policy/modules/apps/wireshark.te

   1 policy_module(wireshark, 2.1.1)
   2
   3 ########################################
   4 #
   5 # Declarations
   6 #
   7
   8 type wireshark_t;
   9 type wireshark_exec_t;
  10 typealias wireshark_t alias { user_wireshark_t staff_wireshark_t sysadm_wireshark_t };
  11 typealias wireshark_t alias { auditadm_wireshark_t secadm_wireshark_t };
  12 application_domain(wireshark_t, wireshark_exec_t)
  13 ubac_constrained(wireshark_t)
  14
  15 type wireshark_home_t;
  16 typealias wireshark_home_t alias { user_wireshark_home_t staff_wireshark_home_t sysadm_wireshark_home_t };
  17 typealias wireshark_home_t alias { auditadm_wireshark_home_t secadm_wireshark_home_t };
  18 files_poly_member(wireshark_home_t)
  19 userdom_user_home_content(wireshark_home_t)
  20
  21 type wireshark_tmp_t;
  22 typealias wireshark_tmp_t alias { user_wireshark_tmp_t staff_wireshark_tmp_t sysadm_wireshark_tmp_t };
  23 typealias wireshark_tmp_t alias { auditadm_wireshark_tmp_t secadm_wireshark_tmp_t };
  24 files_tmp_file(wireshark_tmp_t)
  25 ubac_constrained(wireshark_tmp_t)
  26
  27 type wireshark_tmpfs_t;
  28 typealias wireshark_tmpfs_t alias { user_wireshark_tmpfs_t staff_wireshark_tmpfs_t sysadm_wireshark_tmpfs_t };
  29 typealias wireshark_tmpfs_t alias { auditadm_wireshark_tmpfs_t secadm_wireshark_tmpfs_t };
  30 files_tmpfs_file(wireshark_tmpfs_t)
  31 ubac_constrained(wireshark_tmpfs_t)
  32
  33 ##############################
  34 #
  35 # Local Policy
  36 #
  37
  38 allow wireshark_t self:capability { net_admin net_raw setgid };
  39 allow wireshark_t self:process { signal getsched };
  40 allow wireshark_t self:fifo_file { getattr read write };
  41 allow wireshark_t self:shm destroy;
  42 allow wireshark_t self:shm create_shm_perms;
  43 allow wireshark_t self:netlink_route_socket { nlmsg_read create_socket_perms };
  44 allow wireshark_t self:packet_socket { setopt bind ioctl getopt create read };
  45 allow wireshark_t self:tcp_socket create_socket_perms;
  46 allow wireshark_t self:udp_socket create_socket_perms;
  47
  48 # Re-execute itself (why?)
  49 can_exec(wireshark_t, wireshark_exec_t)
  50 corecmd_search_bin(wireshark_t)
  51
  52 # /home/.wireshark
  53 manage_dirs_pattern(wireshark_t, wireshark_home_t, wireshark_home_t)
  54 manage_files_pattern(wireshark_t, wireshark_home_t, wireshark_home_t)
  55 manage_lnk_files_pattern(wireshark_t, wireshark_home_t, wireshark_home_t)
  56 userdom_user_home_dir_filetrans(wireshark_t, wireshark_home_t, dir)
  57
  58 # Store temporary files
  59 manage_dirs_pattern(wireshark_t, wireshark_tmp_t, wireshark_tmp_t)
  60 manage_files_pattern(wireshark_t, wireshark_tmp_t, wireshark_tmp_t)
  61 files_tmp_filetrans(wireshark_t, wireshark_tmp_t, { dir file })
  62
  63 manage_dirs_pattern(wireshark_t, wireshark_tmpfs_t, wireshark_tmpfs_t)
  64 manage_files_pattern(wireshark_t, wireshark_tmpfs_t, wireshark_tmpfs_t)
  65 manage_lnk_files_pattern(wireshark_t, wireshark_tmpfs_t, wireshark_tmpfs_t)
  66 manage_sock_files_pattern(wireshark_t, wireshark_tmpfs_t, wireshark_tmpfs_t)
  67 manage_fifo_files_pattern(wireshark_t, wireshark_tmpfs_t, wireshark_tmpfs_t)
  68 fs_tmpfs_filetrans(wireshark_t, wireshark_tmpfs_t,{ dir file lnk_file sock_file fifo_file })
  69
  70 kernel_read_kernel_sysctls(wireshark_t)
  71 kernel_read_system_state(wireshark_t)
  72 kernel_read_sysctl(wireshark_t)
  73
  74 corecmd_search_bin(wireshark_t)
  75
  76 corenet_tcp_connect_generic_port(wireshark_t)
  77 corenet_tcp_sendrecv_generic_if(wireshark_t)
  78
  79 dev_read_urand(wireshark_t)
  80
  81 files_read_etc_files(wireshark_t)
  82 files_read_usr_files(wireshark_t)
  83
  84 fs_list_inotifyfs(wireshark_t)
  85 fs_search_auto_mountpoints(wireshark_t)
  86
  87 libs_read_lib_files(wireshark_t)
  88
  89 miscfiles_read_fonts(wireshark_t)
  90 miscfiles_read_localization(wireshark_t)
  91
  92 seutil_use_newrole_fds(wireshark_t)
  93
  94 sysnet_read_config(wireshark_t)
  95
  96 userdom_manage_user_home_content_files(wireshark_t)
  97
  98 tunable_policy(`use_nfs_home_dirs',`
  99         fs_manage_nfs_dirs(wireshark_t)
 100         fs_manage_nfs_files(wireshark_t)
 101         fs_manage_nfs_symlinks(wireshark_t)
 102 ')
 103
 104 tunable_policy(`use_samba_home_dirs',`
 105         fs_manage_cifs_dirs(wireshark_t)
 106         fs_manage_cifs_files(wireshark_t)
 107         fs_manage_cifs_symlinks(wireshark_t)
 108 ')
 109
 110 optional_policy(`
 111         nscd_socket_use(wireshark_t)
 112 ')
 113
 114 # Manual transition from userhelper
 115 optional_policy(`
 116         userhelper_use_fd(wireshark_t)
 117         userhelper_sigchld(wireshark_t)
 118 ')
 119
 120 optional_policy(`
 121         xserver_user_x_domain_template(wireshark, wireshark_t, wireshark_tmpfs_t)
 122         xserver_create_xdm_tmp_sockets(wireshark_t)
 123 ')