92 lines
2.6 KiB
Plaintext
92 lines
2.6 KiB
Plaintext
|
#DESC Net Saint / NAGIOS - network monitoring server
|
||
|
|
#
|
||
|
|
# Author: Russell Coker <russell@coker.com.au>
|
||
|
|
# X-Debian-Packages: netsaint, nagios
|
||
|
|
# Depends: mta.te
|
||
|
|
#
|
||
|
|
|
||
|
|
#################################
|
||
|
|
#
|
||
|
|
# Rules for the nagios_t domain.
|
||
|
|
#
|
||
|
|
# nagios_exec_t is the type of the netsaint/nagios executable.
|
||
|
|
#
|
||
|
|
daemon_domain(nagios, `, privmail')
|
||
|
|
|
||
|
|
etcdir_domain(nagios)
|
||
|
|
typealias nagios_etc_t alias etc_nagios_t;
|
||
|
|
|
||
|
|
logdir_domain(nagios)
|
||
|
|
allow nagios_t nagios_log_t:fifo_file create_file_perms;
|
||
|
|
allow initrc_t nagios_log_t:dir rw_dir_perms;
|
||
|
|
|
||
|
|
tmp_domain(nagios)
|
||
|
|
allow system_mail_t nagios_tmp_t:file { getattr read };
|
||
|
|
# for open file handles
|
||
|
|
dontaudit system_mail_t nagios_etc_t:file read;
|
||
|
|
dontaudit system_mail_t nagios_log_t:fifo_file read;
|
||
|
|
|
||
|
|
# Use the network.
|
||
|
|
allow nagios_t self:fifo_file rw_file_perms;
|
||
|
|
allow nagios_t self:unix_stream_socket create_socket_perms;
|
||
|
|
allow nagios_t self:unix_dgram_socket create_socket_perms;
|
||
|
|
|
||
|
|
# Use capabilities
|
||
|
|
allow nagios_t self:capability { dac_override setgid setuid };
|
||
|
|
allow nagios_t self:process setpgid;
|
||
|
|
|
||
|
|
allow nagios_t { bin_t sbin_t }:dir search;
|
||
|
|
allow nagios_t bin_t:lnk_file read;
|
||
|
|
can_exec(nagios_t, { shell_exec_t bin_t })
|
||
|
|
|
||
|
|
allow nagios_t proc_t:file { getattr read };
|
||
|
|
|
||
|
|
can_network_server(nagios_t)
|
||
|
|
can_ypbind(nagios_t)
|
||
|
|
|
||
|
|
# read config files
|
||
|
|
allow nagios_t { etc_t etc_runtime_t }:file { getattr read };
|
||
|
|
allow nagios_t etc_t:lnk_file read;
|
||
|
|
|
||
|
|
allow nagios_t etc_t:dir r_dir_perms;
|
||
|
|
|
||
|
|
# for ps
|
||
|
|
r_dir_file(nagios_t, domain)
|
||
|
|
allow nagios_t boot_t:dir search;
|
||
|
|
allow nagios_t system_map_t:file { getattr read };
|
||
|
|
|
||
|
|
# for who
|
||
|
|
allow nagios_t initrc_var_run_t:file { getattr read lock };
|
||
|
|
|
||
|
|
system_domain(nagios_cgi)
|
||
|
|
allow nagios_cgi_t device_t:dir search;
|
||
|
|
r_dir_file(nagios_cgi_t, nagios_etc_t)
|
||
|
|
allow nagios_cgi_t var_log_t:dir search;
|
||
|
|
r_dir_file(nagios_cgi_t, nagios_log_t)
|
||
|
|
allow nagios_cgi_t self:process { fork signal_perms };
|
||
|
|
allow nagios_cgi_t self:fifo_file rw_file_perms;
|
||
|
|
allow nagios_cgi_t bin_t:dir search;
|
||
|
|
can_exec(nagios_cgi_t, bin_t)
|
||
|
|
read_locale(nagios_cgi_t)
|
||
|
|
|
||
|
|
# for ps
|
||
|
|
allow nagios_cgi_t { etc_runtime_t etc_t }:file { getattr read };
|
||
|
|
r_dir_file(nagios_cgi_t, { proc_t self nagios_t })
|
||
|
|
allow nagios_cgi_t boot_t:dir search;
|
||
|
|
allow nagios_cgi_t system_map_t:file { getattr read };
|
||
|
|
dontaudit nagios_cgi_t domain:dir getattr;
|
||
|
|
allow nagios_cgi_t self:unix_stream_socket create_socket_perms;
|
||
|
|
|
||
|
|
ifdef(`apache.te', `
|
||
|
|
r_dir_file(httpd_t, nagios_etc_t)
|
||
|
|
domain_auto_trans({ httpd_t httpd_suexec_t }, nagios_cgi_exec_t, nagios_cgi_t)
|
||
|
|
allow nagios_cgi_t httpd_log_t:file append;
|
||
|
|
')
|
||
|
|
|
||
|
|
ifdef(`ping.te', `
|
||
|
|
domain_auto_trans(nagios_t, ping_exec_t, ping_t)
|
||
|
|
allow nagios_t ping_t:process { sigkill signal };
|
||
|
|
dontaudit ping_t nagios_etc_t:file read;
|
||
|
|
dontaudit ping_t nagios_log_t:fifo_file read;
|
||
|
|
')
|