diff --git a/pcp-RHEL-213736.patch b/pcp-RHEL-213736.patch index 297b522..910dbc0 100644 --- a/pcp-RHEL-213736.patch +++ b/pcp-RHEL-213736.patch @@ -126,1967 +126,3 @@ index 5845932be1..0a4ae75b25 100644 tmpsize = PDU_CHUNK * ( 1 + php->len / PDU_CHUNK); maxsize = tmpsize; } -diff --git a/src/pcp/atop/photoproc.c.orig b/src/pcp/atop/photoproc.c.orig -deleted file mode 100644 -index 6e789417db..0000000000 ---- a/src/pcp/atop/photoproc.c.orig -+++ /dev/null -@@ -1,386 +0,0 @@ --/* --** Copyright (C) 2015-2017,2019-2022 Red Hat. --** --** This program is free software; you can redistribute it and/or modify it --** under the terms of the GNU General Public License as published by the --** Free Software Foundation; either version 2, or (at your option) any --** later version. --** --** This program is distributed in the hope that it will be useful, but --** WITHOUT ANY WARRANTY; without even the implied warranty of --** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. --** See the GNU General Public License for more details. --*/ -- --#include --#include --#include -- --#include "atop.h" --#include "photoproc.h" --#include "procmetrics.h" -- --static pmID pmids[TASK_NMETRICS]; --static pmDesc descs[TASK_NMETRICS]; -- --extern char prependenv; --extern regex_t envregex; -- --/* --** store the full command line --** --** the command line may be prepended by environment variables --*/ -- --#define ABBENVLEN 16 -- --static void --proccmd(struct tstat *task, int pid, char *name, pmResult *rp, pmDesc *dp, int offset) --{ -- size_t env_len = 0, next_len; -- char *p, *q, *pc, *nametail = name; -- char environ[BUFSIZ]; -- -- strsep(&nametail, " "); /* remove process identifier prefix; might fail */ -- pc = nametail ? nametail : name; -- -- if (prependenv) -- { -- p = extract_string_inst(rp, dp, TASK_GEN_ENVIRON, &environ[0], -- sizeof environ, pid, offset); -- while ((p = strsep(&p, " "))) -- { -- if (!regexec(&envregex, p, 0, NULL, 0)) -- { -- if ((q = strchr(p, ' ')) == NULL) -- next_len = strlen(p); -- else -- next_len = q - p; -- -- if (env_len + next_len >= CMDLEN) -- { -- // try to add abbreviated env string -- // -- if (env_len + ABBENVLEN + 1 >= CMDLEN) -- { -- break; -- } -- else -- { -- p[ABBENVLEN-4] = '.'; -- p[ABBENVLEN-3] = '.'; -- p[ABBENVLEN-2] = '.'; -- p[ABBENVLEN-1] = '\0'; -- p[ABBENVLEN] = '\0'; -- next_len= ABBENVLEN; -- } -- } -- -- env_len += next_len; -- -- *(p+next_len-1) = ' '; // modify NULL byte to space -- -- strcpy(pc, p); -- pc += next_len; -- } -- } -- } -- -- strncpy(task->gen.cmdline, pc, CMDLEN-env_len); -- task->gen.cmdline[CMDLEN] = '\0'; --} -- --/* --** sampled proc values into task structure, for one process/thread --*/ --static void --update_task(struct tstat *task, int pid, char *name, pmResult *rp, pmDesc *dp, int offset) --{ -- int key; -- char buf[32]; -- char cgname[CGRLEN+2]; -- -- memset(task, 0, sizeof(struct tstat)); -- -- proccmd(task, pid, name, rp, dp, offset); -- task->gen.isproc = 1; /* thread/process marker */ -- -- /* accumulate Pss from smaps (optional, relatively expensive) */ -- if (!calcpss) -- task->mem.pmem = (unsigned long long)-1; -- else -- task->mem.pmem = extract_ucount_t_inst(rp, dp, TASK_MEM_PMEM, pid, offset); -- -- /* determine wchan if wanted (optional, relatively expensive) */ -- if (getwchan) -- extract_string_inst(rp, dp, TASK_GEN_WCHAN, &task->cpu.wchan[0], -- sizeof task->cpu.wchan, pid, offset); -- -- /* /proc/pid/cgroup */ -- extract_string_inst(rp, dp, TASK_GEN_CONTAINER, &task->gen.utsname[0], -- sizeof task->gen.utsname, pid, offset); -- if (task->gen.utsname[0] != '\0') -- supportflags |= CONTAINERSTAT; -- -- cgname[0] = '\0'; -- extract_string_inst(rp, dp, TASK_GEN_CGROUP, &cgname[0], -- sizeof cgname, pid, offset); -- if (cgname[0] == ':') -- { -- strncpy(task->gen.cgpath, &cgname[1], sizeof task->gen.cgpath); -- task->gen.cgpath[sizeof task->gen.cgpath - 1] = '\0'; -- supportflags |= CGROUPV2; -- } -- -- /* /proc/pid/stat */ -- extract_string_inst(rp, dp, TASK_GEN_NAME, &task->gen.name[0], -- sizeof(task->gen.name), pid, offset); -- extract_string_inst(rp, dp, TASK_GEN_STATE, &task->gen.state, -- sizeof(task->gen.state), pid, offset); -- -- task->gen.pid = extract_integer_inst(rp, dp, TASK_GEN_PID, pid, offset); -- task->gen.ppid = extract_integer_inst(rp, dp, TASK_GEN_PPID, pid, offset); -- if (task->gen.ppid <= 0 && pid != 1) -- task->gen.ppid = 1; -- task->mem.minflt = extract_count_t_inst(rp, dp, TASK_MEM_MINFLT, pid, offset); -- task->mem.majflt = extract_count_t_inst(rp, dp, TASK_MEM_MAJFLT, pid, offset); -- task->cpu.utime = extract_count_t_inst(rp, dp, TASK_CPU_UTIME, pid, offset); -- task->cpu.stime = extract_count_t_inst(rp, dp, TASK_CPU_STIME, pid, offset); -- task->cpu.prio = extract_integer_inst(rp, dp, TASK_CPU_PRIO, pid, offset); -- task->cpu.nice = extract_integer_inst(rp, dp, TASK_CPU_NICE, pid, offset); -- task->gen.btime = extract_integer_inst(rp, dp, TASK_GEN_BTIME, pid, offset); -- task->mem.vmem = extract_count_t_inst(rp, dp, TASK_MEM_VMEM, pid, offset); -- task->mem.rmem = extract_count_t_inst(rp, dp, TASK_MEM_RMEM, pid, offset); -- task->cpu.curcpu = extract_integer_inst(rp, dp, TASK_CPU_CURCPU, pid, offset); -- task->cpu.rtprio = extract_integer_inst(rp, dp, TASK_CPU_RTPRIO, pid, offset); -- task->cpu.policy = extract_integer_inst(rp, dp, TASK_CPU_POLICY, pid, offset); -- task->cpu.rundelay = extract_integer_inst(rp, dp, TASK_CPU_RUNDELAY, pid, offset); -- task->cpu.blkdelay = extract_integer_inst(rp, dp, TASK_CPU_BLKDELAY, pid, offset); -- -- task->cpu.nvcsw = extract_count_t_inst(rp, dp, TASK_CPU_NVCTXSW, pid, offset); -- task->cpu.nivcsw = extract_count_t_inst(rp, dp, TASK_CPU_NIVCTXSW, pid, offset); -- -- task->cpu.cgcpuweight = -2; /* not available */ -- task->cpu.cgcpumax = task->cpu.cgcpumaxr = -2; /* not available */ -- -- /* /proc/pid/status */ -- task->gen.nthr = extract_integer_inst(rp, dp, TASK_GEN_NTHR, pid, offset); -- task->gen.tgid = extract_integer_inst(rp, dp, TASK_GEN_TGID, pid, offset); -- if (task->gen.tgid <= 0) -- task->gen.tgid = pid; -- task->gen.ctid = extract_integer_inst(rp, dp, TASK_GEN_ENVID, pid, offset); -- task->gen.vpid = extract_integer_inst(rp, dp, TASK_GEN_VPID, pid, offset); -- -- task->gen.ruid = extract_integer_inst(rp, dp, TASK_GEN_RUID, pid, offset); -- task->gen.euid = extract_integer_inst(rp, dp, TASK_GEN_EUID, pid, offset); -- task->gen.suid = extract_integer_inst(rp, dp, TASK_GEN_SUID, pid, offset); -- task->gen.fsuid = extract_integer_inst(rp, dp, TASK_GEN_FSUID, pid, offset); -- task->gen.rgid = extract_integer_inst(rp, dp, TASK_GEN_RGID, pid, offset); -- task->gen.egid = extract_integer_inst(rp, dp, TASK_GEN_EGID, pid, offset); -- task->gen.sgid = extract_integer_inst(rp, dp, TASK_GEN_SGID, pid, offset); -- task->gen.fsgid = extract_integer_inst(rp, dp, TASK_GEN_FSGID, pid, offset); -- -- task->mem.vdata = extract_count_t_inst(rp, dp, TASK_MEM_VDATA, pid, offset); -- task->mem.vstack = extract_count_t_inst(rp, dp, TASK_MEM_VSTACK, pid, offset); -- task->mem.vexec = extract_count_t_inst(rp, dp, TASK_MEM_VEXEC, pid, offset); -- task->mem.vlibs = extract_count_t_inst(rp, dp, TASK_MEM_VLIBS, pid, offset); -- task->mem.vswap = extract_count_t_inst(rp, dp, TASK_MEM_VSWAP, pid, offset); -- task->mem.vlock = extract_count_t_inst(rp, dp, TASK_MEM_VLOCK, pid, offset); -- -- task->mem.cgmemmax = task->mem.cgmemmaxr = -2; /* not available */ -- task->mem.cgswpmax = task->mem.cgswpmaxr = -2; /* not available */ -- -- /* /proc/pid/io */ -- task->dsk.rsz = extract_count_t_inst(rp, dp, TASK_DSK_RSZ, pid, offset); -- task->dsk.wsz = extract_count_t_inst(rp, dp, TASK_DSK_WSZ, pid, offset); -- task->dsk.cwsz = extract_count_t_inst(rp, dp, TASK_DSK_CWSZ, pid, offset); -- -- /* user names (cached) */ -- key = task->gen.ruid; -- if (get_username(task->gen.ruid) == NULL && -- extract_string_inst(rp, dp, TASK_GEN_RUIDNM, buf, sizeof buf, pid, offset)) -- add_username(key, buf); -- if (key != task->gen.euid && get_username(task->gen.euid) == NULL && -- extract_string_inst(rp, dp, TASK_GEN_EUIDNM, buf, sizeof buf, pid, offset)) -- add_username(key, buf); -- if (key != task->gen.suid && get_username(task->gen.suid) == NULL && -- extract_string_inst(rp, dp, TASK_GEN_SUIDNM, buf, sizeof buf, pid, offset)) -- add_username(key, buf); -- if (key != task->gen.fsuid && get_username(task->gen.fsuid) == NULL && -- extract_string_inst(rp, dp, TASK_GEN_FSUIDNM, buf, sizeof buf, pid, offset)) -- add_username(key, buf); -- -- /* group names (cached) */ -- key = task->gen.rgid; -- if (get_groupname(task->gen.rgid) == NULL && -- extract_string_inst(rp, dp, TASK_GEN_RGIDNM, buf, sizeof buf, pid, offset)) -- add_groupname(key, buf); -- if (key != task->gen.egid && get_groupname(task->gen.egid) == NULL && -- extract_string_inst(rp, dp, TASK_GEN_EGIDNM, buf, sizeof buf, pid, offset)) -- add_groupname(key, buf); -- if (key != task->gen.sgid && get_groupname(task->gen.sgid) == NULL && -- extract_string_inst(rp, dp, TASK_GEN_SGIDNM, buf, sizeof buf, pid, offset)) -- add_groupname(key, buf); -- if (key != task->gen.fsgid && get_groupname(task->gen.fsgid) == NULL && -- extract_string_inst(rp, dp, TASK_GEN_FSGIDNM, buf, sizeof buf, pid, offset)) -- add_groupname(key, buf); -- -- /* -- ** normalization -- */ -- task->cpu.prio += 100; /* was subtracted by kernel */ -- -- switch (task->gen.state) -- { -- case 'R': -- task->gen.nthrrun = 1; -- break; -- case 'S': -- task->gen.nthrslpi = 1; -- break; -- case 'I': -- task->gen.nthridle = 1; -- break; -- case 'D': -- task->gen.nthrslpu = 1; -- break; -- } -- -- if (task->gen.tgid > 0 && task->gen.tgid != pid) -- task->gen.isproc = 0; -- -- if (task->dsk.rsz >= 0) -- supportflags |= IOSTAT; -- -- task->dsk.rio = task->dsk.rsz /= 512; /* sectors */ -- task->dsk.wio = task->dsk.wsz /= 512; /* sectors */ -- task->dsk.cwsz /= 512; /* sectors */ --} -- --/* --** kernel.all.pid_max is unavailable, fall back to heuristics. --** Firstly seek out the maximum PID from the proc indom for a --** single sample, or (in the case of an archive) all available --** samples. If that fails fallback to some sensible default. --*/ --int --getmaxpid(void) --{ -- char **insts; -- int *pids, maxpid = 0; -- unsigned long i, count; -- -- count = get_instances("maxpid", TASK_GEN_PID, descs, &pids, &insts); -- if (count > 0) { -- for (i = 0; i < count; i++) -- if (pids[i] > maxpid) -- maxpid = pids[i]; -- free(insts); -- free(pids); -- } -- if (!maxpid) -- return (1 << 15); -- return maxpid; --} -- --void --setup_photoproc(void) --{ -- unsigned long i; -- -- if (!hotprocflag) -- for (i = 0; i < TASK_NMETRICS; i++) -- procmetrics[i] += 3; /* skip "hot" */ -- -- setup_metrics(procmetrics, pmids, descs, TASK_NMETRICS); -- -- /* check if per-process network metrics are available */ -- netproc_probe(); --} -- --unsigned long --photoproc(struct tstat **tasks, unsigned long *taskslen) --{ -- static int setup; -- static pmID envid, pssid, wchanid; -- pmResult *result; -- char **insts; -- int *pids, offset; -- unsigned long count, i; -- -- if (!setup) -- { -- wchanid = pmids[TASK_GEN_WCHAN]; -- pssid = pmids[TASK_MEM_PMEM]; -- envid = pmids[TASK_GEN_ENVIRON]; -- setup = 1; -- } -- -- /* -- ** reading the smaps file for every process with every sample -- ** is quite 'expensive' from a CPU consumption point-of-view, -- ** so gathering this info is optional -- */ -- if (!calcpss) -- pmids[TASK_MEM_PMEM] = PM_ID_NULL; -- else -- pmids[TASK_MEM_PMEM] = pssid; -- -- /* -- ** similar situation reading the environment of every process -- */ -- if (!prependenv) -- pmids[TASK_GEN_ENVIRON] = PM_ID_NULL; -- else -- pmids[TASK_GEN_ENVIRON] = envid; -- -- /* -- ** determine thread's wchan, if wanted ('expensive' from -- ** a CPU consumption point-of-view) -- */ -- if (!getwchan) -- pmids[TASK_GEN_WCHAN] = PM_ID_NULL; -- else -- pmids[TASK_GEN_WCHAN] = wchanid; -- -- fetch_metrics("task", TASK_NMETRICS, pmids, &result); -- -- /* extract external process names (insts) */ -- count = fetch_instances("task", TASK_GEN_NAME, descs, &pids, &insts); -- if (count > *taskslen) -- { -- size_t size = count * sizeof(struct tstat); -- -- *tasks = (struct tstat *)realloc(*tasks, size); -- ptrverify(*tasks, "photoproc [%ld]\n", (long)size); -- *taskslen = count; -- } -- -- supportflags &= ~CONTAINERSTAT; -- -- for (i=0; i < count; i++) -- { -- if (pmDebugOptions.appl0) -- fprintf(stderr, "%s: updating process %d: %s\n", -- pmGetProgname(), pids[i], insts[i]); -- offset = get_instance_index(result, TASK_GEN_PID, pids[i]); -- update_task(&(*tasks)[i], pids[i], insts[i], result, descs, offset); -- } -- -- if (supportflags & NETATOP) -- netproc_update_tasks(tasks, count); -- -- if (supportflags & NETATOPBPF) -- netbpfproc_update_tasks(tasks, count); -- -- if (pmDebugOptions.appl0) -- fprintf(stderr, "%s: done %lu processes\n", pmGetProgname(), count); -- -- pmFreeResult(result); -- if (count > 0) { -- free(insts); -- free(pids); -- } -- -- return count; --} -diff --git a/src/pmdas/ds389/pmdads389.pl.orig b/src/pmdas/ds389/pmdads389.pl.orig -deleted file mode 100644 -index 1679c0415e..0000000000 ---- a/src/pmdas/ds389/pmdads389.pl.orig -+++ /dev/null -@@ -1,465 +0,0 @@ --# --# Copyright (C) 2014-2015 Marko Myllynen --# Copyright (C) 2021 Raul Mahiques --# --# This program is free software; you can redistribute it and/or modify it --# under the terms of the GNU General Public License as published by the --# Free Software Foundation; either version 2 of the License, or (at your --# option) any later version. --# --# This program is distributed in the hope that it will be useful, but --# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY --# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License --# for more details. --# -- --use strict; --use warnings; --use PCP::PMDA; --use POSIX; -- --my $have_ldap = eval { -- require Net::LDAP; -- Net::LDAP->import(); -- use Net::LDAP::Util; -- 1; --}; --if (!$have_ldap) { die("Net::LDAP unavailable on this platform"); } -- --# Default values --our $aname = 'ds389'; --our $server = 'localhost'; --# Default LDAP version to use. --our $ldapver = 3; --our $binddn = 'cn=Directory Manager'; --our $bindpw = 'Manager12'; --# Default scope --our $dfscope = 'base'; --# Default LDAP filter --our $dffilter = '(objectclass=*)'; --# Default LDAP attributes to retrieve --our $dattrs = ['*', '+']; --# How often it will check --our $query_interval = 2; # seconds --# Metrics defaults --our $mpm_type = PM_TYPE_U32; --our $mpm_indom = PM_INDOM_NULL; --our $mpm_sem = PM_SEM_INSTANT; --# Format: dim_space, dim_time, dim_count, scale_space, scale_time, scale_count --our $mpmda_units = '0,0,1,0,0,'.PM_COUNT_ONE; --our @add_met = (); --our %dclu; -- --# Default base and metrics --our %dataclusters = ( -- '0' => ['0','cn=monitor','cn.',$dfscope,$dffilter,$dattrs], -- '1' => ['0','cn=monitor,cn=userRoot,cn=ldbm database,cn=plugins,cn=config','userroot.',$dfscope,$dffilter,$dattrs], -- '2' => ['0','cn=monitor,cn=changelog,cn=ldbm database,cn=plugins,cn=config','changelog_mon.',$dfscope,$dffilter,$dattrs], -- '3' => ['0','cn=snmp,cn=monitor','snmp_mon.',$dfscope,$dffilter,$dattrs] --); --our @def_met = ( -- [0,0,$mpm_type,$mpm_indom,$mpm_sem,$mpmda_units,'threads'], -- [0,1,$mpm_type,$mpm_indom,$mpm_sem,$mpmda_units,'currentconnections'], -- [0,2,PM_TYPE_U64,$mpm_indom,PM_SEM_COUNTER,$mpmda_units,'totalconnections'], -- [0,3,$mpm_type,$mpm_indom,$mpm_sem,$mpmda_units,'currentconnectionsatmaxthreads'], -- [0,4,$mpm_type,$mpm_indom,$mpm_sem,$mpmda_units,'maxthreadsperconnhits'], -- [0,5,$mpm_type,$mpm_indom,$mpm_sem,$mpmda_units,'dtablesize'], -- [0,6,$mpm_type,$mpm_indom,$mpm_sem,$mpmda_units,'readwaiters'], -- [0,7,PM_TYPE_U64,$mpm_indom,$mpm_sem,$mpmda_units,'opsinitiated'], -- [0,8,PM_TYPE_U64,$mpm_indom,$mpm_sem,$mpmda_units,'opscompleted'], -- [0,9,PM_TYPE_U64,$mpm_indom,$mpm_sem,$mpmda_units,'entriessent'], -- [0,10,PM_TYPE_U64,$mpm_indom,$mpm_sem,'1,0,0,'.PM_SPACE_BYTE.',0,0','bytessent'], -- [0,11,$mpm_type,$mpm_indom,$mpm_sem,'0,1,0,0,'.PM_TIME_SEC.',0','uptime'], -- [0,12,PM_TYPE_STRING,$mpm_indom,PM_SEM_DISCRETE,'0,0,0,0,0,0','version'], -- [0,13,$mpm_type,$mpm_indom,$mpm_sem,$mpmda_units,'nbackends'], -- [1,0,$mpm_type,$mpm_indom,$mpm_sem,'0,0,0,0,0,0','readonly'], -- [1,1,PM_TYPE_U64,$mpm_indom,PM_SEM_COUNTER,$mpmda_units,'entrycachehits'], -- [1,2,PM_TYPE_U64,$mpm_indom,PM_SEM_COUNTER,$mpmda_units,'entrycachetries'], -- [1,3,PM_TYPE_U64,$mpm_indom,$mpm_sem,$mpmda_units,'entrycachehitratio'], -- [1,4,PM_TYPE_U64,$mpm_indom,$mpm_sem,'1,0,0,'.PM_SPACE_BYTE.',0,0','currententrycachesize'], -- [1,5,PM_TYPE_U64,$mpm_indom,PM_SEM_DISCRETE,'1,0,0,'.PM_SPACE_BYTE.',0,0','maxentrycachesize'], -- [1,6,$mpm_type,$mpm_indom,$mpm_sem,$mpmda_units,'currententrycachecount'], -- [1,7,PM_TYPE_32,$mpm_indom,$mpm_sem,$mpmda_units,'maxentrycachecount'], -- [1,8,PM_TYPE_U64,$mpm_indom,PM_SEM_COUNTER,$mpmda_units,'dncachehits'], -- [1,9,PM_TYPE_U64,$mpm_indom,PM_SEM_COUNTER,$mpmda_units,'dncachetries'], -- [1,10,$mpm_type,$mpm_indom,$mpm_sem,$mpmda_units,'dncachehitratio'], -- [1,11,$mpm_type,$mpm_indom,$mpm_sem,'1,0,0,'.PM_SPACE_BYTE.',0,0','currentdncachesize'], -- [1,12,$mpm_type,$mpm_indom,PM_SEM_DISCRETE,'1,0,0,'.PM_SPACE_BYTE.',0,0','maxdncachesize'], -- [1,13,$mpm_type,$mpm_indom,$mpm_sem,$mpmda_units,'currentdncachecount'], -- [1,14,PM_TYPE_32,$mpm_indom,$mpm_sem,$mpmda_units,'maxdncachecount'], -- [1,15,$mpm_type,$mpm_indom,$mpm_sem,$mpmda_units,'normalizeddncachehits'], -- [1,16,PM_TYPE_32,$mpm_indom,$mpm_sem,$mpmda_units,'normalizeddncachetries'], -- [1,17,PM_TYPE_32,$mpm_indom,$mpm_sem,$mpmda_units,'normalizeddncachehitratio'], -- [1,18,PM_TYPE_32,$mpm_indom,$mpm_sem,'1,0,0,'.PM_SPACE_BYTE.',0,0','currentnormalizeddncachesize'], -- [1,19,PM_TYPE_32,$mpm_indom,$mpm_sem,'1,0,0,'.PM_SPACE_BYTE.',0,0','maxnormalizeddncachesize'], -- [1,20,PM_TYPE_32,$mpm_indom,$mpm_sem,$mpmda_units,'currentnormalizeddncachecount'], -- [1,21,PM_TYPE_32,$mpm_indom,$mpm_sem,$mpmda_units,'normalizeddncachemisses'], -- [2,0,$mpm_type,$mpm_indom,$mpm_sem,'0,0,0,0,0,0','readonly'], -- [2,1,PM_TYPE_U64,$mpm_indom,PM_SEM_COUNTER,$mpmda_units,'entrycachehits'], -- [2,2,PM_TYPE_U64,$mpm_indom,PM_SEM_COUNTER,$mpmda_units,'entrycachetries'], -- [2,3,PM_TYPE_U64,$mpm_indom,$mpm_sem,$mpmda_units,'entrycachehitratio'], -- [2,4,PM_TYPE_U64,$mpm_indom,$mpm_sem,'1,0,0,'.PM_SPACE_BYTE.',0,0','currententrycachesize'], -- [2,5,PM_TYPE_U64,$mpm_indom,PM_SEM_DISCRETE,'1,0,0,'.PM_SPACE_BYTE.',0,0','maxentrycachesize'], -- [2,6,$mpm_type,$mpm_indom,$mpm_sem,$mpmda_units,'currententrycachecount'], -- [2,7,PM_TYPE_32,$mpm_indom,$mpm_sem,$mpmda_units,'maxentrycachecount'], -- [2,8,PM_TYPE_U64,$mpm_indom,PM_SEM_COUNTER,$mpmda_units,'dncachehits'], -- [2,9,PM_TYPE_U64,$mpm_indom,PM_SEM_COUNTER,$mpmda_units,'dncachetries'], -- [2,10,$mpm_type,$mpm_indom,$mpm_sem,$mpmda_units,'dncachehitratio'], -- [2,11,$mpm_type,$mpm_indom,$mpm_sem,'1,0,0,'.PM_SPACE_BYTE.',0,0','currentdncachesize'], -- [2,12,$mpm_type,$mpm_indom,PM_SEM_DISCRETE,'1,0,0,'.PM_SPACE_BYTE.',0,0','maxdncachesize'], -- [2,13,$mpm_type,$mpm_indom,$mpm_sem,$mpmda_units,'currentdncachecount'], -- [2,14,PM_TYPE_32,$mpm_indom,$mpm_sem,$mpmda_units,'maxdncachecount'], -- [3,0,$mpm_type,$mpm_indom,$mpm_sem,$mpmda_units,'anonymousbinds'], -- [3,1,$mpm_type,$mpm_indom,$mpm_sem,$mpmda_units,'unauthbinds'], -- [3,2,$mpm_type,$mpm_indom,$mpm_sem,$mpmda_units,'simpleauthbinds'], -- [3,3,$mpm_type,$mpm_indom,$mpm_sem,$mpmda_units,'strongauthbinds'], -- [3,4,$mpm_type,$mpm_indom,$mpm_sem,$mpmda_units,'bindsecurityerrors'], -- [3,5,$mpm_type,$mpm_indom,$mpm_sem,$mpmda_units,'inops'], -- [3,6,$mpm_type,$mpm_indom,$mpm_sem,$mpmda_units,'readops'], -- [3,7,$mpm_type,$mpm_indom,$mpm_sem,$mpmda_units,'compareops'], -- [3,8,$mpm_type,$mpm_indom,$mpm_sem,$mpmda_units,'addentryops'], -- [3,9,$mpm_type,$mpm_indom,$mpm_sem,$mpmda_units,'modifyentryops'], -- [3,10,$mpm_type,$mpm_indom,$mpm_sem,$mpmda_units,'modifyrdnops'], -- [3,11,$mpm_type,$mpm_indom,$mpm_sem,$mpmda_units,'listops'], -- [3,12,$mpm_type,$mpm_indom,$mpm_sem,$mpmda_units,'searchops'], -- [3,13,$mpm_type,$mpm_indom,$mpm_sem,$mpmda_units,'onelevelsearchops'], -- [3,14,$mpm_type,$mpm_indom,$mpm_sem,$mpmda_units,'wholesubtreesearchops'], -- [3,15,$mpm_type,$mpm_indom,$mpm_sem,$mpmda_units,'referrals'], -- [3,16,$mpm_type,$mpm_indom,$mpm_sem,$mpmda_units,'chainings'], -- [3,17,$mpm_type,$mpm_indom,$mpm_sem,$mpmda_units,'securityerrors'], -- [3,18,$mpm_type,$mpm_indom,$mpm_sem,$mpmda_units,'errors'], -- [3,19,$mpm_type,$mpm_indom,$mpm_sem,$mpmda_units,'connections'], -- [3,20,$mpm_type,$mpm_indom,$mpm_sem,$mpmda_units,'connectionseq'], -- [3,21,$mpm_type,$mpm_indom,$mpm_sem,$mpmda_units,'connectionsinmaxthreads'], -- [3,22,$mpm_type,$mpm_indom,$mpm_sem,$mpmda_units,'connectionsmaxthreadscount'], -- [3,23,$mpm_type,$mpm_indom,$mpm_sem,$mpmda_units,'bytesrecv'], -- [3,24,$mpm_type,$mpm_indom,$mpm_sem,$mpmda_units,'bytessent'], -- [3,25,$mpm_type,$mpm_indom,$mpm_sem,$mpmda_units,'entriesreturned'], -- [3,26,$mpm_type,$mpm_indom,$mpm_sem,$mpmda_units,'referralsreturned'], -- [3,27,$mpm_type,$mpm_indom,$mpm_sem,$mpmda_units,'masterentries'], -- [3,28,$mpm_type,$mpm_indom,$mpm_sem,$mpmda_units,'cacheentries'], -- [3,29,$mpm_type,$mpm_indom,$mpm_sem,$mpmda_units,'cachehits'], -- [3,30,$mpm_type,$mpm_indom,$mpm_sem,$mpmda_units,'slavehits'] --); -- --our @def_replagr_met = ( -- [$mpm_type,$mpm_indom,$mpm_sem,$mpmda_units,'nsds5ReplicaChangeCount'], -- [$mpm_type,$mpm_indom,$mpm_sem,$mpmda_units,'nsds5replicareapactive'] --); -- --our @def_repl_met = ( -- [$mpm_type,$mpm_indom,$mpm_sem,$mpmda_units,'nsds5replicareapactive'], -- [$mpm_type,$mpm_indom,$mpm_sem,'0,1,0,0,'.PM_TIME_SEC.',0','nsruvReplicaLastModified'], -- [$mpm_type,$mpm_indom,$mpm_sem,'0,1,0,0,'.PM_TIME_SEC.',0','nsds5replicaLastUpdateStart'], -- [$mpm_type,$mpm_indom,$mpm_sem,'0,1,0,0,'.PM_TIME_SEC.',0','nsds5replicaLastUpdateEnd'], -- [$mpm_type,$mpm_indom,$mpm_sem,$mpmda_units,'nsds5replicaChangesSentSinceStartup'], -- [$mpm_type,$mpm_indom,$mpm_sem,$mpmda_units,'replicaLastUpdateStatus'], -- [$mpm_type,$mpm_indom,$mpm_sem,'0,1,0,0,'.PM_TIME_SEC.',0','nsds5replicaLastInitStart'], -- [$mpm_type,$mpm_indom,$mpm_sem,'0,1,0,0,'.PM_TIME_SEC.',0','nsds5replicaLastInitEnd'], -- [$mpm_type,$mpm_indom,$mpm_sem,'0,1,0,0,'.PM_TIME_SEC.',0','nsds5replicaLastUpdateTime'], -- [$mpm_type,$mpm_indom,$mpm_sem,$mpmda_units,'nsds5replicaUpdateInProgeress'], -- [$mpm_type,$mpm_indom,$mpm_sem,$mpmda_units,'replicaChangesSkippedSinceStartup'], -- [$mpm_type,$mpm_indom,$mpm_sem,$mpmda_units,'replicaChangesSentSinceStartup'] --); -- --our @def_mon_met = ( -- [$mpm_type,$mpm_indom,$mpm_sem,'0,0,0,0,0,0','readonly'], -- [PM_TYPE_U64,$mpm_indom,PM_SEM_COUNTER,$mpmda_units,'entrycachehits'], -- [PM_TYPE_U64,$mpm_indom,PM_SEM_COUNTER,$mpmda_units,'entrycachetries'], -- [PM_TYPE_U64,$mpm_indom,$mpm_sem,$mpmda_units,'entrycachehitratio'], -- [PM_TYPE_U64,$mpm_indom,$mpm_sem,'1,0,0,'.PM_SPACE_BYTE.',0,0','currententrycachesize'], -- [PM_TYPE_U64,$mpm_indom,PM_SEM_DISCRETE,'1,0,0,'.PM_SPACE_BYTE.',0,0','maxentrycachesize'], -- [$mpm_type,$mpm_indom,$mpm_sem,$mpmda_units,'currententrycachecount'], -- [PM_TYPE_32,$mpm_indom,$mpm_sem,$mpmda_units,'maxentrycachecount'], -- [PM_TYPE_U64,$mpm_indom,PM_SEM_COUNTER,$mpmda_units,'dncachehits'], -- [PM_TYPE_U64,$mpm_indom,PM_SEM_COUNTER,$mpmda_units,'dncachetries'], -- [$mpm_type,$mpm_indom,$mpm_sem,$mpmda_units,'dncachehitratio'], -- [$mpm_type,$mpm_indom,$mpm_sem,'1,0,0,'.PM_SPACE_BYTE.',0,0','currentdncachesize'], -- [$mpm_type,$mpm_indom,PM_SEM_DISCRETE,'1,0,0,'.PM_SPACE_BYTE.',0,0','maxdncachesize'], -- [$mpm_type,$mpm_indom,$mpm_sem,$mpmda_units,'currentdncachecount'], -- [PM_TYPE_32,$mpm_indom,$mpm_sem,$mpmda_units,'maxdncachecount'] --); -- -- --# Configuration files for overriding the above settings --for my $file (pmda_config('PCP_PMDAS_DIR') . "/$aname/$aname.conf", "./$aname.conf") { -- eval `cat $file` unless ! -f $file; --} -- --unless (!keys %dclu) { -- %dataclusters = (%dataclusters, %dclu) --} -- --use vars qw( $ldap $pmda %metrics ); -- --sub ds389_connection_setup { -- if (!defined($ldap)) { -- if (!pmda_install()) { $pmda->log("binding to $server"); } -- $ldap = Net::LDAP->new($server,version => $ldapver); -- if (!defined($ldap)) { -- if (!pmda_install()) { $pmda->log("bind failed, server down?"); } -- return; -- } -- my $mesg = $ldap->bind($binddn, password => $bindpw); -- if ($mesg->code) { -- $pmda->log("bind failed: " . $mesg->error); -- return; -- } -- $pmda->log("bind to $server ok"); -- } --} -- --# Function copied from https://github.com/389ds/389-ds-base/blob/389-ds-base-1.3.10/ldap/admin/src/scripts/repl-monitor.pl.in --sub to_decimal_csn --{ -- my ($maxcsn) = @_; -- if (!$maxcsn || $maxcsn eq "" || $maxcsn eq "Unavailable") { -- return "Unavailable"; -- } -- -- my ($tm, $seq, $masterid, $subseq) = unpack("a8 a4 a4 a4", $maxcsn); -- -- $tm = hex($tm); -- $seq = hex($seq); -- $masterid = hex($masterid); -- $subseq = hex($subseq); -- -- return "$tm $seq $masterid $subseq"; --} -- -- -- --sub ds389_time_to_epoch { -- my ($time) = @_; -- return mktime(substr($time,12,2), -- substr($time,10,2), -- substr($time,8,2), -- substr($time,6,2), -- substr($time,4,2) - 1, -- substr($time,0,4) - 1900); --} -- --sub ds389_process_entry { -- my ($entry, $prefix, $cluster) = @_; -- my $currtime; -- my $startrepltime = ''; -- my $endrepltime = ''; -- if ($entry && $entry->can('attributes')) { -- foreach my $attr ($entry->attributes) { -- my $value = $entry->get_value($attr); -- -- if ($attr eq 'currenttime') { -- $currtime = ds389_time_to_epoch($value); -- next; -- } -- -- if ($attr eq 'starttime') { -- my $starttime = ds389_time_to_epoch($value); -- $value = $currtime - $starttime; -- $attr = 'uptime'; -- } -- -- if ($attr eq 'nsds5replicaLastUpdateStatus') { -- if ($value =~ /No replication sessions started since server startup/i) { -- $value = 30 -- } elsif ($value =~ /agreement disabled/i) { -- $value = 31 -- } elsif ($value =~ /Problem connecting to the replica/i) { -- $value = 20 -- } else { -- $value = (split /\)/, (split /Error \(/, $value)[1])[0]; -- } -- $attr = 'replicaLastUpdateStatus'; -- } -- -- if ($attr eq 'nsds5replicaChangesSentSinceStartup' ) { --# my $rep_id = (split /:/, $value)[0]; -- my ($sent, $skipped) = (split /\//, (split /:/, $value)[1]); --# $attr = 'replica'.$rep_id.'ChangesSentSinceStartup'; -- $attr = 'replicaChangesSentSinceStartup'; -- $metrics{"$aname." . $prefix . $attr} = $sent; -- $value = $skipped; --# $attr = 'replica'.$rep_id.'ChangesSkippedSinceStartup'; -- $attr = 'replicaChangesSkippedSinceStartup'; -- } -- -- if ($attr eq 'nsds5replicaUpdateInProgress' ) { -- if ($value =~ /^(true|TRUE)$/) { -- $value = 1; -- } else { -- $value = 0; -- } -- } -- -- if ($attr =~ /^(nsds5replicaLastInitEnd|nsds5replicaLastUpdateStart|nsds5replicaLastInitStart)$/i ) { -- $value = ds389_time_to_epoch($value); -- if ($attr eq 'nsds5replicaLastUpdateStart') { -- $startrepltime = $value; -- } -- $metrics{"$aname." . $prefix . $attr} = $value; -- } -- -- if ($endrepltime ne '' && $startrepltime ne '' ) { -- $attr = 'nsds5replicaLastUpdateTime'; -- $value = $endrepltime - $startrepltime; -- $startrepltime = $endrepltime = ''; -- } -- -- if ($attr =~ /^(nsds5replicaLastUpdateEnd)$/i ) { -- $value = ds389_time_to_epoch($value); -- $endrepltime = $value; -- } -- -- if ($attr =~ /^nsds5AgmtMaxCSN$/i ) { -- my $maxcsn = &to_decimal_csn((split /\;/, $value)[5]); -- $value = (split / /, $maxcsn)[0]; -- } -- -- $metrics{"$aname." . $prefix . $attr} = $value; -- } -- } --} -- --sub retrieve_ldap { -- my ($cluster, $ts, $base, $tname, $scope, $filter, $lattrs) = @_; -- my $mesg; -- -- if ((strftime("%s", localtime()) - $ts) > $query_interval) { -- $ts = strftime("%s", localtime()); -- $mesg = $ldap->search(scope => $scope, base => $base, filter => $filter, attrs => $lattrs); -- if ($mesg->code) { -- $pmda->log("search(scope: \"$scope\", base: \"$base\", filter: \"$filter\", attrs: \"". join(' ', @$lattrs) ."\") failed: " . $mesg->error); -- undef $ldap; -- return; -- } -- ds389_process_entry($mesg->entry, $tname, $cluster); -- } --} -- --sub ds389_fetch { -- if (!defined($ldap)) { -- ds389_connection_setup(); -- } -- return unless defined($ldap); -- -- my ($cluster) = @_; -- my $mesg; -- -- \&retrieve_ldap($cluster,$dataclusters{$cluster}[0],$dataclusters{$cluster}[1],$dataclusters{$cluster}[2],$dataclusters{$cluster}[3],$dataclusters{$cluster}[4], $dataclusters{$cluster}[5]); --} -- --sub ds389_fetch_callback { -- my ($cluster, $item, $inst) = @_; -- -- if (!defined($ldap)) { return (PM_ERR_AGAIN, 0); } -- if ($inst != PM_INDOM_NULL) { return (PM_ERR_INST, 0); } -- -- my $pmnm = pmda_pmid_name($cluster, $item); -- my $value = $metrics{$pmnm}; -- -- if (!defined($value)) { return (PM_ERR_APPVERSION, 0); } -- -- return ($value, 1); --} -- -- --sub ds389_simple_search { -- my ($scope, $base, $filter, $attrs) = @_; -- -- if (!defined($ldap)) { return; } -- my $mesg = $ldap->search(scope => $scope, base => $base, filter => $filter, attrs => $attrs); -- if ($mesg->code) { -- $pmda->log("search(scope: \"$scope\", base: \"$base\", filter: \"$filter\", attrs: \"". join(' ', @$attrs) ."\") failed: " . $mesg->error); -- undef $ldap; -- return; -- } -- return $mesg --} -- --sub push_to_met { -- my ($tc, @myarr) = @_; -- my $count = 0; -- foreach my $c (0 .. $#myarr) { -- push(@def_met, [$tc, $c, $myarr[$c][0], $myarr[$c][1], $myarr[$c][2], $myarr[$c][3], $myarr[$c][4]]); -- }; --} -- --$pmda = PCP::PMDA->new($aname, 130); -- --# Add to the existing ones --my $topclu = 0; --foreach my $attr (keys %dataclusters) { -- if ($attr gt $topclu) { -- $topclu = $attr; -- } --}; -- --ds389_connection_setup(); -- --my $mesg = ds389_simple_search('sub','cn=config','objectclass=*',['nsslapd-defaultnamingcontext','nsslapd-backend']); -- --my $max = defined($mesg) ? $mesg->count : 0; --for ( my $i = 0 ; $i < $max ; $i++ ) { -- my $entry = $mesg->entry ( $i ); -- foreach my $attr ($entry->attributes) { -- my $value = $entry->get_value($attr); -- my $value_short = $value =~ s/[,]*[a-zA-Z]*=/_/rgi; -- my $value_ldap = $value =~ s/=/\\3D/igr =~ s/,/\\2C/igr; -- if ($attr eq 'nsslapd-defaultnamingcontext') { -- $topclu++; -- $dataclusters{$topclu} = ['0',$value,$value_short . '.','sub','(&(nsuniqueid=ffffffff-ffffffff-ffffffff-ffffffff)(objectclass=nstombstone))',['nsds5agmtmaxcsn','nsds50ruv']]; -- my $mesg2 = ds389_simple_search('sub',"cn=$value_ldap,cn=mapping tree,cn=config",'objectclass=nsds5replicationagreement',['cn']); -- my $max2 = $mesg2->count; -- for ( my $i2 = 0 ; $i2 < $max2 ; $i2++ ) { -- my $entry2 = $mesg2->entry ( $i2 ); -- my $rplagr = $entry2->get_value('cn'); -- $topclu++; -- my $value2_short = (split /\./, $rplagr)[0]; -- $dataclusters{$topclu} = ['0',"cn=". $rplagr .",cn=replica,cn=". $value_ldap .",cn=mapping tree,cn=config",$value2_short . '.',$dfscope,$dffilter,$dattrs]; -- push_to_met($topclu, @def_repl_met); -- $topclu++; -- $dataclusters{$topclu} = ['0',"cn=replica,cn=". $value_ldap .",cn=mapping tree,cn=config","rpl_". $value2_short . '.',$dfscope,$dffilter,$dattrs]; -- push_to_met($topclu, @def_replagr_met); -- } -- } -- if (($attr eq 'nsslapd-backend') and ($value eq 'ipaca')) { -- $topclu++; -- $dataclusters{$topclu} = ['0',$value,$value_short . '.','sub','(&(nsuniqueid=ffffffff-ffffffff-ffffffff-ffffffff)(objectclass=nstombstone))',['nsds5agmtmaxcsn','nsds50ruv']]; -- my $mesg2 = ds389_simple_search('sub',"cn=o\\3D$value_ldap,cn=mapping tree,cn=config",'objectclass=nsds5replicationagreement',['cn']); -- my $max2 = $mesg2->count; -- for ( my $i2 = 0 ; $i2 < $max2 ; $i2++ ) { -- my $entry2 = $mesg2->entry ( $i2 ); -- my $rplagr = $entry2->get_value('cn'); -- $topclu++; -- my $value2_short = (split /\./, $rplagr)[0]; -- $dataclusters{$topclu} = ['0',"cn=". $rplagr .",cn=replica,cn=o\\3D". $value_ldap .",cn=mapping tree,cn=config",$value2_short . '.',$dfscope,$dffilter,$dattrs]; -- push_to_met($topclu, @def_repl_met); -- $topclu++; -- $dataclusters{$topclu} = ['0',"cn=replica,cn=o\\3D". $value_ldap .",cn=mapping tree,cn=config","rpl_". $value2_short . '.',$dfscope,$dffilter,$dattrs]; -- push_to_met($topclu, @def_replagr_met); -- $topclu++; -- $dataclusters{$topclu} = ['0',"cn=monitor,cn=$value,cn=ldbm database,cn=plugins,cn=config",$value ."_mon.",$dfscope,$dffilter,$dattrs]; -- push_to_met($topclu, @def_mon_met); -- } -- } -- }; --}; -- --# Add default metrics --while (my ($i, @met) = each @def_met) { -- if (defined($dataclusters{$def_met[$i][0]})) { -- $pmda->add_metric(pmda_pmid($def_met[$i][0],$def_met[$i][1]), $def_met[$i][2], $def_met[$i][3],$def_met[$i][4], pmda_units(split(',',$def_met[$i][5])),"$aname.$dataclusters{$def_met[$i][0]}[2]$def_met[$i][6]", '', ''); -- } --}; -- --# Add metrics from the configuration file --while (my ($i, @met) = each @add_met) { -- if (defined($dataclusters{$add_met[$i][0]})) { -- $pmda->add_metric(pmda_pmid($add_met[$i][0],$add_met[$i][1]), $add_met[$i][2], $add_met[$i][3],$add_met[$i][4], pmda_units(split(',',$add_met[$i][5])),"$aname.$dataclusters{$add_met[$i][0]}[2]$add_met[$i][6]", '', ''); -- } --}; -- --$pmda->set_refresh(\&ds389_fetch); --$pmda->set_fetch_callback(\&ds389_fetch_callback); --$pmda->set_user('pcp'); --$pmda->run; -diff --git a/src/selinux/pcp.te.orig b/src/selinux/pcp.te.orig -deleted file mode 100644 -index 9cbd59bd2b..0000000000 ---- a/src/selinux/pcp.te.orig -+++ /dev/null -@@ -1,1095 +0,0 @@ --policy_module(pcp, 2.0.0) -- --######################################## --# --# Declarations --# -- -- --## --##

--## Allow pcp to bind to all unreserved_ports --##

--## --gen_tunable(pcp_bind_all_unreserved_ports, false) -- --## --##

--## Allow pcp to read generic logs --##

--## --gen_tunable(pcp_read_generic_logs, false) -- --attribute pcp_domain; -- --pcp_domain_template(pmcd) --pcp_domain_template(pmlogger) --pcp_domain_template(pmproxy) --pcp_domain_template(pmie) --pcp_domain_template(plugin) -- --type pcp_log_t; --logging_log_file(pcp_log_t) -- --type pcp_var_lib_t; --files_type(pcp_var_lib_t) -- --type pcp_var_run_t; --files_pid_file(pcp_var_run_t) -- --type pcp_tmp_t; --files_tmp_file(pcp_tmp_t) -- --type pcp_tmpfs_t; --files_tmpfs_file(pcp_tmpfs_t) -- --######################################## --# --# pcp domain local policy --# -- --allow pcp_domain self:capability { setuid setgid dac_read_search }; --allow pcp_domain self:process signal_perms; --allow pcp_domain self:tcp_socket create_stream_socket_perms; --allow pcp_domain self:udp_socket create_socket_perms; --allow pcp_domain self:netlink_route_socket create_socket_perms; --allow pcp_domain self:unix_stream_socket connectto; -- --corenet_tcp_connect_all_ephemeral_ports(pcp_domain) -- --manage_dirs_pattern(pcp_domain, pcp_log_t, pcp_log_t) --manage_files_pattern(pcp_domain, pcp_log_t, pcp_log_t) --logging_log_filetrans(pcp_domain, pcp_log_t, { dir }) -- --manage_dirs_pattern(pcp_domain, pcp_var_lib_t, pcp_var_lib_t) --manage_files_pattern(pcp_domain, pcp_var_lib_t, pcp_var_lib_t) --manage_sock_files_pattern(pcp_domain, pcp_var_lib_t, pcp_var_lib_t) --manage_lnk_files_pattern(pcp_domain, pcp_var_lib_t, pcp_var_lib_t) --exec_files_pattern(pcp_domain, pcp_var_lib_t, pcp_var_lib_t) --files_var_lib_filetrans(pcp_domain, pcp_var_lib_t, { dir}) -- --manage_dirs_pattern(pcp_domain, pcp_var_run_t, pcp_var_run_t) --manage_files_pattern(pcp_domain, pcp_var_run_t, pcp_var_run_t) --manage_sock_files_pattern(pcp_domain, pcp_var_run_t, pcp_var_run_t) --manage_lnk_files_pattern(pcp_domain, pcp_var_run_t, pcp_var_run_t) --files_pid_filetrans(pcp_domain, pcp_var_run_t, { dir file sock_file lnk_file }) -- --manage_dirs_pattern(pcp_domain, pcp_tmp_t, pcp_tmp_t) --manage_files_pattern(pcp_domain, pcp_tmp_t, pcp_tmp_t) --manage_sock_files_pattern(pcp_domain, pcp_tmp_t, pcp_tmp_t) --files_tmp_filetrans(pcp_domain, pcp_tmp_t, { dir file sock_file }) -- --manage_dirs_pattern(pcp_domain, pcp_tmpfs_t, pcp_tmpfs_t) --manage_files_pattern(pcp_domain, pcp_tmpfs_t, pcp_tmpfs_t) --fs_tmpfs_filetrans(pcp_domain, pcp_tmpfs_t, { dir file }) --can_exec(pcp_domain, pcp_tmpfs_t) -- --dev_read_urand(pcp_domain) -- --files_read_etc_files(pcp_domain) -- --fs_getattr_all_fs(pcp_domain) -- --miscfiles_read_generic_certs(pcp_domain) -- --sysnet_read_config(pcp_domain) -- --tunable_policy(`pcp_bind_all_unreserved_ports',` -- corenet_sendrecv_all_server_packets(pcp_pmcd_t) -- corenet_sendrecv_all_server_packets(pcp_pmlogger_t) -- corenet_tcp_bind_all_unreserved_ports(pcp_pmcd_t) -- corenet_tcp_bind_all_unreserved_ports(pcp_pmlogger_t) --') -- -- --######################################## --# --# pcp_pmcd local policy --# -- --allow pcp_pmcd_t self:capability { dac_read_search dac_override ipc_owner net_admin sys_admin sys_ptrace }; --allow pcp_pmcd_t self:process { setsched }; --allow pcp_pmcd_t self:unix_dgram_socket { create_socket_perms getattr }; --allow pcp_pmcd_t self:cap_userns sys_ptrace; -- --kernel_get_sysvipc_info(pcp_pmcd_t) --kernel_manage_perf_event(pcp_pmcd_t) --kernel_read_debugfs(pcp_pmcd_t) --kernel_read_network_state(pcp_pmcd_t) --kernel_read_system_state(pcp_pmcd_t) --kernel_read_state(pcp_pmcd_t) --kernel_read_fs_sysctls(pcp_pmcd_t) --kernel_read_vm_sysctls(pcp_pmcd_t) --kernel_read_rpc_sysctls(pcp_pmcd_t) --kernel_search_network_sysctl(pcp_pmcd_t) --kernel_read_net_sysctls(pcp_pmcd_t) --kernel_read_psi(pcp_pmcd_t) -- --corecmd_exec_bin(pcp_pmcd_t) --corecmd_exec_shell(pcp_pmcd_t) -- --corenet_tcp_connect_ntop_port(pcp_pmcd_t) --corenet_all_recvfrom_netlabel(pcp_pmcd_t) --corenet_tcp_sendrecv_generic_if(pcp_pmcd_t) --corenet_tcp_sendrecv_generic_node(pcp_pmcd_t) -- --corenet_sendrecv_all_client_packets(pcp_pmcd_t) --corenet_tcp_connect_all_ports(pcp_pmcd_t) --corenet_tcp_sendrecv_all_ports(pcp_pmcd_t) -- --corenet_dontaudit_tcp_bind_all_reserved_ports(pcp_pmcd_t) --corenet_dontaudit_udp_bind_all_reserved_ports(pcp_pmcd_t) -- --dev_read_sysfs(pcp_pmcd_t) --dev_read_urand(pcp_pmcd_t) --dev_rw_lvm_control(pcp_pmcd_t) -- --domain_read_all_domains_state(pcp_pmcd_t) --domain_getattr_all_domains(pcp_pmcd_t) -- --dev_getattr_all_blk_files(pcp_pmcd_t) --dev_getattr_all_chr_files(pcp_pmcd_t) -- --fs_getattr_all_fs(pcp_pmcd_t) --fs_getattr_all_dirs(pcp_pmcd_t) --fs_list_cgroup_dirs(pcp_pmcd_t) --fs_read_cgroup_files(pcp_pmcd_t) --fs_read_nfsd_files(pcp_pmcd_t) --fs_search_tracefs_dirs(pcp_pmcd_t) -- --init_read_utmp(pcp_pmcd_t) -- --logging_send_syslog_msg(pcp_pmcd_t) -- --lvm_domtrans(pcp_pmcd_t) -- --storage_getattr_fixed_disk_dev(pcp_pmcd_t) --storage_raw_read_fixed_disk(pcp_pmcd_t) -- --userdom_read_user_tmp_files(pcp_pmcd_t) --userdom_manage_unpriv_user_semaphores(pcp_pmcd_t) -- --optional_policy(` -- acct_search_data(pcp_pmcd_t) --') -- --optional_policy(` -- cron_read_pid_files(pcp_pmcd_t) --') -- --optional_policy(` -- container_manage_lib_files(pcp_pmcd_t) --') -- --optional_policy(` -- mock_read_lib_files(pcp_pmcd_t) --') -- --optional_policy(` -- mysql_stream_connect(pcp_pmcd_t) --') -- --optional_policy(` -- dbus_system_bus_client(pcp_pmcd_t) -- -- optional_policy(` -- avahi_dbus_chat(pcp_pmcd_t) -- ') --') -- --optional_policy(` -- postfix_read_config(pcp_pmcd_t) -- postfix_search_spool(pcp_pmcd_t) --') -- --optional_policy(` -- raid_domtrans_mdadm(pcp_pmcd_t) -- raid_access_check_mdadm(pcp_pmcd_t) --') -- --tunable_policy(`pcp_read_generic_logs',` -- logging_read_generic_logs(pcp_pmcd_t) -- --') -- --######################################## --# --# pcp_pmproxy local policy --# -- --allow pcp_pmproxy_t self:process setsched; --allow pcp_pmproxy_t self:unix_dgram_socket create_socket_perms; --allow pcp_pmproxy_t self:capability { ipc_lock ipc_owner sys_resource }; --optional_policy(` -- require { -- class io_uring { sqpoll }; -- } -- #RHBZ2223568 -- allow pcp_pmproxy_t self:io_uring { sqpoll }; --') -- --ifdef(`kernel_io_uring_use',` -- kernel_io_uring_use(pcp_pmproxy_t) --') --kernel_search_network_sysctl(pcp_pmproxy_t) -- --logging_send_syslog_msg(pcp_pmproxy_t) -- --optional_policy(` -- dbus_system_bus_client(pcp_pmproxy_t) -- -- optional_policy(` -- avahi_dbus_chat(pcp_pmproxy_t) -- ') --') -- --######################################## --# --# pcp_pmie local policy --# --allow pcp_pmie_t self:capability { chown fsetid sys_admin sys_ptrace }; --allow pcp_pmie_t self:cap_userns sys_ptrace; --allow pcp_pmie_t self:netlink_route_socket { create_socket_perms nlmsg_read }; --allow pcp_pmie_t self:unix_dgram_socket { create_socket_perms sendto }; -- --allow pcp_pmie_t pcp_pmcd_t:unix_stream_socket connectto; -- --allow pcp_pmie_t pcp_pmcd_t:process signal; -- --kernel_read_net_sysctls(pcp_pmie_t) --kernel_read_network_state(pcp_pmie_t) --kernel_read_system_state(pcp_pmie_t) --kernel_dontaudit_request_load_module(pcp_pmie_t) -- --can_exec(pcp_pmie_t, pcp_pmie_exec_t) -- --corecmd_exec_bin(pcp_pmie_t) --corecmd_getattr_all_executables(pcp_pmie_t) -- --domain_read_all_domains_state(pcp_pmie_t) -- --fs_dontaudit_getattr_nsfs_files(pcp_pmie_t) --fs_search_cgroup_dirs(pcp_pmie_t) -- --init_status(pcp_pmie_t) --optional_policy(` -- init_manage_script_tmp_files(pcp_pmie_t) --') -- --logging_send_syslog_msg(pcp_pmie_t) -- --systemd_exec_systemctl(pcp_pmie_t) --systemd_read_unit_files(pcp_pmie_t) --systemd_search_unit_dirs(pcp_pmie_t) --systemd_status_systemd_services(pcp_pmie_t) -- --userdom_read_user_tmp_files(pcp_pmie_t) -- --files_manage_generic_tmp_dirs(pcp_pmie_t) --files_manage_generic_tmp_files(pcp_pmie_t) -- --######################################## --# --# pcp_pmlogger local policy --# -- --allow pcp_pmlogger_t self:capability { dac_read_search dac_override chown fowner sys_admin sys_ptrace }; --allow pcp_pmlogger_t self:process { getattr setpgid }; --allow pcp_pmlogger_t self:netlink_route_socket {create_socket_perms nlmsg_read }; -- --allow pcp_pmlogger_t pcp_pmcd_t:unix_stream_socket connectto; --allow pcp_pmlogger_t self:unix_dgram_socket create_socket_perms; -- --allow pcp_pmlogger_t pcp_pmlogger_exec_t:file execute_no_trans; --allow pcp_pmlogger_t ldconfig_exec_t:file { execute execute_no_trans }; -- --dontaudit pcp_pmlogger_t self:cap_userns { sys_ptrace }; -- --kernel_read_system_state(pcp_pmlogger_t) --kernel_read_network_state(pcp_pmlogger_t) --kernel_read_all_sysctls(pcp_pmlogger_t) -- --corecmd_exec_bin(pcp_pmlogger_t) -- --corenet_tcp_bind_dey_sapi_port(pcp_pmlogger_t) --corenet_tcp_bind_commplex_link_port(pcp_pmlogger_t) --corenet_tcp_bind_generic_node(pcp_pmlogger_t) -- --domain_read_all_domains_state(pcp_pmlogger_t) -- --fs_dontaudit_getattr_nsfs_files(pcp_pmlogger_t) --fs_mount_tracefs(pcp_pmlogger_t) --fs_getattr_all_fs(pcp_pmlogger_t) -- --init_read_utmp(pcp_pmlogger_t) --init_status(pcp_pmlogger_t) --optional_policy(` -- init_manage_script_tmp_files(pcp_pmlogger_t) --') -- --logging_send_syslog_msg(pcp_pmlogger_t) -- --systemd_exec_systemctl(pcp_pmlogger_t) --systemd_getattr_unit_files(pcp_pmlogger_t) --systemd_status_systemd_services(pcp_pmlogger_t) -- --userdom_manage_tmp_dirs(pcp_pmlogger_t) --userdom_manage_tmp_files(pcp_pmlogger_t) -- --optional_policy(` -- hostname_exec(pcp_pmlogger_t) --') -- --optional_policy(` -- rpm_script_signal(pcp_pmlogger_t) --') -- --optional_policy(` -- userdom_setattr_user_home_content_files(pcp_pmlogger_t) --') -- --######################################## --# --# pcp_plugin local policy --# -- --domtrans_pattern(pcp_domain, pcp_plugin_exec_t, pcp_plugin_t) -- --optional_policy(` -- unconfined_domain(pcp_plugin_t) --') -- -- --######################################## --# --# pcp_plugin local policy (previously pcpupstream) --# -- --require { -- attribute domain; -- attribute file_type; -- attribute pcp_domain; -- attribute userdomain; -- -- type configfs_t; #pcp.lio -- type debugfs_t; -- type default_t; -- type device_t; -- type etc_t; -- type fixed_disk_device_t; -- type fs_t; -- type fsadm_exec_t; -- type gpmctl_t; -- type haproxy_t; -- type haproxy_var_lib_t; -- type hostname_exec_t; -- type init_t; -- type initrc_tmp_t; -- type kernel_t; -- type kmsg_device_t; -- type ldconfig_exec_t; -- type mdadm_exec_t; -- type modules_object_t; # pcp.lio, pcp.bcc -- type mount_exec_t; -- type named_exec_t; -- type ndc_exec_t; -- type ntop_port_t; -- type pcp_log_t; -- type pcp_pmcd_t; -- type pcp_pmie_exec_t; # pmda.summary -- type pcp_pmie_t; -- type pcp_pmlogger_exec_t; -- type pcp_pmlogger_t; -- type pcp_pmproxy_t; -- type pcp_tmp_t; -- type pcp_tmpfs_t; -- type pcp_var_lib_t; -- type ping_exec_t; # pmda.netcheck -- type postgresql_var_run_t; -- type proc_kcore_t; -- type proc_mdstat_t; -- type proc_net_t; #RHBZ1517656 -- type samba_var_t; # pmda.samba -- type setfiles_exec_t; -- type su_exec_t; -- type sysctl_fs_t; #RHBZ1505888 -- type sysctl_irq_t; #pmda.bcc -- type sysctl_net_t; -- type sysfs_t; #RHBZ1545245 -- type syslogd_t; -- type syslogd_var_run_t; -- type system_cronjob_t; -- type tmp_t; -- type unconfined_t; #RHBZ1443632 -- type user_home_t; -- type user_tmp_t; -- type var_run_t; -- type virt_image_t; -- type websm_port_t; # pmda.openmetrics -- -- class blk_file { ioctl open read }; -- class capability { net_raw }; # pmda.netcheck -- class capability { kill dac_override sys_admin sys_ptrace sys_pacct net_admin chown sys_chroot ipc_lock ipc_owner sys_resource fowner sys_rawio fsetid }; -- class chr_file { open read write }; -- class dbus { send_msg }; -- class dir { add_name open read search write getattr lock ioctl }; -- class fifo_file { getattr read open unlink lock ioctl write }; # qa/455 -- class file { append create execute execute_no_trans getattr setattr ioctl lock open read write unlink }; -- class filesystem { mount quotaget }; -- class lnk_file { create read getattr setattr }; -- class msgq { unix_read }; -- class process { signull signal execmem setrlimit ptrace setcap }; #RHBZ1443632, pmda.netcheck (setcap) -- class sem { unix_read associate getattr read }; -- class shm { unix_read associate getattr read }; -- class sock_file { getattr write }; #RHBZ1633211, RHBZ1449671 -- class system { module_request }; -- class tcp_socket { name_bind name_connect }; -- class udp_socket { name_bind }; -- class unix_dgram_socket { create_socket_perms getattr sendto }; -- class unix_stream_socket connectto; --} -- --optional_policy(` -- require { -- class bpf { map_create map_read map_write prog_load prog_run }; -- } -- #RHBZ1633211, RHBZ1693332 -- allow pcp_pmcd_t self:bpf { map_create map_read map_write prog_load prog_run }; --') -- --optional_policy(` -- require { -- class capability2 { bpf }; -- } -- #RHBZ1952374 -- # pmda-bcc and pmda-bpftrace need the ability to run eBPF code -- allow pcp_pmcd_t self:capability2 bpf; --') -- --optional_policy(` -- require { -- class capability2 { syslog }; -- } -- # pmda-bcc needs the ability to read addresses in /proc/kallsyms -- allow pcp_pmcd_t self:capability2 syslog; --') -- --optional_policy(` -- require { -- type cluster_exec_t; -- } -- # pmda-hacluster (crm_mon, cibadmin, corosync-quorumtool, corosync-cfgtool) -- # type=AVC msg=audit(N): avc: denied { execute } for pid=PID comm="sh" name="corosync-cfgtool" dev=DEV ino=INO scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:cluster_exec_t:s0 tclass=file permissive=0 -- allow pcp_pmcd_t cluster_exec_t:file { execute execute_no_trans }; --') -- --optional_policy(` -- require { -- type cluster_tmpfs_t; -- } -- # pmda-hacluster (crm_mon, cibadmin, corosync-quorumtool, corosync-cfgtool) -- # type=AVC msg=audit(N): avc: denied { write } for pid=PID comm="crm_mon" name="qb-request-stonith-ng-header" dev="tmpfs" ino=INO scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:cluster_tmpfs_t:s0 tclass=file permissive=1 -- allow pcp_pmcd_t cluster_tmpfs_t:file { write }; --') -- --optional_policy(` -- require { -- type drbd_exec_t; -- } -- # pmda-hacluster (drbdsetup) -- # type=AVC msg=audit(N): avc: denied { execute_no_trans } for pid=PID comm="sh" path="/usr/sbin/drbdsetup" dev="vda1" ino=INO scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:drbd_exec_t:s0 tclass=file permissive=1 -- allow pcp_pmcd_t drbd_exec_t:file { execute execute_no_trans }; --') -- --optional_policy(` -- require { -- class file { map }; -- } -- # type=AVC msg=audit(N): avc: denied { map } for pid=PID comm="pmie" path="/usr/bin/pmie" dev="dm-0" ino=INO scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:pcp_pmie_exec_t:s0 tclass=file permissive=0 -- # type=AVC msg=audit(N): avc: denied { map } for pid=PID comm="ldconfig" path="/usr/sbin/ldconfig" dev="dm-1" ino=INO scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:ldconfig_exec_t:s0 tclass=file permissive=1 -- # type=AVC msg=audit(N): avc: denied { map } for pid=PID comm="smartctl" path="/usr/sbin/smartctl" dev="dm-1" ino=INO scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:fsadm_exec_t:s0 tclass=file permissive=1 -- # type=AVC msg=audit(N): avc: denied { map } for pid=PID comm="pmdanvidia" path="/usr/lib64/libnvidia-ml.so" dev="dm-2" ino=INO scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=unconfined_u:object_r:default_t:s0 tclass=file permissive=0 -- allow pcp_pmcd_t default_t:file { map }; -- allow pcp_pmcd_t fsadm_exec_t:file { map }; -- allow pcp_pmcd_t hostname_exec_t:file { map }; -- allow pcp_pmie_t hostname_exec_t:file { map }; -- allow pcp_pmcd_t ldconfig_exec_t:file { map }; -- allow pcp_pmcd_t pcp_pmie_exec_t:file { map }; -- allow pcp_pmcd_t pcp_tmp_t:file { map }; -- allow pcp_pmcd_t ping_exec_t:file { map }; -- allow pcp_pmcd_t syslogd_var_run_t:file { map }; --') -- --optional_policy(` -- require { -- class rawip_socket { create getopt setopt read write }; -- } -- # pmda.netcheck -- allow pcp_pmcd_t self:rawip_socket { create getopt setopt read write }; --') -- --optional_policy(` -- require { -- class netlink_generic_socket { bind create getattr setopt write read }; -- } -- # pmda-hacluster requirements for checking drbdsetup -- # type=AVC msg=audit(N): avc: denied { write } for pid=PID comm="drbdsetup" scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:pcp_pmcd_t:s0 tclass=netlink_generic_socket permissive=1 -- allow pcp_pmcd_t self:netlink_generic_socket { bind create getattr setopt write read }; --') -- --optional_policy(` -- require { -- class netlink_kobject_uevent_socket { getattr read }; -- } -- # type=AVC msg=audit(N): avc: denied { getattr } for pid=PID comm="python3" path="socket:[36479]" dev="sockfs" ino=INO scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=netlink_kobject_uevent_socket permissive=0 -- allow pcp_pmcd_t self:netlink_kobject_uevent_socket { getattr read }; --') -- --optional_policy(` -- require { -- class netlink_tcpdiag_socket { append bind connect create getattr getopt ioctl lock nlmsg_read nlmsg_write read setattr setopt shutdown write }; -- } -- # pmda-sockets -- # type=AVC msg=audit(N): avc: denied { create } for pid=PID comm="ss" scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:pcp_pmcd_t:s0 tclass=netlink_tcpdiag_socket permissive=1 -- # type=AVC msg=audit(N): avc: denied { setopt } for pid=PID comm="ss" scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:pcp_pmcd_t:s0 tclass=netlink_tcpdiag_socket permissive=1 -- # type=AVC msg=audit(N): avc: denied { bind } for pid=PID comm="ss" scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:pcp_pmcd_t:s0 tclass=netlink_tcpdiag_socket permissive=1 -- # type=AVC msg=audit(N): avc: denied { getattr } for pid=PID comm="ss" scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:pcp_pmcd_t:s0 tclass=netlink_tcpdiag_socket permissive=1 -- # type=AVC msg=audit(N): avc: denied { nlmsg_read } for pid=PID comm="ss" scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:pcp_pmcd_t:s0 tclass=netlink_tcpdiag_socket permissive=1 -- allow pcp_pmcd_t self:netlink_tcpdiag_socket { append bind connect create getattr getopt ioctl lock nlmsg_read nlmsg_write read setattr setopt shutdown write }; --') -- --optional_policy(` -- require { -- type mdadm_conf_t; -- } -- allow pcp_pmcd_t mdadm_conf_t:file { getattr open read }; --') -- --optional_policy(` -- require { -- type container_runtime_t; -- type container_runtime_tmpfs_t; -- type container_var_run_t; -- } -- # pmda.podman -- # type=AVC msg=audit(N): avc: denied { getattr write } for pid=PID comm="pmdapodman" path="/run/podman/podman.sock" dev="tmpfs" ino=INO scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=unconfined_u:object_r:container_var_run_t:s0 tclass=sock_file permissive=0 -- allow pcp_pmcd_t container_var_run_t:file { getattr read open }; -- allow pcp_pmcd_t container_var_run_t:sock_file { getattr write }; -- allow pcp_pmcd_t container_runtime_t:unix_stream_socket connectto; -- allow pcp_pmcd_t container_runtime_tmpfs_t:dir getattr; --') -- --optional_policy(` -- require { -- type docker_var_lib_t; -- } -- # pmda.docker -- allow pcp_pmcd_t docker_var_lib_t:dir search; --') -- --optional_policy(` -- require { -- type dma_device_t; -- } -- # type=AVC msg=audit(N): avc: denied { getattr } for pid=PID comm="pmdaproc" path="/dev/dma_heap" dev="devtmpfs" ino=INO scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:dma_device_t:s0 tclass=dir permissive=0 -- allow pcp_pmcd_t dma_device_t:dir getattr; --') -- --optional_policy(` -- require { -- type kmod_exec_t; -- } -- # pmda-bcc -- # type=AVC msg=audit(N): avc: denied { execute } for pid=PID comm="sh" name="kmod" dev="dm-0" ino=INO scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:kmod_exec_t:s0 tclass=file permissive=0 -- # type=AVC msg=audit(N): avc: denied { execute_no_trans } for pid=PID comm="sh" path="/usr/bin/kmod" dev="dm-0" ino=INO scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:kmod_exec_t:s0 tclass=file permissive=0 -- allow pcp_pmcd_t kmod_exec_t:file { execute execute_no_trans }; --') -- --optional_policy(` -- require { -- type nsfs_t; -- } -- # pmdalinux filesys.used metric -- # type=AVC msg=audit(N): avc: denied { read } for pid=PID comm="pmdalinux" dev="nsfs" ino=INO scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:nsfs_t:s0 tclass=file permissive=1 -- allow pcp_pmcd_t nsfs_t:file { read open getattr }; --') --optional_policy(` -- require { -- type numad_t; -- } -- # type=AVC msg=audit(N): avc: denied { unix_read } for pid=PID comm="pmdalinux" key=KEY scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:numad_t:s0 tclass=msgq permissive=0 -- # type=AVC msg=audit(N): avc: denied { unix_read } for pid=PID comm="pmdalinux" key=KEY scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:numad_t:s0 tclass=msgq permissive=0 -- allow pcp_pmcd_t numad_t:msgq unix_read; --') -- --optional_policy(` -- require { -- type proc_security_t; -- } -- # type=AVC msg=audit(N): avc: denied { read } for pid=PID comm="bpftrace" name="randomize_va_space" dev="proc" ino=INO scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:proc_security_t:s0 tclass=file permissive=0 -- allow pcp_pmcd_t proc_security_t:file { getattr open read }; --') -- --optional_policy(` -- require { -- type rpcbind_var_run_t; -- } -- # pmda.shping -- allow pcp_pmcd_t rpcbind_var_run_t:sock_file write; --') -- --optional_policy(` -- require { -- type sbd_exec_t; -- } -- # pmda-hacluster -- # type=AVC msg=audit(N): avc: denied { execute_no_trans } for pid=PID comm="sh" path="/usr/sbin/sbd" dev="vda1" ino=INO scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:sbd_exec_t:s0 tclass=file permissive=1 -- allow pcp_pmcd_t sbd_exec_t:file { execute execute_no_trans }; --') -- --optional_policy(` -- require { -- type tracefs_t; -- } -- # pmda.perfevent, pmda.kvm -- # type=AVC msg=audit(N): avc: denied { mount } for pid=PID comm="pmdaperfevent" name="/" dev="tracefs" ino=INO scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:tracefs_t:s0 tclass=filesystem permissive=0 -- # type=AVC msg=audit(N): avc: denied { search } for pid=PID comm="pmdaperfevent" name="/" dev="tracefs" ino=INO scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:tracefs_t:s0 tclass=dir permissive=0 -- # type=AVC msg=audit(N): avc: denied { read } for pid=PID comm="pmdaperfevent" name="events" dev="tracefs" ino=INO scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:tracefs_t:s0 tclass=dir permissive=0 -- # type=AVC msg=audit(N): avc: denied { open } for pid=PID comm="pmdaperfevent" path="/sys/kernel/debug/tracing/events" dev="tracefs" ino=INO scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:tracefs_t:s0 tclass=dir permissive=0 -- # type=AVC msg=audit(N): avc: denied { read } for pid=PID comm="pmdaperfevent" name="id" dev="tracefs" ino=INO scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:tracefs_t:s0 tclass=file permissive=0 -- # type=AVC msg=audit(N): avc: denied { open } for pid=PID comm="pmdaperfevent" path="/sys/kernel/debug/tracing/events/gfs2/gfs2_glock_state_change/id" dev="tracefs" ino=INO scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:tracefs_t:s0 tclass=file permissive=0 -- # type=AVC msg=audit(N): avc: denied { read } for pid=PID comm="pmdakvm" name="kvm" dev="tracefs" ino=INO scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:tracefs_t:s0 tclass=dir permissive=0 -- allow pcp_pmcd_t tracefs_t:filesystem { mount }; -- allow pcp_pmcd_t tracefs_t:file { getattr read open append write }; -- allow pcp_pmcd_t tracefs_t:dir { search read open }; --') -- --optional_policy(` -- require { -- type unconfined_service_t; -- } -- #RHBZ1709237 -- # type=AVC msg=audit(N): avc: denied { signull } for pid=PID comm="pmdaX" scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:unconfined_service_t:s0 tclass=process permissive=0 -- # type=AVC msg=audit(N): avc: denied { signal } for pid=PID comm="pmsignal" scontext=system_u:system_r:pcp_pmlogger_t:s0 tcontext=system_u:system_r:unconfined_service_t:s0 tclass=process permissive=0 -- # type=AVC msg=audit(N): avc: denied { signal } for pid=PID comm="pmsignal" scontext=system_u:system_r:pcp_pmie_t:s0 tcontext=system_u:system_r:unconfined_service_t:s0 tclass=process permissive=0 -- allow pcp_pmcd_t unconfined_service_t:process signull; -- allow pcp_pmlogger_t unconfined_service_t:process signal; -- allow pcp_pmie_t unconfined_service_t:process { signal signull }; --') -- --optional_policy(` -- require { -- type init_tmp_t; -- } -- # type=AVC msg=audit(N): avc: denied { write } for pid=PID comm="pmie_check" path="/var/tmp/pmie_rc.FTTTXkNr6/pmie" dev="dm-0" ino=755982 scontext=system_u:system_r:pcp_pmie_t:s0 tcontext=system_u:object_r:init_tmp_t:s0 tclass=file permissive=0 -- # type=AVC msg=audit(N): avc: denied { write } for pid=PID comm="pmlogger_check" path="/var/tmp/pmlogger_rc_start.mbj4oP4Vg/pmcheck.out" dev="dm-0" ino=51322314 scontext=system_u:system_r:pcp_pmlogger_t:s0 tcontext=system_u:object_r:init_tmp_t:s0 tclass=file permissive=0 -- # type=AVC msg=audit(N): avc: denied { unlink } for pid=3012 comm="rm" name="pmie_check.log" dev="dm-0" ino=59069480 scontext=system_u:system_r:pcp_pmie_t:s0 tcontext=system_u:object_r:init_tmp_t:s0 tclass=file permissive=0 -- # type=AVC msg=audit(N): avc: denied { unlink } for pid=3778 comm="rm" name="pmlogger_check.log" dev="dm-0" ino=100870703 scontext=system_u:system_r:pcp_pmlogger_t:s0 tcontext=system_u:object_r:init_tmp_t:s0 tclass=file permissive=0 -- # -- -- allow pcp_pmie_t init_tmp_t:file { write unlink }; -- allow pcp_pmlogger_t init_tmp_t:file { write unlink }; --') -- --optional_policy(` -- require { -- type unreserved_port_t; -- } -- # type=AVC msg=audit(N): avc: denied { name_bind } for pid=PID comm="pmdasimple" src=5650 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:unreserved_port_t:s0 tclass=tcp_socket permissive=0 -- # type=AVC msg=audit(N): avc: denied { name_connect } for pid=PID comm="pmcd" dest=5650 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:unreserved_port_t:s0 tclass=tcp_socket permissive=0 -- # type=AVC msg=audit(N): avc: denied { name_bind } for pid=PID comm="pmdastatsd" src=8126 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:unreserved_port_t:s0 tclass=udp_socket permissive=0 -- # type=AVC msg=audit(N): avc: denied { name_bind } for pid=PID comm=pmlogger src=4332 scontext=system_u:system_r:pcp_pmlogger_t:s0 tcontext=system_u:object_r:unreserved_port_t:s0 tclass=tcp_socket permissive=0 -- allow pcp_pmcd_t unreserved_port_t:tcp_socket { name_bind name_connect }; -- allow pcp_pmcd_t unreserved_port_t:udp_socket { name_bind }; -- allow pcp_pmlogger_t unreserved_port_t:tcp_socket { name_bind }; --') -- --optional_policy(` -- require { -- type virt_var_run_t; -- } -- # pmda.libvirt -- # type=AVC msg=audit(N): avc: denied { write } for pid=PID comm="python3" name="libvirt-sock-ro" dev="tmpfs" ino=INO scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:virt_var_run_t:s0 tclass=sock_file permissive=0 -- allow pcp_pmcd_t virt_var_run_t:sock_file write; --') -- --optional_policy(` -- # pmda.statsd -- # type=AVC msg=audit(N): avc: denied { name_bind } for pid=46938 comm=4E65742E204C697374656E6572 src=8125 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:statsd_port_t:s0 tclass=udp_socket permissive=1 -- corenet_udp_bind_statsd_port(pcp_pmcd_t); --') -- --optional_policy(` -- # pmda.zimbra -- # type=AVC msg=audit(N): avc: denied { write } for pid=PID comm="java" name="hsperfdata_zimbra" dev="dm-0" ino=42488265 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=dir permissive=0 -- # type=AVC msg=audit(N): avc: denied { kill } for pid=PID comm="zimbraprobe" capability=5 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:pcp_pmcd_t:s0 tclass=capability permissive=0 -- # type=AVC msg=audit(N): avc: denied { execute } for pid=PID comm="zimbraprobe" name="su" dev="dm-0" ino=INO scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:su_exec_t:s0 tclass=file permissive=0 -- allow pcp_pmcd_t self:capability kill; -- allow pcp_pmcd_t user_tmp_t:dir write; -- allow pcp_pmcd_t su_exec_t:file { execute execute_no_trans }; -- userdom_manage_tmp_dirs(pcp_pmcd_t) -- userdom_manage_tmp_files(pcp_pmcd_t) --') -- --#============= init_t ============== --# type=AVC msg=audit(N): avc: denied { read } for pid=PID comm="pmcd" name="pmcd" dev="dm-1" ino=INO scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:pcp_log_t:s0 tclass=dir permissive=0 --allow init_t pcp_log_t:dir read; -- --allow init_t pcp_log_t:file getattr; -- --# type=AVC msg=audit(N): avc: denied { getattr } for pid=PID comm="pmcd" path="/var/lib/pcp/pmns/root" dev="dm-1" ino=INO scontext=system_u:system_r:init_t:s0 tcontext=unconfined_u:object_r:pcp_var_lib_t:s0 tclass=file permissive=0 --allow init_t pcp_var_lib_t:dir { add_name read write }; -- --# type=AVC msg=audit(N): avc: denied { execute } for pid=PID comm="pmcd" name="Rebuild" dev="dm-1" ino=INO scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:pcp_var_lib_t:s0 tclass=file permissive=0 --# execute -- --allow init_t pcp_var_lib_t:file { append create execute execute_no_trans getattr ioctl open read write }; -- --allow init_t pcp_var_lib_t:lnk_file read; -- --# type=AVC msg=audit(N): avc: denied { open } for pid=PID comm="pmcd" path="/var/tmp/pcp.xxx/pcp.env.path" dev="dm-1" ino=INO scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:tmp_t:s0 tclass=file permissive=0 --# --allow init_t tmp_t:file open; -- --# type=USER_AVC msg=audit(N): pid=PID uid=INO auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: denied { send_msg } for msgtype=method_return dest=:1.14778 spid=1 tpid=19555 scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:system_cronjob_t:s0-s0:c0.c1023 tclass=dbus permissive=0 exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?' --allow init_t system_cronjob_t:dbus send_msg; -- -- --#============= pcp_pmcd_t ============== -- --#SYN AVC for testing --# type=AVC msg=audit(N): avc: denied { execute execute_no_trans open read } for pid=PID comm="pmdaX" name="/" dev="tracefs" ino=INO scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:user_home_t:s0 tclass=file permissive=0 --allow pcp_pmcd_t user_home_t:file { execute execute_no_trans open read }; -- --# type=AVC msg=audit(N): avc: denied { getattr write } for pid=PID comm="pmdapodman" path="/run/user/N/podman/podman.sock" dev="tmpfs" ino=INO scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=sock_file permissive=0 --allow pcp_pmcd_t user_tmp_t:sock_file { getattr write }; -- --# type=AVC msg=audit(N): avc: denied { getattr write } for pid=PID comm="pmdapodman" path="/run/podman/podman.sock" dev="tmpfs" ino=INO scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:var_run_t:s0 tclass=sock_file permissive=0 --allow pcp_pmcd_t var_run_t:sock_file { getattr write }; -- --# type=AVC msg=audit(N): avc: denied { append getattr ioctl open read write } for pid=PID comm="pmdaX" name="/" dev="tracefs" ino=INO scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:debugfs_t:s0 tclass=file permissive=0 --allow pcp_pmcd_t debugfs_t:file { append getattr ioctl open read write }; --allow pcp_pmcd_t debugfs_t:dir read; -- --# type=AVC msg=audit(N): avc: denied { execute execute_no_trans open read } for pid=PID comm="pmdaX" name="/" dev="tracefs" ino=INO scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:pcp_pmie_exec_t:s0 tclass=file permissive=0 --allow pcp_pmcd_t pcp_pmie_exec_t:file { execute execute_no_trans open read }; -- --# type=AVC msg=audit(N): avc: denied { getattr open read unlink } for pid=PID comm="pmdaX" name="/" dev="tracefs" ino=INO scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:pcp_var_lib_t:s0 tclass=fifo_file permissive=0 --allow pcp_pmcd_t pcp_var_lib_t:fifo_file { getattr open read unlink }; #RHBZ1460131 -- --# type=AVC msg=audit(N): avc: denied { getattr } for pid=PID comm="pmdaX" name="/" dev="tracefs" ino=INO scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:proc_kcore_t:s0 tclass=file permissive=0 --allow pcp_pmcd_t proc_kcore_t:file getattr; -- --# type=AVC msg=audit(N): avc: denied { sys_chroot kill sys_resource } for pid=PID comm="pmdalinux" capability=18 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:pcp_pmcd_t:s0 tclass=capability --# type=AVC msg=audit(N): avc: denied { chown } for pid=PID comm="pmdasimple" capability=0 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:pcp_pmcd_t:s0 tclass=capability --# type=AVC msg=audit(N): avc: denied { sys_pacct } for pid=PID comm="pmdaproc" capability=20 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:pcp_pmcd_t:s0 tclass=capability permissive=0 --allow pcp_pmcd_t self:capability { kill sys_pacct chown sys_chroot ipc_owner ipc_lock sys_resource }; -- --# type=AVC msg=audit(N): avc: denied { write } for pid=PID comm="smbstatus" name="msg.lock" dev="dm-0" ino=INO scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:samba_var_t:s0 tclass=dir permissive=0 --allow pcp_pmcd_t samba_var_t:dir { add_name write }; # pmda.samba --allow pcp_pmcd_t samba_var_t:file { create }; # pmda.samba -- --# type=AVC msg=audit(N): avc: denied { name_connect } for pid=PID comm="python3" dest=9090 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:websm_port_t:s0 tclass=tcp_socket permissive=0 --allow pcp_pmcd_t websm_port_t:tcp_socket name_connect; # pmda.openmetrics -- --# type=AVC msg=audit(N): avc: denied { execute } for pid=PID comm="sh" name="8641" dev="tmpfs" ino=INO scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:pcp_tmp_t:s0 tclass=file permissive=0 --# type=AVC msg=audit(N): avc: denied { execute_no_trans } for pid=PID comm="sh" path="/tmp/8641" dev="tmpfs" ino=INO scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:pcp_tmp_t:s0 tclass=file permissive=0 --allow pcp_pmcd_t pcp_tmp_t:file { execute execute_no_trans }; -- --# type=AVC msg=audit(N): avc: denied { getattr } for pid=PID comm="sh" path="/usr/bin/hostname" dev="dm-1" ino=INO scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:hostname_exec_t:s0 tclass=file permissive=0 --# type=AVC msg=audit(N): avc: denied { execute } for pid=PID comm="sh" name="hostname" dev="dm-1" ino=INO scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:hostname_exec_t:s0 tclass=file permissive=0 --# type=AVC msg=audit(N): avc: denied { read } for pid=PID comm="sh" name="hostname" dev="dm-1" ino=INO scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:hostname_exec_t:s0 tclass=file permissive=0 --# type=AVC msg=audit(N): avc: denied { open } for pid=PID comm="sh" path="/usr/bin/hostname" dev="dm-1" ino=INO scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:hostname_exec_t:s0 tclass=file permissive=0 --# type=AVC msg=audit(N): avc: denied { execute_no_trans } for pid=PID comm="sh" path="/usr/bin/hostname" dev="dm-1" ino=INO scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:hostname_exec_t:s0 tclass=file permissive=0 --allow pcp_pmcd_t hostname_exec_t:file { getattr execute read open execute_no_trans }; -- --# https://bugzilla.redhat.com/show_bug.cgi?id=2050094 --# type=AVC msg=audit(N): avc: denied { execute } for pid=PID comm="python3" path=2F6D656D66643A6C6962666669202864656C6574656429 dev="tmpfs" ino=INO scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:pcp_tmpfs_t:s0 tclass=file permissive=0 --# libffi (used by Python/ctypes) wants to execute from memfd:libffi (a memory mapped file) --# similar to selinux-policy PR: https://github.com/fedora-selinux/selinux-policy/pull/1019 --can_exec(pcp_pmcd_t, pcp_tmpfs_t) -- --# type=AVC msg=audit(N): avc: denied { getattr } for pid=PID comm="pmdaproc" path="/dev/gpmctl" dev="devtmpfs" ino=INO scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:gpmctl_t:s0 tclass=sock_file permissive=1 --allow pcp_pmcd_t gpmctl_t:sock_file getattr; -- --# type=AVC msg=audit(N): avc: denied { write } for pid=PID comm="pmdaX" name="/" dev="tracefs" ino=INO scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:haproxy_var_lib_t:s0 tclass=sock_file permissive=0 --allow pcp_pmcd_t haproxy_var_lib_t:sock_file write; -- --# type=AVC msg=audit(N): avc: denied { write } for pid=PID comm="pmdaxfs" name="stats_clear" dev="proc" ino=INO scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:sysctl_fs_t:s0 tclass=file --#RHBZ1505888 --allow pcp_pmcd_t sysctl_fs_t:file write; -- --# type=AVC msg=audit(N): avc: denied { quotaget } for pid=PID comm="pmdaxfs" scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:fs_t:s0 tclass=filesystem permissive=0 --allow pcp_pmcd_t fs_t:filesystem quotaget; -- -- --#RHBZ1545245 --# type=AVC msg=audit(N): avc: denied { write } for pid=PID comm="pmdaX" name="/" dev="tracefs" ino=INO scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:sysfs_t:s0 tclass=dir permissive=0 --allow pcp_pmcd_t sysfs_t:dir write; -- --# pmda.bcc --# type=AVC msg=audit(N): avc: denied { read } for pid=PID comm="pmdaX" name="/" dev="tracefs" ino=INO scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:modules_object_t:s0 tclass=lnk_file permissive=0 --allow pcp_pmcd_t modules_object_t:lnk_file read; -- --# type=AVC msg=audit(N): avc: denied { execute execute_no_trans open read } for pid=PID comm="pmdaX" name="/" dev="tracefs" ino=INO scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:mdadm_exec_t:s0 tclass=file permissive=0 --allow pcp_pmcd_t mdadm_exec_t:file { execute execute_no_trans open read }; -- --# type=AVC msg=audit(N): avc: denied { execute } for pid=PID comm="pmdaX" name="unbound-control" dev="vda1" ino=INO scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:named_exec_t:s0 tclass=file permissive=0 --allow pcp_pmcd_t named_exec_t:file execute; --allow pcp_pmcd_t ndc_exec_t:file { execute execute_no_trans }; -- --# type=AVC msg=audit(N): avc: denied { getattr open read } for pid=PID comm="pmdaX" name="/" dev="tracefs" ino=INO scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:proc_mdstat_t:s0 tclass=file permissive=0 --allow pcp_pmcd_t proc_mdstat_t:file { getattr open read }; -- --#pmda.bcc --# type=AVC msg=audit(N): avc: denied { execmem setrlimit ptrace } for pid=PID comm="pmdaX" name="/" dev="tracefs" ino=INO scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:pcp_pmcd_t:s0 tclass=process permissive=0 --allow pcp_pmcd_t self:process { execmem setrlimit ptrace }; -- --# type=AVC msg=audit(N): avc: denied { search } for pid=PID comm="pmdaX" name="/" dev="tracefs" ino=INO scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:sysctl_irq_t:s0 tclass=dir permissive=0 --allow pcp_pmcd_t sysctl_irq_t:dir { search }; -- --# type=AVC msg=audit(N): avc: denied { signull } for pid=PID comm="pmdaX" name="/" dev="tracefs" ino=INO scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:kernel_t:s0 tclass=process permissive=0 --allow pcp_pmcd_t kernel_t:process signull; -- --# pmda-bcc -- failing to compile bpf files on Fedora 33 --# type=AVC msg=audit(N): avc: denied { fsetid } for pid=PID comm="tar" capability=4 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:pcp_pmcd_t:s0 tclass=capability permissive=1 --# type=AVC msg=audit(N): avc: denied { create } for pid=PID comm="tar" name="linux-event-codes.h" scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:pcp_tmp_t:s0 tclass=lnk_file permissive=1 --# type=AVC msg=audit(N): avc: denied { setattr } for pid=PID comm="tar" name="linux-event-codes.h" dev="tmpfs" ino=INO scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:pcp_tmp_t:s0 tclass=lnk_file permissive=1 --# type=AVC msg=audit(N): avc: denied { getattr } for pid=PID comm="tar" path="/tmp/kheaders-.../include/dt-bindings/input/linux-event-codes.h" dev="tmpfs" ino=INO scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:pcp_tmp_t:s0 tclass=lnk_file permissive=1 --allow pcp_pmcd_t pcp_tmp_t:lnk_file { create getattr setattr }; --allow pcp_pmcd_t self:capability { fsetid }; -- --#RHBZ1690542 --# type=AVC msg=audit(N): avc: denied { module_request } for pid=PID comm="pmdalinux" kmod="netdev-tun0" scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=system permissive=0 --allow pcp_pmcd_t kernel_t:system module_request; -- --# type=AVC msg=audit(N): avc: denied { write } for pid=PID comm="python3" name=".s.PGSQL.5432" dev="tmpfs" ino=INO scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:postgresql_var_run_t:s0 tclass=sock_file permissive=0 --allow pcp_pmcd_t postgresql_var_run_t:sock_file { write }; -- --allow pcp_pmcd_t ntop_port_t:tcp_socket name_connect; -- --allow pcp_pmcd_t pcp_log_t:fifo_file { getattr open read }; -- --allow pcp_pmcd_t virt_image_t:dir search; -- --allow pcp_pmcd_t syslogd_var_run_t:dir read; -- --allow pcp_pmcd_t syslogd_var_run_t:file { getattr open read }; -- --#============= pcp_pmlogger_t ============== --# type=AVC msg=audit(N): avc: denied { open write } for pid=PID comm="pmdaX" name="/" dev="tracefs" ino=INO scontext=system_u:system_r:pcp_pmlogger_t:s0 tcontext=system_u:object_r:kmsg_device_t:s0 tclass=chr_file permissive=0 --allow pcp_pmlogger_t kmsg_device_t:chr_file { open write }; -- --# type=AVC msg=audit(N): avc: denied { sys_ptrace } for pid=PID comm="ps" capability=19 scontext=system_u:system_r:pcp_pmlogger_t:s0 tcontext=system_u:system_r:pcp_pmlogger_t:s0 tclass=capability --# type=AVC msg=audit(N): avc: denied { kill } for pid=PID comm="pmdaX" name="/" dev="tracefs" ino=INO scontext=system_u:system_r:pcp_pmlogger_t:s0 tcontext=system_u:object_r:pcp_pmlogger_t:s0 tclass=capability permissive=0 --allow pcp_pmlogger_t self:capability { sys_ptrace fowner fsetid kill }; -- --# type=AVC msg=audit(N) : avc: denied { signal } for pid=PID comm=pmsignal scontext=system_u:system_r:pcp_pmlogger_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=process --allow pcp_pmlogger_t unconfined_t:process signal; -- --# type=AVC msg=audit(N): avc: denied { setattr unlink } for pid=PID comm="mv" name="pmlogger_check.log" dev="dm-0" ino=INO scontext=system_u:system_r:pcp_pmlogger_t:s0 tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=file permissive=0 --allow pcp_pmlogger_t user_tmp_t:file { setattr unlink }; -- --# type=AVC msg=audit(N): avc: denied { execute } for pid=PID comm="pmlogger_daily" name="setfiles" dev="dm-0" ino=INO scontext=system_u:system_r:pcp_pmlogger_t:s0 tcontext=system_u:object_r:setfiles_exec_t:s0 tclass=file permissive=0 --allow pcp_pmlogger_t setfiles_exec_t:file execute; -- --# type=AVC msg=audit(N): avc: denied { write } for pid=PID comm="pmlogger" name="12" dev="dm-0" ino=INO scontext=system_u:system_r:pcp_pmlogger_t:s0 tcontext=system_u:object_r:initrc_tmp_t:s0 tclass=dir permissive=0 --# type=AVC msg=audit(N): avc: denied { unlink } for pid=PID comm="rm" name="pmlogger_check.log" dev="dm-0" ino=58981759 scontext=system_u:system_r:pcp_pmlogger_t:s0 tcontext=system_u:object_r:initrc_tmp_t:s0 tclass=file permissive=0 --# type=AVC msg=audit(N): avc: denied { write } for pid=PID comm="pmlock" name="pmlogger" scontext=system_u:system_r:pcp_pmlogger_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=dir permissive=0 --# type=AVC msg=audit(N): avc: denied { execute } for pid=PID comm="pmlogctl" name="mount" scontext=system_u:system_r:pcp_pmlogger_t:s0 tcontext=system_u:object_r:mount_exec_t:s0 tclass=file permissive=0 --# type=AVC msg=audit(N): avc: denied { write } for pid=PID comm="pmlogctl" name="cgroup.procs" scontext=system_u:system_r:pcp_pmlogger_t:s0 tcontext=system_u:object_r:cgroup_t:s0 tclass=file permissive=0 --allow pcp_pmlogger_t initrc_tmp_t:dir { add_name read write }; --allow pcp_pmlogger_t initrc_tmp_t:file { create unlink }; --allow pcp_pmlogger_t mount_exec_t:file { execute execute_no_trans }; --allow pcp_pmlogger_t etc_t:dir { add_name read remove_name write }; --allow pcp_pmlogger_t etc_t:file { create unlink write }; --allow pcp_pmlogger_t cgroup_t:file { getattr read open append write }; -- --# type=AVC msg=audit(N) : avc: denied { getattr } for pid=PID comm=pstree scontext=system_u:system_r:pcp_pmlogger_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=process permissive=0 --allow pcp_pmlogger_t init_t:process getattr; -- --# type=AVC msg=audit(N) : avc: denied { getattr } for pid=PID comm=mount path=/dev/dm-0 dev="devtmpfs" ino=INO scontext=system_u:system_r:pcp_pmlogger_t:s0 tcontext=system_u:object_r:fixed_disk_device_t:s0 tclass=blk_file permissive=0 --allow pcp_pmlogger_t fixed_disk_device_t:blk_file getattr; --allow pcp_pmlogger_t sysfs_t:lnk_file read; -- --#============= pcp_pmie_t ============== --# type=AVC msg=audit(N): avc: denied { execute execute_no_trans getattr open read } for pid=PID comm="pmdaX" name="/" dev="tracefs" ino=INO scontext=system_u:system_r:pcp_pmie_t:s0 tcontext=system_u:object_r:hostname_exec_t:s0 tclass=file permissive=0 --allow pcp_pmie_t hostname_exec_t:file { execute execute_no_trans getattr open read }; -- --# type=AVC msg=audit(N): avc: denied { sys_ptrace } for pid=PID comm="ps" capability=19 scontext=system_u:system_r:pcp_pmie_t:s0 tcontext=system_u:system_r:pcp_pmie_t:s0 tclass=capability permissive=0 --allow pcp_pmie_t self:capability { chown fowner dac_override kill net_admin sys_ptrace fsetid }; -- --#RHBZ1517656 --# type=AVC msg=audit(N): avc: denied { read } for pid=PID comm="pmdaX" name="/" dev="tracefs" ino=INO scontext=system_u:system_r:pcp_pmie_t:s0 tcontext=system_u:object_r:proc_net_t:s0 tclass=file permissive=0 --allow pcp_pmie_t proc_net_t:file read; -- --#RHBZ2122883 --# type=AVC audit(N): avc: denied { read } for pid=PID comm="pmie" name="net" dev="proc" ino=INO scontext=system_u:system_r:pcp_pmie_t:s0 tcontext=system_u:object_r:proc_net_t:s0 tclass=lnk_file permissive=0 --allow pcp_pmie_t proc_net_t:lnk_file read; -- --#RHBZ1743040 --# type=AVC msg=audit(N): avc: denied { setrlimit } for pid=PID comm="systemctl" scontext=system_u:system_r:pcp_pmie_t:s0 tcontext=system_u:system_r:pcp_pmie_t:s0 tclass=process permissive=0 --allow pcp_pmie_t self:process setrlimit; -- --#RHBZ1623988 --# type=AVC msg=audit(N): avc: denied { signal } for pid=PID comm="pmsignal" scontext=system_u:system_r:pcp_pmie_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=process permissive=1 --allow pcp_pmie_t unconfined_t:process signal; -- --# type=AVC msg=audit(N): avc: denied { write } for pid=PID comm="pmie" name="02" dev="dm-0" ino=INO scontext=system_u:system_r:pcp_pmie_t:s0 tcontext=system_u:object_r:initrc_tmp_t:s0 tclass=dir permissive=0 --# type=AVC msg=audit(N): avc: denied { unlink } for pid=PID comm="rm" name="pmie_check.log" dev="dm-0" ino=17724510 scontext=system_u:system_r:pcp_pmie_t:s0 tcontext=system_u:object_r:initrc_tmp_t:s0 tclass=file permissive=0 --# type=AVC msg=audit(N): avc: denied { write } for pid=PID comm="pmlock" name="pmie" scontext=system_u:system_r:pcp_pmie_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=dir permissive=0 --# type=AVC msg=audit(N): avc: denied { execute } for pid=PID comm="pmiectl" name="mount" scontext=system_u:system_r:pcp_pmie_t:s0 tcontext=system_u:object_r:mount_exec_t:s0 tclass=file permissive=0 --allow pcp_pmie_t initrc_tmp_t:dir { add_name read write }; --allow pcp_pmie_t initrc_tmp_t:file { create unlink }; --allow pcp_pmie_t mount_exec_t:file { execute execute_no_trans }; --allow pcp_pmie_t etc_t:dir { add_name read remove_name write }; --allow pcp_pmie_t etc_t:file { create unlink write }; --allow pcp_pmie_t cgroup_t:file { getattr read open append write }; -- --# type=AVC msg=audit(N) : avc: denied { getattr } for pid=PID comm=mount path=/dev/dm-0 dev="devtmpfs" ino=INO scontext=system_u:system_r:pcp_pmie_t:s0 tcontext=system_u:object_r:fixed_disk_device_t:s0 tclass=blk_file permissive=0 --allow pcp_pmie_t fixed_disk_device_t:blk_file getattr; --allow pcp_pmie_t sysfs_t:lnk_file read; --allow pcp_pmie_t sysfs_t:file read; --allow pcp_pmie_t sysfs_t:dir read; -- --# type=AVC msg=audit(N): avc: denied { search } for pid=PID comm="ps" name="homedir" dev="device" ino=INO scontext=system_u:system_r:pcp_pmie_t:s0 tcontext=unconfined_u:object_r:user_home_dir_t:s0 tclass=dir permissive=0 --allow pcp_pmie_t user_home_t:dir { open read search }; -- --#============= pmda-lio ============== --# type=AVC msg=audit(N): avc: denied { open read search write } for pid=PID comm="pmdaX" name="/" dev="tracefs" ino=INO scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:configfs_t:s0 tclass=dir permissive=0 --allow pcp_pmcd_t configfs_t:dir { add_name open read search write }; -- --# type=AVC msg=audit(N): avc: denied { getattr ioctl open read } for pid=PID comm="pmdaX" name="/" dev="tracefs" ino=INO scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:configfs_t:s0 tclass=file permissive=0 --allow pcp_pmcd_t configfs_t:file { create getattr ioctl open read write }; -- --# type=AVC msg=audit(N): avc: denied { getattr read } for pid=PID comm="pmdaX" name="/" dev="tracefs" ino=INO scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:configfs_t:s0 tclass=lnk_file permissive=0 --allow pcp_pmcd_t configfs_t:lnk_file { getattr read }; -- --# type=AVC msg=audit(N): avc: denied { module_load } for pid=PID comm="pmdaX" scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:pcp_pmcd_t:s0 tclass=system permissive=0 --allow pcp_pmcd_t self:system module_load; -- --# type=AVC msg=audit(N): avc: denied { execute execute_no_trans getattr open read } for pid=PID comm="pmdaX" name="/" dev="tracefs" ino=INO scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:ldconfig_exec_t:s0 tclass=file permissive=0 --allow pcp_pmcd_t ldconfig_exec_t:file { execute execute_no_trans getattr open read }; -- --#============= pcp_pmproxy_t ============== --# type=AVC msg=audit(N) : avc: denied { net_admin } for pid=PID comm=pmproxy capability=net_admin scontext=system_u:system_r:pcp_pmproxy_t:s0 tcontext=system_u:system_r:pcp_pmproxy_t:s0 tclass=capability --allow pcp_pmproxy_t self:capability { net_admin dac_override }; -- --# type=AVC msg=audit(N) : avc: denied { read } for pid=PID comm=pmproxy name=disable_ipv6 dev="proc" ino=INO scontext=system_u:system_r:pcp_pmproxy_t:s0 tcontext=system_u:object_r:sysctl_net_t:s0 tclass=file --# type=AVC msg=audit(N) : avc: denied { open } for pid=PID comm=pmproxy path=/proc/sys/net/ipv6/conf/all/disable_ipv6 dev="proc" ino=INO scontext=system_u:system_r:pcp_pmproxy_t:s0 tcontext=system_u:object_r:sysctl_net_t:s0 tclass=file --# type=AVC msg=audit(N) : avc: denied { getattr } for pid=PID comm=pmproxy path=/proc/sys/net/ipv6/conf/all/disable_ipv6 dev="proc" ino=INO scontext=system_u:system_r:pcp_pmproxy_t:s0 tcontext=system_u:object_r:sysctl_net_t:s0 tclass=file --allow pcp_pmproxy_t sysctl_net_t:file { getattr open read }; -- --# type=AVC msg=audit(N): avc: denied { read } for pid=PID comm="pmproxy" name="unix" dev="proc" ino=INO scontext=system_u:system_r:pcp_pmproxy_t:s0 tcontext=system_u:object_r:proc_net_t:s0 tclass=file --#RHBZ1517656 --allow pcp_pmproxy_t proc_net_t:file read; -- --# type=AVC msg=audit(N): avc: denied { read } for pid=PID comm="pmproxy" name="pmlogger" dev="dm-92" ino=INO scontext=system_u:system_r:pcp_pmproxy_t:s0 tcontext=system_u:object_r:pcp_log_t:s0 tclass=lnk_file --allow pcp_pmproxy_t pcp_log_t:lnk_file read; -- --#============= pmda-smart ============== -- --# type=AVC msg=audit(N): avc: denied { read } for pid=PID comm="sh" name="smartctl" dev="dm-1" ino=INO scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:fsadm_exec_t:s0 tclass=file permissive=1 --# type=AVC msg=audit(N): avc: denied { open } for pid=PID comm="sh" path="/usr/sbin/smartctl" dev="dm-1" ino=INO scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:fsadm_exec_t:s0 tclass=file permissive=1 --# type=AVC msg=audit(N): avc: denied { execute_no_trans } for pid=PID comm="sh" path="/usr/sbin/smartctl" dev="dm-1" ino=INO scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:fsadm_exec_t:s0 tclass=file permissive=1 --# type=AVC msg=audit(N): avc: denied { execute } for pid=PID comm="sh" name="smartctl" dev="dm-1" ino=INO scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:fsadm_exec_t:s0 tclass=file permissive=1 --# type=AVC msg=audit(N): avc: denied { getattr } for pid=PID comm="sh" path="/usr/sbin/smartctl" dev="dm-1" ino=INO scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:fsadm_exec_t:s0 tclass=file permissive=1 --# type=AVC msg=audit(N): avc: denied { sys_rawio } for pid=PID comm="smartctl" capability=17 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:pcp_pmcd_t:s0 tclass=capability permissive=1 --# type=AVC msg=audit(N): avc: denied { read } for pid=PID comm="smartctl" name="sda" dev="devtmpfs" ino=INO scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:fixed_disk_device_t:s0 tclass=blk_file permissive=0 -- --allow pcp_pmcd_t fsadm_exec_t:file { execute execute_no_trans getattr open read }; --allow pcp_pmcd_t fixed_disk_device_t:blk_file { open read ioctl }; -- --#============= pmda-nvidia ============== --# type=AVC msg=audit(N): avc: denied { execute } for pid=PID comm="pmdanvidia" path="/usr/lib64/libnvidia-ml.so" dev="dm-2" ino=INO scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=unconfined_u:object_r:default_t:s0 tclass=file permissive=0 --# type=AVC msg=audit(N): avc: denied { read } for pid=PID comm="pmdanvidia" name="nvidia-cap2" dev="devtmpfs" ino=INO scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=unconfined_u:object_r:device_t:s0 tclass=chr_file permissive=0 --#RHEL-83594 --allow pcp_pmcd_t default_t:file { execute }; --allow pcp_pmcd_t device_t:chr_file { create open read setattr write }; --allow pcp_pmcd_t device_t:dir { add_name remove_name write }; --allow pcp_pmcd_t device_t:lnk_file { create unlink }; --allow pcp_pmcd_t self:capability mknod; -- --# type=AVC msg=audit(N): avc: denied { sys_rawio } for pid=PID comm="pmdaX" name="/" dev="tracefs" ino=INO scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:pcp_pmcd_t:s0 tclass=capability permissive=0 --allow pcp_pmcd_t self:capability sys_rawio; -- --#============= pmda-openvswitch ============== --optional_policy(` -- require { -- type openvswitch_exec_t; -- } -- # pmda.openvswitch -- # type=AVC msg=audit(N): avc: denied { execute } for pid=PID comm="sh" name="ovs-vsctl" dev="dm-0" ino=INO scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:openvswitch_exec_t:s0 tclass=file permissive=0 -- allow pcp_pmcd_t openvswitch_exec_t:file { execute execute_no_trans }; --') -- --#============= pmda-netcheck ============== --allow pcp_pmcd_t ping_exec_t:file { execute execute_no_trans }; --allow pcp_pmcd_t self:capability net_raw; --allow pcp_pmcd_t self:process setcap; -- --optional_policy(` -- require { -- class icmp_socket { create getopt setopt read write }; -- } -- # pmda.netcheck -- allow pcp_pmcd_t self:icmp_socket { create getopt setopt read write }; --') -- --# permit pcp_domain to read all dirs,files and fifo_file in attribute file_type --optional_policy(` -- files_list_non_auth_dirs(pcp_domain) --') --optional_policy(` -- files_list_non_security(pcp_domain) --') --files_read_all_files(pcp_pmcd_t) --files_read_all_files(pcp_pmie_t) --files_read_all_files(pcp_pmlogger_t) --files_read_all_files(pcp_pmproxy_t) -- --allow pcp_domain file_type:fifo_file read_fifo_file_perms; -- --# permit pcp_pmcd_t domain to read shared memory and semaphores of all domain on system --allow pcp_domain domain:shm r_sem_perms; --allow pcp_domain domain:sem r_shm_perms; --allow pcp_domain userdomain:shm r_sem_perms; --allow pcp_domain userdomain:sem r_shm_perms; -- --# permit pcp_domain stream connect to all domains --allow pcp_domain domain:unix_stream_socket connectto; -- --# permit pcp_domain to connect to all ports. --corenet_tcp_connect_all_ports(pcp_domain) -- --# all pcp_domain read access to all maps --optional_policy(` -- files_mmap_all_files(pcp_domain); --') -- --# all pcp_domain watch access to all log files --optional_policy(` -- logging_watch_all_log_dirs_path(pcp_domain); --') --optional_policy(` -- logging_watch_journal_dir(pcp_domain); --') --allow syslogd_t pcp_log_t:fifo_file { open read write }; -- --#============= pcp_pmcd_t ============== --# --##============= pcp_pmie_t ============== --#files_manage_generic_tmp_dirs(pcp_pmie_t) --#files_manage_generic_tmp_files(pcp_pmie_t) --# --##============= pcp_pmlogger_t ============== -- --#============= pmda-denki ================= --require { -- type pcp_pmcd_t; -- type cpu_device_t; -- class chr_file { open read }; --} --#============= pcp_pmcd_t ============== --allow pcp_pmcd_t cpu_device_t:chr_file read; --allow pcp_pmcd_t cpu_device_t:chr_file open; diff --git a/pcp.spec b/pcp.spec index 0242a1c..e153b3a 100644 --- a/pcp.spec +++ b/pcp.spec @@ -1,6 +1,6 @@ Name: pcp Version: 6.3.7 -Release: 11%{?dist} +Release: 12%{?dist} Summary: System-level performance monitoring and performance management License: GPL-2.0-or-later AND LGPL-2.1-or-later AND CC-BY-3.0 URL: https://pcp.io