# policy generated from full system learning
define grsec_denied {
	/boot	h
	/dev/grsec	h
	/dev/kmem	h
	/dev/mem	h
	/dev/port	h
	/etc/grsec	h
	/proc/kcore	h
	/proc/slabinfo	h
	/proc/modules	h
	/proc/kallsyms	h
	/lib/modules	hs
	/lib64/modules	hs
	/etc/ssh	h
}

# general profile rules applicable for all users
define gp_libs {
	/etc/ld.so.cache	r
	/lib
	/lib/modules		h
	/lib/*.so*		rx
	/lib32
	/lib32/modules		h
	/lib32/*.so*		rx
	/lib32/security
	/lib32/security/*.so*	rx
	/lib64
	/lib64/modules		h
	/lib64/*.so*		rx
	/usr/lib
	/usr/lib/*.so*		rx
	/usr/lib32
	/usr/lib32/*.so*	rx
	/usr/lib64
	/usr/lib64/*.so*	rx
	/ciena/lib
	/ciena/lib/*.so*	rx
	/ciena/lib32
	/ciena/lib32/*.so*	rx
}

define gp_ciena_runtime {
	/ciena/bin			rx
	/ciena/scripts			rx
}

define gp_rootdir {
	/				
	/bin
	/bin/bash			rx
	/bin/busybox			rx
	/bin/ps				rx
	/boot				h
	/ciena				
	/ciena/bin			h
	/ciena/bin/cpuload		x
	/ciena/bin/leos			x
	/ciena/bin/root			xX
	/ciena/scripts			h
	/ciena/scripts/board_lib.sh	r
	/ciena/scripts/kernel_arg.sh	r
	/ciena/scripts/leos-shell	r
	/ciena/scripts/software_bank	rx
	/ciena/scripts/utils.sh		r
	/dev				h
	/dev/kmem			h
	/dev/log			h
	/dev/mem			h
	/dev/null			rw
	/dev/port			h
	/dev/tty			rw
	/etc				h
	/etc/gshadow			h
	/etc/gshadow-			h
	/etc/ld.so.cache		r
	/etc/nsswitch.conf		r
	/etc/passwd			r
	/etc/ppp			h
	/etc/profile			r
	/etc/samba/smbpasswd		h
	/etc/shadow			h
	/etc/shadow-			h
	/etc/ssh			h
	/mnt				
	/proc				r
	/proc/bus			h
	/proc/kallsyms			h
	/proc/kcore			h
	/proc/modules			h
	/proc/slabinfo			h
	/sys				h
	/tmp				a
	/usr				h
	/usr/bin/linxstat-n32		x
	/usr/bin/w			x
	/var				h
	/var/run/utmp			r
	/tmp/users/leosdiag			rw
	/tmp/users/leosdiag/*		rwc
	/etc/bash.bashrc		r
	/usr/share/terminfo		r
	/etc/bash_completion.d
	/etc/bash_completion.d/*.completion	r
	/tmp/users/gss/.bash_history	rwc
	/ciena/bin/evt_box		rx
	-CAP_ALL
	bind	disabled
	connect	disabled
}

define gp_busybox {
	/				h
	/bin				h
	/bin/busybox			x
	/ciena				h
	/ciena/scripts/leos-shell	x
	/etc				h
	/etc/group			r
	/etc/ld.so.cache		r
	/etc/localtime			s
	/etc/motd			
	/etc/passwd			r
	/mnt				h
	/mnt/sysfs/config		rwc
	/mnt/sysfs/fault/fault.log	rwd
	/proc				h
	/proc/cmdline			r
	/proc/cpuinfo			r
	/proc/meminfo			r
	/sys				h
	/sys/devices			h
	/sys/devices/platform		h
	/sys/devices/platform/octeon-twsi*	r
	/tmp				wc
	/mnt/log/corefiles		r
	-CAP_ALL
}

define gp_leos {
	/				h
	/bin				h
	/bin/bash			x
	/ciena				rx
	/dev				h
	/dev/mtd*			rw
	/dev/pts			
	/dev/shm			
	/dev/shm/evt_data		rw
	/dev/shm/evt_ram0		rw
	/dev/shm/evt_ram1		rw
	/dev/shm/evt_ram2		rw
	/dev/tty*			rw
	/dev/urandom			r
	/etc				h
	/etc/localtime			s
	/mnt				rw
	/proc				r
	/proc/bus			h
	/proc/kallsyms			h
	/proc/kcore			h
	/proc/modules			h
	/proc/slabinfo			h
	/proc/sys			h
	/rls_status			
	/sys				h
	/sys/devices			h
	/sys/devices/platform		
	/tmp				rwcd
	/usr				h
	/usr/etc			h
	/usr/etc/libnl/classid		r
	/var				
	/var/run			
	/var/run/guardian_max_reboots	rw
	/var/run/utmp			r
	-CAP_ALL
	bind 0.0.0.0/0 any_sock any_proto
	connect 0.0.0.0/0 any_sock any_proto
}

define gp_binroot {
	/				h
	/ciena				h
	/ciena/bin/root			x
	/dev				h
	/dev/pts			
	/dev/ttyS0			rw
	/etc				h
	/etc/ld.so.cache		r
	/etc/special			r
	/proc				
	/proc/bus			h
	/proc/kallsyms			h
	/proc/kcore			h
	/proc/modules			h
	/proc/slabinfo			h
	/proc/sys			h
	/var				h
	/var/run/utmp			r
	-CAP_ALL
	+CAP_SETUID
	bind	disabled
	connect	disabled
}

define gp_linxstat {
	/				h
	/usr/bin/linxstat-n32		rx
	-CAP_ALL
	bind	disabled
	connect	disabled
}

define gp_evtbox {
	/				h
	/dev/shm			rw
	/proc/mounts			r
	/etc/fstab			r
	-CAP_ALL
	+CAP_SYSLOG
	bind	disabled
	connect	disabled
}

# the set of commands available from the FILE submenu
# of the SAOS CLI
define gp_file_cmds {
	/bin/cat			x
	/bin/chmod			x
	/bin/cp				x
	/bin/ls				x
	/bin/mkdir			x
	/bin/mv				x
	/bin/ps				x
	/bin/pwd			x
	/bin/rm				x
	/bin/rmdir			x
	/usr/bin/scp			x
	/usr/bin/telnet			x
	/usr/bin/tget			x
	/usr/bin/tput			x
}

#
# User Roles
#

# Role: gradmin
#       GRSEC administration role
role gradmin sA
subject / rvka
	/ rwcdmlxi

# Role: root
#       typically used by daemons, NOT the root user
role root uG
role_transitions gradmin

# Role: root
#       standard policy for everything running under user root
subject /  {
	/				
	/bin				rx
	/boot				h
	/ciena				rx
	/dev				
	/dev/console			rw
	/dev/grsec			h
	/dev/kmem			h
	/dev/kmsg			w
	/dev/log			r
	/dev/mem			h
	/dev/null			rw
	/dev/port			h
	/dev/ptmx			rw
	/dev/pts			rw
	/dev/tty*			rw
	/dev/shm			rwcd
	/dev/random			r
	/dev/urandom			r
	/etc				r
	/etc/grsec			h
	/etc/init.d			h
	/etc/init.d/*			r
	/etc/authdb			rwcd
	/etc/ssh			rwcd
	/etc/sshd_config*		rwcd
	/etc/ntp.conf			rw
	/mnt				rw
	/mnt/sysfs/ssh			rwcd
	/proc
	/proc/*/mounts			r
	/proc/cpuinfo			r
	/proc/loadavg			r
	/proc/meminfo			r
	/proc/stat			r
	/proc/cmdline			r
	/proc/sys/net			rw
	/sbin				rx
	/sbin/gradm			rx
	/sys
	/sys/devices/platform		rw
	/tmp				rwcd
	/usr				rx
	/var
	/var/log			rwcd
	/var/run			rwcd
	$gp_libs
	-CAP_ALL
 	+CAP_CHOWN
 	+CAP_DAC_OVERRIDE
 	+CAP_FOWNER
 	+CAP_FSETID
 	+CAP_SETGID
 	+CAP_SETUID
 	+CAP_NET_RAW
 	+CAP_KILL
	+CAP_SYS_NICE
 	bind 0.0.0.0/32:0 dgram ip udp tcp
	connect 0.0.0.0/32:0 dgram raw_sock udp raw_proto tcp
 	sock_allow_family linx netlink ipv6 packet unix
}
# the rest of the subjects below, until the next role object,
# specify modifications to the "subject /" above that are specific
# to individual applications
subject /usr/sbin/sshd {
	/ciena/scripts/leos-shell	x
	/dev
	/dev/log			rw
	/dev/null			rw
	/dev/ptmx			rw
	/dev/pts			rw
	/dev/tty			rw
	/etc/motd			rwcd
	/etc/passwd			r
	/proc
	/proc/*/oom_*			rw
	/proc/*/fd			rw
	/proc/sys/kernel		r
        -CAP_ALL
        +CAP_CHOWN
        +CAP_DAC_OVERRIDE
        +CAP_FOWNER
        +CAP_FSETID
        +CAP_SETGID
        +CAP_SETUID
        +CAP_SYS_CHROOT
	+CAP_SYS_RESOURCE
	+CAP_NET_BIND_SERVICE
        bind 0.0.0.0/32:22 stream tcp
        connect disabled
        sock_allow_family ipv6 netlink
}
subject /usr/bin/ntpq {
 	bind disabled
	connect 127.0.0.1/32:123 dgram stream ip udp
	sock_allow_family ipv6 netlink
}
subject /usr/bin/ntpd {
	/dev/log			rw
	/proc
	/proc/*/net			r
	+CAP_SYS_TIME
	+CAP_NET_BIND_SERVICE
}
subject /usr/bin/ntpdc {
 	bind disabled
	connect 127.0.0.1/32:123 dgram stream ip udp
	sock_allow_family ipv6 netlink
}
subject /usr/bin/killall {
	/proc
	/proc/*/stat			r
	/proc/*/cmdline			r
	+CAP_KILL
}
subject /bin/busybox {
	/dev
	/dev/log			rw
	/dev/mtd*			rw
	/dev/tty*			rw
	/etc				r
	/etc/dot1x*.conf		rwcd
        /etc/group*                     clrwd
        /etc/gshadow*                   clrwd
        /etc/passwd*                    clrwd
        /etc/shadow*                    clrwd
	/etc/init.d			rx
	/etc/issue			rwcd
	/etc/bash.bashrc		rwcd
	/etc/bash_completion.d		rwcd
	/etc/vsftpd*			rwcdl
	/etc/fstab			rwcd
	/etc/gai.conf			rwcd
	/etc/sshd_config		rwcd
	/etc/inetd.conf			rwcd
	/lib/security			rx
	/proc
	/proc/*/cmdline			r
	/proc/*/*mounts			r
	/proc/*/stat			r
	/proc/cmdline			r
	/tmp				rwcdl
	+CAP_SYS_BOOT
	+CAP_SYS_ADMIN
	+CAP_SYS_PTRACE
	+CAP_NET_BIND_SERVICE
}
subject /ciena/bin/saparam {
	/dev
	/dev/mtd*			rw
	/mnt/sysfs/cookie		rwcd
}
subject /usr/bin/kmod {
	/lib/modules			r
	/lib32/modules			r
	/lib64/modules			r
	/proc/cmdline			r
	/sys/module			r
	+CAP_SYS_MODULE
}
subject /usr/bin/lttng-sessiond {
	/proc/lttng			rwcd
	/proc/sys/fs			r
	/proc/sys/kernel		r
	/proc/sys/net			r
	/sys/module			r
	+CAP_SYS_RESOURCE
}
subject /usr/libexec/udev/udevd {
	/dev/log			rw
	/run/udev			rwcd
	/sys/module			r
	+CAP_NET_ADMIN
}
subject /bin/bash {
	+CAP_NET_ADMIN
}
subject /bin/ps {
	/proc
	/proc/*/stat			r
	/proc/uptime			r
	/proc/*/cmdline			r
	/proc/*/status			r
	/proc/tty			r
	/proc/sys/kernel		r
	+CAP_SYS_PTRACE
}
subject /usr/sbin/dhclient {
	/dev/log			rw
	/proc
	/proc/*/net			r
	/var/db				rwcd
	+CAP_NET_BIND_SERVICE
}
subject /ciena/bin {
	/				x
	/dev				rw
	/dev/log			rw
	/proc				r
	/sys/devices			rw
	+CAP_SYSLOG
	+CAP_SYS_ADMIN
	+CAP_NET_ADMIN
}
subject /ciena/scripts {
	/				x
	/dev				rw
	/etc/nologin			rwcd
}
subject /ciena/scripts/leos-shell o {
	/				rwcdmlxi
}
subject /ciena/bin/leos o {
	/				rwcdmlxi
}
subject /ciena/bin/sc_oc {
	bind 0.0.0.0:4242 stream udp
	connect disabled
 	sock_allow_family linx netlink ipv6 packet unix tipc
}

# Role: sshd
#       used by the SSH daemon
role sshd u
# Role: sshd
subject /  {
	/				h
	-CAP_ALL
	bind	disabled
	connect	disabled
}

# Role: default
#       standard role for all non-root users
#       user will transition to debug_shell role when jumping into the
#       diag shell from the SAOS CLI
role default G
role_transitions debug_shell
subject /  {
	/				h
	/boot				h
	/dev				h
	/dev/mtd*			rw
	/dev/pts			r
	/dev/tty			rw
	/dev/ttyS0			rw
	/etc				h
	/etc/grsec			h
	/lib				x
	/proc/kallsyms			h
	/proc/modules			h
	/proc/slabinfo			h
	/sys				h
	/sys/devices			rw
	-CAP_SYS_MODULE
	-CAP_SYS_RAWIO
	-CAP_MKNOD
	-CAP_SYS_ADMIN
	-CAP_SYSLOG
	-CAP_SYS_BOOT
	-CAP_NET_ADMIN
	-CAP_NET_BIND_SERVICE
	-CAP_SYS_TTY_CONFIG 
	-CAP_SETFCAP
}
subject /bin/bash {
	/bin				h
	/bin/cat			x
	/bin/chmod			x
	/bin/ls				x
	/bin/busybox			x
	/ciena/bin			x
	/ciena/scripts			x
	/dev/grsec			r
	/dev/log			rw
	/etc/grsec			r
	/etc/profile			r
	/proc/meminfo			r
	/sbin/gradm			x
	/tmp				r
	/tmp/users			rwcd
	/usr/bin/ssh			x
	$gp_libs
}
subject /bin/busybox {
	/ciena/bin			x
	/ciena/scripts			x
	/dev/log			rw
	/etc				h
	/etc/group			r
	/proc/meminfo			r
	/tmp				h
	/tmp/users			rwcd
	$gp_libs
}
subject /ciena/bin/root {
	/etc				r
	/proc
	/proc/*/fd			rw
	/var/run			rwcd
	$gp_libs
}
subject /ciena/scripts/leos-shell o {
	/				rwxcd
}
subject /usr/sbin/sshd {
	/ciena/scripts/leos-shell	x
	/dev/pts			rw
	/etc/passwd			r
	/proc
	/proc/*/fd			rw
	/tmp/users			rwcd
	/var/run			rwcd
}
subject /ciena/bin/leos o {
	/				rwxcd
}

# Role: diag_shell
#       mirrors the standard diag shell permissions
#       only accessible from the debug_shell role, with a password
role diag_shell sG
subject / rvka {
	/ rwcdmlxi
	+CAP_ALL
}

# Role: debug_shell
#       Special role for a very limited working area within the
#       first level of the diag shell (ie. when entering the diag
#       shell from the SAOS CLI, the user will be entered into a
#       debug_shell role automatically).
#       From the debug_shell role the user can attempt to subsequently
#       jump to the standard diag_shell role with a password.
role debug_shell sNG
role_transitions diag_shell
subject / {
	/			h
	/bin/bash		x
	/bin/sh			x
	/bin/busybox		x
	/tmp/bin/hal		x
	/ciena/bin/leos		rx
	/dev/grsec		r
	/sbin/gradm		rx
	/etc/grsec
	/etc/grsec/*		r
	/tmp/users		rwcd
	$gp_libs
	$gp_file_cmds
	-CAP_ALL
	bind			disabled
	connect			disabled
}
subject /ciena/bin/leos o {
	/			h
	$gp_libs
	/usr/etc/libnl/classid	r
	/proc
	/proc/*/maps		r
	/proc/*/exe		r
	/mnt/apps/version	r
	/tmp/linx_maxsize	s
	/dev/pts		rw
	-CAP_ALL
	bind 0.0.0.0/0 any_sock any_proto
	connect 0.0.0.0/0 any_sock any_proto
	sock_allow_family ipv6 netlink linx
}
