs_read_lib_files(wireshark_t)
  85
  86 miscfiles_read_fonts(wireshark_t)
  87 miscfiles_read_localization(wireshark_t)
  88
  89 seutil_use_newrole_fds(wireshark_t)
  90
  91 sysnet_read_config(wireshark_t)
  92
  93 userdom_manage_user_home_content_files(wireshark_t)
  94
  95 tunable_policy(`use_nfs_home_dirs',`
  96         fs_manage_nfs_dirs(wireshark_t)
  97         fs_manage_nfs_files(wireshark_t)
  98         fs_manage_nfs_symlinks(wireshark_t)
  99 ')
 100
 101 tunable_policy(`use_samba_home_dirs',`
 102         fs_manage_cifs_dirs(wireshark_t)
 103         fs_manage_cifs_files(wireshark_t)
 104         fs_manage_cifs_symlinks(wireshark_t)
 105 ')
 106
 107 optional_policy(`
 108         nscd_socket_use(wireshark_t)
 109 ')
 110
 111 # Manual transition from userhelper
 112 optional_policy(`
 113         userhelper_use_fd(wireshark_t)
 114         userhelper_sigchld(wireshark_t)
 115 ')
 116
 117 optional_policy(`
 118         xserver_user_x_domain_template(wireshark, wireshark_t, wireshark_tmpfs_t)
 119         xserver_create_xdm_tmp_sockets(wireshark_t)
 120 ')