SELinux TE file for Snort

snort.te (text/plain), 1.36 KB, created by Bill McCarty on 2004-01-14 13:17:18 UTC

#DESC Snort - Network sniffer
#
# Author: Shaun Savage <[e-mail]> 
# Modified by Russell Coker <[e-mail]>
# X-Debian-Packages: snort-common
#
# Gentoo modifications by Patrick and Bill McCarty, Jan 12, 2004

daemon_domain(snort)

# Gentoo: Add permissions for accessing snort_log_t directories and files
#logdomain(snort)
logdir_domain(snort)
can_network(snort_t)
type snort_etc_t, file_type, sysadmfile;

# Create temporary files.
tmp_domain(snort)

# use iptable netlink
allow snort_t self:netlink_socket create_socket_perms;
allow snort_t self:packet_socket create_socket_perms;
# Gentoo: Snort can be configured to drop root privileges and therefore
# Gentoo: needs dac_override
#allow snort_t self:capability { setgid setuid net_admin net_raw };
allow snort_t self:capability { setgid setuid net_admin net_raw dac_override };

r_dir_file(snort_t, snort_etc_t)
allow snort_t etc_t:file { getattr read };
allow snort_t etc_t:lnk_file read;

allow snort_t self:unix_dgram_socket create_socket_perms;
allow snort_t self:unix_stream_socket create_socket_perms;

allow snort_t snort_log_t:dir rw_dir_perms;
allow snort_t snort_log_t:file rw_file_perms;

# for start script
allow initrc_t snort_etc_t:file read;

# Gentoo: provide transition for entering snort_t from initrc_t
domain_auto_trans(initrc_t, snort_exec_t, snort_t)