Snort TE file

snort.te (text/plain), 1.30 KB, created by Bill McCarty on 2004-01-13 23:56:51 UTC

#DESC Snort - Network sniffer
#
# Author: Shaun Savage <[e-mail]> 
# Modified by Russell Coker <[e-mail]>
#
# Gentoo modifications by Patrick and Bill McCarty, Jan 12, 2004

daemon_domain(snort)

log_domain(snort)
can_network(snort_t)
type snort_etc_t, file_type, sysadmfile;

# Create temporary files.
tmp_domain(snort)

# use iptable netlink
allow snort_t self:netlink_socket create_socket_perms;
allow snort_t self:packet_socket create_socket_perms;
# Gentoo: Snort can be configured to drop root privileges and therefore
# Gentoo: needs dac_override
#allow snort_t self:capability { setgid setuid net_admin net_raw };
allow snort_t self:capability { setgid setuid net_admin net_raw dac_override }

r_dir_file(snort_t, snort_etc_t)
allow snort_t etc_t:file { getattr read };
allow snort_t etc_t:lnk_file read;

allow snort_t self:unix_dgram_socket create_socket_perms;
allow snort_t self:unix_stream_socket create_socket_perms;

# for start script
allow initrc_t snort_etc_t:file read;

# Gentoo: provide transition for entering snort_t from initrc_t
domain_auto_trans(initrc_t, snort_exec_t, snort_t)

# Gentoo: Add permissions for accessing snort_log_t directories and files
allow snort_t snort_log_t:dir rw_dir_perms;
allow snort_t snort_log_t:file rw_file_perms;