From 59f1ed963b00b7cbc0b0ddc181f54e07afd72f2f Mon Sep 17 00:00:00 2001
From: Dominick Grift <dominick.grift@gmail.com>
Date: Oct 17 2012 12:23:40 +0000
Subject: Changes to the pads policy module


Ported from Fedora with changes

Signed-off-by: Dominick Grift <dominick.grift@gmail.com>

---

diff --git a/pads.if b/pads.if
index 8ac407e..6e097c9 100644
--- a/pads.if
+++ b/pads.if
@@ -1,17 +1,9 @@
-## <summary>Passive Asset Detection System</summary>
-## <desc>
-##	<p>
-##	PADS is a libpcap based detection engine used to
-##	passively detect network assets.  It is designed to
-##	complement IDS technology by providing context to IDS
-##	alerts.
-##	</p>
-## </desc>
+## <summary>Passive Asset Detection System.</summary>
 
 ########################################
 ## <summary>
-##	All of the rules required to administrate 
-##	an pads environment
+##	All of the rules required to
+##	administrate an pads environment.
 ## </summary>
 ## <param name="domain">
 ##	<summary>
@@ -27,8 +19,8 @@
 #
 interface(`pads_admin', `
 	gen_require(`
-		type pads_t, pads_config_t;
-		type pads_var_run_t, pads_initrc_exec_t;
+		type pads_t, pads_config_t, pads_var_run_t;
+		type pads_initrc_exec_t;
 	')
 
 	allow $1 pads_t:process { ptrace signal_perms };
@@ -39,6 +31,9 @@ interface(`pads_admin', `
 	role_transition $2 pads_initrc_exec_t system_r;
 	allow $2 system_r;
 
+	files_search_pids($1)
 	admin_pattern($1, pads_var_run_t)
+
+	files_search_etc($1)
 	admin_pattern($1, pads_config_t)
 ')
diff --git a/pads.te b/pads.te
index b246bdd..29a7364 100644
--- a/pads.te
+++ b/pads.te
@@ -1,4 +1,4 @@
-policy_module(pads, 1.0.0) 
+policy_module(pads, 1.0.1)
 
 ########################################
 #
@@ -8,7 +8,7 @@ policy_module(pads, 1.0.0)
 type pads_t;
 type pads_exec_t;
 init_daemon_domain(pads_t, pads_exec_t)
-role system_r types pads_t;
+application_executable_file(pads_exec_t)
 
 type pads_initrc_exec_t;
 init_script_file(pads_initrc_exec_t)
@@ -25,10 +25,8 @@ files_pid_file(pads_var_run_t)
 #
 
 allow pads_t self:capability { dac_override net_raw };
-allow pads_t self:netlink_route_socket { write getattr read bind create nlmsg_read };
-allow pads_t self:packet_socket { ioctl setopt getopt read bind create };
-allow pads_t self:udp_socket { create ioctl };
-allow pads_t self:unix_dgram_socket { write create connect };
+allow pads_t self:packet_socket create_socket_perms;
+allow pads_t self:socket create_socket_perms;
 
 allow pads_t pads_config_t:file manage_file_perms;
 files_etc_filetrans(pads_t, pads_config_t, file)
@@ -37,6 +35,7 @@ allow pads_t pads_var_run_t:file manage_file_perms;
 files_pid_filetrans(pads_t, pads_var_run_t, file)
 
 kernel_read_sysctl(pads_t)
+kernel_read_network_state(pads_t)
 
 corecmd_search_bin(pads_t)
 
@@ -44,10 +43,14 @@ corenet_all_recvfrom_unlabeled(pads_t)
 corenet_all_recvfrom_netlabel(pads_t)
 corenet_tcp_sendrecv_generic_if(pads_t)
 corenet_tcp_sendrecv_generic_node(pads_t)
+
+corenet_sendrecv_prelude_client_packets(pads_t)
 corenet_tcp_connect_prelude_port(pads_t)
+corenet_tcp_sendrecv_prelude_port(pads_t)
 
 dev_read_rand(pads_t)
 dev_read_urand(pads_t)
+dev_read_sysfs(pads_t)
 
 files_read_etc_files(pads_t)
 files_search_spool(pads_t)