Wireshark application updates
v2 cover Wireshark application updates
This is a set of simple updates on the wireshark application.
- Support the use of user terminals
- Access /dev/random
- Remove duplicate corecmd_search_bin
- Allow wireshark to execute bin_t
- Let dumpcap dump its packets
- Grant access to sysfs
Changes since v1
================
- Use userdom_use_user_ptys instead of _terminals
- Generate patch from within contrib submodule
Wkr,
Sven Vermeulen
PATCH v2 1/6 Allow using user terminals
In order to debug wireshark startup issues, it is important that wireshark, when started from a command line, is allowed to output its error messages.
--- wireshark.te | 1 + 1 files changed, 1 insertions(+), 0 deletions(-)
wireshark.te +1 -0
@@ -93,6 +93,7 @@ seutil_use_newrole_fds(wireshark_t) sysnet_read_config(wireshark_t) userdom_manage_user_home_content_files(wireshark_t) +userdom_use_user_ptys(wireshark_t) tunable_policy(`use_nfs_home_dirs',` fs_manage_nfs_dirs(wireshark_t)
Signature · 1 line
1.7.3.4
PATCH v2 2/6 Allow wireshark to use the random device
In reply to Sven VermeulenIt already has the rights to use the urandom device, but access to the random device is also needed.
--- wireshark.te | 1 + 1 files changed, 1 insertions(+), 0 deletions(-)
wireshark.te +1 -0
@@ -75,6 +75,7 @@ corecmd_search_bin(wireshark_t) corenet_tcp_connect_generic_port(wireshark_t) corenet_tcp_sendrecv_generic_if(wireshark_t) +dev_read_rand(wireshark_t) dev_read_urand(wireshark_t) files_read_etc_files(wireshark_t)
Signature · 1 line
1.7.3.4
PATCH v2 3/6 Remove duplicate corecmd_search_bin
In reply to Sven VermeulenTitle sais it all, the module used "corecmd_search_bin" twice.
--- wireshark.te | 1 - 1 files changed, 0 insertions(+), 1 deletions(-)
wireshark.te +0 -1
@@ -46,7 +46,6 @@ allow wireshark_t self:udp_socket create_socket_perms; # Re-execute itself (why?) can_exec(wireshark_t, wireshark_exec_t) -corecmd_search_bin(wireshark_t) # /home/.wireshark manage_dirs_pattern(wireshark_t, wireshark_home_t, wireshark_home_t)
Signature · 1 line
1.7.3.4
PATCH v2 4/6 Allow wireshark to execute bin_t
In reply to Sven VermeulenWireshark needs to be able to execute applications, definitely for its plugin support, but also to call the dumpcap utility (part of the wireshark distribution) to be able to dump the network traffic.
--- wireshark.te | 1 + 1 files changed, 1 insertions(+), 0 deletions(-)
wireshark.te +1 -0
@@ -69,6 +69,7 @@ kernel_read_kernel_sysctls(wireshark_t) kernel_read_system_state(wireshark_t) kernel_read_sysctl(wireshark_t) +corecmd_exec_bin(wireshark_t) corecmd_search_bin(wireshark_t) corenet_tcp_connect_generic_port(wireshark_t)
Signature · 1 line
1.7.3.4
PATCH v2 5/6 Dumpcap dumps the packets as packet_socket
In reply to Sven VermeulenThe dumpcap utility (running in the wireshark_t domain) needs to be able to write packet_sockets
--- wireshark.te | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)
wireshark.te +1 -1
@@ -40,7 +40,7 @@ allow wireshark_t self:fifo_file { getattr read write }; allow wireshark_t self:shm destroy; allow wireshark_t self:shm create_shm_perms; allow wireshark_t self:netlink_route_socket { nlmsg_read create_socket_perms }; -allow wireshark_t self:packet_socket { setopt bind ioctl getopt create read }; +allow wireshark_t self:packet_socket { setopt bind ioctl getopt create read write }; allow wireshark_t self:tcp_socket create_socket_perms; allow wireshark_t self:udp_socket create_socket_perms;
Signature · 1 line
1.7.3.4
PATCH v2 6/6 Grant wireshark read access on sysfs
In reply to Sven VermeulenThe wireshark utility reads information from the network devices listed in the sysfs hierarchy.
--- wireshark.te | 1 + 1 files changed, 1 insertions(+), 0 deletions(-)
wireshark.te +1 -0
@@ -76,6 +76,7 @@ corenet_tcp_connect_generic_port(wireshark_t) corenet_tcp_sendrecv_generic_if(wireshark_t) dev_read_rand(wireshark_t) +dev_read_sysfs(wireshark_t) dev_read_urand(wireshark_t) files_read_etc_files(wireshark_t)
Signature · 1 line
1.7.3.4
v2 cover Wireshark application updates
In reply to Sven VermeulenQuoted 9 lines · Sven Vermeulen
This is a set of simple updates on the wireshark application.
- Support the use of user terminals
- Access/dev/random
- Remove duplicatecorecmd_search_bin
- Allow wireshark to executebin_t
- Let dumpcap dump its packets
- Grant access to sysfs
Quoted 5 lines
Changes since v1
================- Use
userdom_use_user_ptysinstead of_terminals
- Generate patch from within contrib submodule
Merged.
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com