## IEEE 802.11 wireless LAN sniffer. ######################################## ## ## Role access for kismet. ## ## ## ## Role allowed access. ## ## ## ## ## User domain for the role. ## ## # interface(`kismet_role',` gen_require(` type kismet_home_t, kismet_tmp_t, kismet_tmpfs_t; type kismet_t; ') kismet_run($2, $1) allow $2 kismet_t:process { ptrace signal_perms }; ps_process_pattern($2, kismet_t) allow $2 kismet_home_t:dir { manage_dir_perms relabel_dir_perms }; allow $2 kismet_home_t:file { manage_file_perms relabel_file_perms }; userdom_user_home_dir_filetrans($2, kismet_home_t, dir, ".kismet") allow $2 kismet_tmp_t:dir { manage_dir_perms relabel_dir_perms }; allow $2 kismet_tmp_t:file { manage_file_perms relabel_file_perms }; allow $2 kismet_tmp_t:sock_file { manage_sock_file_perms relabel_sock_file_perms }; allow $2 kismet_tmpfs_t:dir { manage_dir_perms relabel_dir_perms }; allow $2 kismet_tmpfs_t:file { manage_file_perms relabel_file_perms }; ') ######################################## ## ## Execute a domain transition to run kismet. ## ## ## ## Domain allowed to transition. ## ## # interface(`kismet_domtrans',` gen_require(` type kismet_t, kismet_exec_t; ') corecmd_search_bin($1) domtrans_pattern($1, kismet_exec_t, kismet_t) ') ######################################## ## ## Execute kismet in the kismet domain, and ## allow the specified role the kismet domain. ## ## ## ## Domain allowed to transition. ## ## ## ## ## Role allowed access. ## ## # interface(`kismet_run',` gen_require(` attribute_role kismet_roles; ') kismet_domtrans($1) roleattribute $2 kismet_roles; ') ######################################## ## ## Read kismet pid files. (Deprecated) ## ## ## ## Domain allowed access. ## ## # interface(`kismet_read_pid_files',` refpolicywarn(`$0($*) has been deprecated, please use kismet_read_runtime_files() instead.') kismet_read_runtime_files($1) ') ######################################## ## ## Create, read, write, and delete ## kismet pid files. (Deprecated) ## ## ## ## Domain allowed access. ## ## # interface(`kismet_manage_pid_files',` refpolicywarn(`$0($*) has been deprecated, please use kismet_manage_runtime_files() instead.') kismet_manage_runtime_files($1) ') ######################################## ## ## Read kismet runtime files. ## ## ## ## Domain allowed access. ## ## # interface(`kismet_read_runtime_files',` gen_require(` type kismet_runtime_t; ') files_search_runtime($1) allow $1 kismet_runtime_t:file read_file_perms; ') ######################################## ## ## Create, read, write, and delete ## kismet runtime files. ## ## ## ## Domain allowed access. ## ## # interface(`kismet_manage_runtime_files',` gen_require(` type kismet_runtime_t; ') files_search_runtime($1) allow $1 kismet_runtime_t:file manage_file_perms; ') ######################################## ## ## Search kismet lib directories. ## ## ## ## Domain allowed access. ## ## # interface(`kismet_search_lib',` gen_require(` type kismet_var_lib_t; ') files_search_var_lib($1) allow $1 kismet_var_lib_t:dir search_dir_perms; ') ######################################## ## ## Read kismet lib files. ## ## ## ## Domain allowed access. ## ## # interface(`kismet_read_lib_files',` gen_require(` type kismet_var_lib_t; ') files_search_var_lib($1) allow $1 kismet_var_lib_t:dir list_dir_perms; allow $1 kismet_var_lib_t:file read_file_perms; ') ######################################## ## ## Create, read, write, and delete ## kismet lib files. ## ## ## ## Domain allowed access. ## ## # interface(`kismet_manage_lib_files',` gen_require(` type kismet_var_lib_t; ') files_search_var_lib($1) manage_files_pattern($1, kismet_var_lib_t, kismet_var_lib_t) ') ######################################## ## ## Create, read, write, and delete ## kismet lib content. ## ## ## ## Domain allowed access. ## ## # interface(`kismet_manage_lib',` gen_require(` type kismet_var_lib_t; ') files_search_var_lib($1) manage_dirs_pattern($1, kismet_var_lib_t, kismet_var_lib_t) manage_files_pattern($1, kismet_var_lib_t, kismet_var_lib_t) manage_lnk_files_pattern($1, kismet_var_lib_t, kismet_var_lib_t) ') ######################################## ## ## Read kismet log files. ## ## ## ## Domain allowed access. ## ## ## # interface(`kismet_read_log',` gen_require(` type kismet_log_t; ') logging_search_logs($1) read_files_pattern($1, kismet_log_t, kismet_log_t) ') ######################################## ## ## Append kismet log files. ## ## ## ## Domain allowed access. ## ## # interface(`kismet_append_log',` gen_require(` type kismet_log_t; ') logging_search_logs($1) append_files_pattern($1, kismet_log_t, kismet_log_t) ') ######################################## ## ## Create, read, write, and delete ## kismet log content. ## ## ## ## Domain allowed access. ## ## # interface(`kismet_manage_log',` gen_require(` type kismet_log_t; ') logging_search_logs($1) manage_dirs_pattern($1, kismet_log_t, kismet_log_t) manage_files_pattern($1, kismet_log_t, kismet_log_t) manage_lnk_files_pattern($1, kismet_log_t, kismet_log_t) ') ######################################## ## ## All of the rules required to ## administrate an kismet environment. ## ## ## ## Domain allowed access. ## ## ## ## ## Role allowed access. ## ## ## # interface(`kismet_admin',` gen_require(` type kismet_t, kismet_var_lib_t, kismet_runtime_t; type kismet_log_t, kismet_tmp_t, kismet_initrc_exec_t; ') init_startstop_service($1, $2, kismet_t, kismet_initrc_exec_t) ps_process_pattern($1, kismet_t) allow $1 kismet_t:process { ptrace signal_perms }; files_search_var_lib($1) admin_pattern($1, kismet_var_lib_t) files_search_runtime($1) admin_pattern($1, kismet_runtime_t) logging_search_logs($1) admin_pattern($1, kismet_log_t) files_search_tmp($1) admin_pattern($1, kismet_tmp_t) kismet_run($1, $2) ')