Chris PeBenito 31b7c0
# DESC - Ethereal  
Chris PeBenito 31b7c0
#
Chris PeBenito 31b7c0
# Author: Ivan Gyurdiev <ivg2@cornell.edu>
Chris PeBenito 31b7c0
#
Chris PeBenito 31b7c0
Chris PeBenito 31b7c0
#############################################################
Chris PeBenito 31b7c0
# ethereal_networking(app_prefix) - 
Chris PeBenito 31b7c0
#	restricted ethereal rules (sysadm only)
Chris PeBenito 31b7c0
#                               
Chris PeBenito 31b7c0
Chris PeBenito 31b7c0
define(`ethereal_networking', `
Chris PeBenito 31b7c0
Chris PeBenito 31b7c0
# Create various types of sockets
Chris PeBenito 31b7c0
allow $1_t self:netlink_route_socket create_netlink_socket_perms;
Chris PeBenito 31b7c0
allow $1_t self:udp_socket create_socket_perms;
Chris PeBenito 31b7c0
allow $1_t self:packet_socket create_socket_perms;
Chris PeBenito 31b7c0
allow $1_t self:unix_stream_socket create_stream_socket_perms;
Chris PeBenito 31b7c0
allow $1_t self:tcp_socket create_socket_perms;
Chris PeBenito 31b7c0
Chris PeBenito 31b7c0
allow $1_t self:capability { dac_override dac_read_search net_raw setgid setuid };
Chris PeBenito 31b7c0
Chris PeBenito 31b7c0
# Resolve names via DNS
Chris PeBenito 31b7c0
can_resolve($1_t)
Chris PeBenito 31b7c0
Chris PeBenito 31b7c0
') dnl ethereal_networking
Chris PeBenito 31b7c0
Chris PeBenito 31b7c0
########################################################
Chris PeBenito 31b7c0
# Ethereal (GNOME) 
Chris PeBenito 31b7c0
#
Chris PeBenito 31b7c0
Chris PeBenito 31b7c0
define(`ethereal_domain', `
Chris PeBenito 31b7c0
Chris PeBenito 31b7c0
# Type for program
Chris PeBenito 31b7c0
type $1_ethereal_t, domain, nscd_client_domain;
Chris PeBenito 31b7c0
Chris PeBenito 31b7c0
# Transition from sysadm type
Chris PeBenito 31b7c0
domain_auto_trans($1_t, ethereal_exec_t, $1_ethereal_t)
Chris PeBenito 31b7c0
role $1_r types $1_ethereal_t;
Chris PeBenito 31b7c0
Chris PeBenito 31b7c0
# Manual transition from userhelper 
Chris PeBenito 31b7c0
ifdef(`userhelper.te', `
Chris PeBenito 31b7c0
allow userhelperdomain $1_ethereal_t:process { transition siginh rlimitinh noatsecure };
Chris PeBenito 31b7c0
allow $1_ethereal_t userhelperdomain:fd use;
Chris PeBenito 31b7c0
allow $1_ethereal_t userhelperdomain:process sigchld;
Chris PeBenito 31b7c0
') dnl userhelper
Chris PeBenito 31b7c0
Chris PeBenito 31b7c0
# X, GNOME
Chris PeBenito 31b7c0
x_client_domain($1_ethereal, $1)
Chris PeBenito 31b7c0
gnome_application($1_ethereal, $1)
Chris PeBenito 31b7c0
gnome_file_dialog($1_ethereal, $1)
Chris PeBenito 31b7c0
Chris PeBenito 31b7c0
# Why does it write this?
Chris PeBenito 31b7c0
ifdef(`snmpd.te', `
Chris PeBenito 31b7c0
dontaudit sysadm_ethereal_t snmpd_var_lib_t:file write;
Chris PeBenito 31b7c0
')
Chris PeBenito 31b7c0
Chris PeBenito 31b7c0
# /home/.ethereal
Chris PeBenito 31b7c0
home_domain($1, ethereal)
Chris PeBenito 31b7c0
file_type_auto_trans($1_ethereal_t, $1_home_dir_t, $1_ethereal_home_t, dir)
Chris PeBenito 31b7c0
Chris PeBenito 31b7c0
# Enable restricted networking rules for sysadm - this is shared w/ tethereal
Chris PeBenito 31b7c0
ifelse($1, `sysadm', `
Chris PeBenito 31b7c0
ethereal_networking($1_ethereal) 
Chris PeBenito 31b7c0
Chris PeBenito 31b7c0
# Ethereal tries to write to user terminal
Chris PeBenito 31b7c0
dontaudit sysadm_ethereal_t user_tty_type:chr_file { read write };
Chris PeBenito 31b7c0
dontaudit sysadm_ethereal_t unpriv_userdomain:fd use;
Chris PeBenito 31b7c0
', `')
Chris PeBenito 31b7c0
Chris PeBenito 31b7c0
# Store temporary files
Chris PeBenito 31b7c0
tmp_domain($1_ethereal)
Chris PeBenito 31b7c0
Chris PeBenito 31b7c0
# Re-execute itself (why?)
Chris PeBenito 31b7c0
can_exec($1_ethereal_t, ethereal_exec_t)
Chris PeBenito 31b7c0
allow $1_ethereal_t sbin_t:dir search;
Chris PeBenito 31b7c0
Chris PeBenito 31b7c0
# Supress .local denials until properly implemented
Chris PeBenito 31b7c0
dontaudit $1_ethereal_t $1_home_t:dir search;
Chris PeBenito 31b7c0
Chris PeBenito 31b7c0
# FIXME: policy is incomplete
Chris PeBenito 31b7c0
Chris PeBenito 31b7c0
') dnl ethereal_domain