Re: Remote audit clients on RHEL 5.2

[Dan Gruhn <Dan.Gruhn@groupw.com>]

I talked with the folks on the fedora-selinux-list and here is the 
result of that discussion:

The text file (auditd.te) for the proper SELinux policy module is as 
follows:
-----------
module auditd 0.0.3;
require {
        class tcp_socket accept;
        type auditd_t;
        attribute reserved_port_type;
        class tcp_socket { name_bind };
}
type audit_port_t;
typeattribute audit_port_t reserved_port_type;
allow auditd_t audit_port_t:tcp_socket { name_bind };
allow auditd_t self:tcp_socket accept;
---------------

Once you have the auditd.te file, you can compile it and check it for 
any errors:

checkmodule -M -m -o auditd.mod auditd.te

If you have no errors, you can then package the .mod file:

semodule_package -o auditd.pp -m auditd.pp

After packaging, insert it into SELinux:

semodule -i auditd.pp

You should now be able to find the policy module using the 
system-config-selinux GUI.

After all of that, the port can be enable under SELinux as per the RHEL 
5.3 release notes:

semanage port -a -t audit_port_t -p tcp 60

My systems are now running clean.  Thanks for the help.

Dan

Steve Grubb wrote:
> On Thursday 12 February 2009 12:48:47 pm Dan Gruhn wrote:
>   
>> My system is a stand-alone in a secure environment so I can't just run a
>> piece of software and get an update, and it is currently locked into 5.2
>> as we're working to get it approved by various powers.  Is there any way
>> to get the SE Linux policy from the 5.3 update as a separate piece?
>>     
>
> I was hoping Dan Walsh would answer...its possible, but I don't know if the 
> selinux people pull it with a bunch of other changes into the reference 
> policy or not. You might be able to just get the 5.3 policy and look for the 
> audit files and transplant them into 5.2 policy and diff against original 52 
> policy to make a patch. You might need to ask on the Fedora-selinux mail list 
> or the NSA selinux policy mail list if no one answers soon.
>
> -Steve
>   

-- 
Dan Gruhn
Group W Inc.
8315 Lee Hwy, Suite 303
Fairfax, VA, 22031
PH: (703) 752-5831
FX: (703) 752-5851