Wireshark application updates
cover Wireshark application updates
This is a set of simple updates on the wireshark application.
- Support the use of user terminals
- Access /dev/random
- Remove duplicate corecmd_search_bin
- Allow wireshark to execute bin_t
- Let dumpcap dump its packets
- Grant access to sysfs
Wkr,
Sven Vermeulen
PATCH 1/6 Allow using user terminals
In order to debug wireshark startup issues, it is important that wireshark, when started from a command line, is allowed to output its error messages.
--- policy/modules/apps/wireshark.te | 1 + 1 files changed, 1 insertions(+), 0 deletions(-)
policy/modules/apps/wireshark.te +1 -0
@@ -93,6 +93,7 @@ seutil_use_newrole_fds(wireshark_t) sysnet_read_config(wireshark_t) userdom_manage_user_home_content_files(wireshark_t) +userdom_use_user_terminals(wireshark_t) tunable_policy(`use_nfs_home_dirs',` fs_manage_nfs_dirs(wireshark_t)
Signature · 1 line
1.7.3.4
PATCH 1/6 Allow using user terminals
Quoted 14 lines · Sven Vermeulen
In order to debug wireshark startup issues, it is important that wireshark, when started from a command line, is allowed to output its error messages.
Signed-off-by Sven Vermeulen <[email protected]>--- policy/modules/apps/wireshark.te | 1 + 1 files changed, 1 insertions(+), 0 deletions(-)policy/modules/apps/wireshark.te +0
-0
policy/modules/apps/wireshark.te seutil_use_newrole_fds(wireshark_t) · line 99
Quoted 7 lines
policy/modules/apps/wireshark.te +1
-0@@ -93,6 +93,7 @@ seutil_use_newrole_fds(wireshark_t) sysnet_read_config(wireshark_t) userdom_manage_user_home_content_files(wireshark_t) +userdom_use_user_terminals(wireshark_t) tunable_policy(`use_nfs_home_dirs',` fs_manage_nfs_dirs(wireshark_t)
Isn't wireshark an X app? Wouldn't it only need pty access?
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com
PATCH 1/6 Allow using user terminals
Quoted 4 lines · Christopher J. PeBenito
Quoted 3 lines · Sven Vermeulen
In order to debug wireshark startup issues, it is important that wireshark, when started from a command line, is allowed to output its error messages.
[...]
Quoted 4 lines
Quoted 1 line
+userdom_use_user_terminals(wireshark_t)
Isn't wireshark an X app? Wouldn't it only need pty access?
Ah yes, my bad. That was a remainder from an earlier attempt where dumpcap too was labeled wireshark_exec_t (in the hope that I didn't need to allow execute rights on bin_t) which is a commandline application (and useful in batch jobs or scripts without need for wireshark).
I'll resubmit with userdom_use_user_ptys().
Wkr,
Sven Vermeulen
PATCH 2/6 Allow wireshark to use the random device
In reply to Sven VermeulenIt already has the rights to use the urandom device, but access to the random device is also needed.
--- policy/modules/apps/wireshark.te | 1 + 1 files changed, 1 insertions(+), 0 deletions(-)
policy/modules/apps/wireshark.te +1 -0
@@ -75,6 +75,7 @@ corecmd_search_bin(wireshark_t) corenet_tcp_connect_generic_port(wireshark_t) corenet_tcp_sendrecv_generic_if(wireshark_t) +dev_read_rand(wireshark_t) dev_read_urand(wireshark_t) files_read_etc_files(wireshark_t)
Signature · 1 line
1.7.3.4
PATCH 3/6 Remove duplicate corecmd_search_bin
In reply to Sven VermeulenTitle sais it all, the module used "corecmd_search_bin" twice.
--- policy/modules/apps/wireshark.te | 1 - 1 files changed, 0 insertions(+), 1 deletions(-)
policy/modules/apps/wireshark.te +0 -1
@@ -46,7 +46,6 @@ allow wireshark_t self:udp_socket create_socket_perms; # Re-execute itself (why?) can_exec(wireshark_t, wireshark_exec_t) -corecmd_search_bin(wireshark_t) # /home/.wireshark manage_dirs_pattern(wireshark_t, wireshark_home_t, wireshark_home_t)
Signature · 1 line
1.7.3.4
PATCH 4/6 Allow wireshark to execute bin_t
In reply to Sven VermeulenWireshark needs to be able to execute applications, definitely for its plugin support, but also to call the dumpcap utility (part of the wireshark distribution) to be able to dump the network traffic.
--- policy/modules/apps/wireshark.te | 1 + 1 files changed, 1 insertions(+), 0 deletions(-)
policy/modules/apps/wireshark.te +1 -0
@@ -69,6 +69,7 @@ kernel_read_kernel_sysctls(wireshark_t) kernel_read_system_state(wireshark_t) kernel_read_sysctl(wireshark_t) +corecmd_exec_bin(wireshark_t) corecmd_search_bin(wireshark_t) corenet_tcp_connect_generic_port(wireshark_t)
Signature · 1 line
1.7.3.4
PATCH 5/6 Dumpcap dumps the packets as packet_socket
In reply to Sven VermeulenThe dumpcap utility (running in the wireshark_t domain) needs to be able to write packet_sockets
--- policy/modules/apps/wireshark.te | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)
policy/modules/apps/wireshark.te +1 -1
@@ -40,7 +40,7 @@ allow wireshark_t self:fifo_file { getattr read write }; allow wireshark_t self:shm destroy; allow wireshark_t self:shm create_shm_perms; allow wireshark_t self:netlink_route_socket { nlmsg_read create_socket_perms }; -allow wireshark_t self:packet_socket { setopt bind ioctl getopt create read }; +allow wireshark_t self:packet_socket { setopt bind ioctl getopt create read write }; allow wireshark_t self:tcp_socket create_socket_perms; allow wireshark_t self:udp_socket create_socket_perms;
Signature · 1 line
1.7.3.4
PATCH 6/6 Grant wireshark read access on sysfs
In reply to Sven VermeulenThe wireshark utility reads information from the network devices listed in the sysfs hierarchy.
--- policy/modules/apps/wireshark.te | 1 + 1 files changed, 1 insertions(+), 0 deletions(-)
policy/modules/apps/wireshark.te +1 -0
@@ -76,6 +76,7 @@ corenet_tcp_connect_generic_port(wireshark_t) corenet_tcp_sendrecv_generic_if(wireshark_t) dev_read_rand(wireshark_t) +dev_read_sysfs(wireshark_t) dev_read_urand(wireshark_t) files_read_etc_files(wireshark_t)
Signature · 1 line
1.7.3.4