add nrpe to nagios, bug 1533

refpolicy/policy/modules/services/nagios.fc

@@ -1,8 +1,8 @@
-
-
 /etc/nagios(/.*)?			gen_context(system_u:object_r:nagios_etc_t,s0)
+/etc/nagios/nrpe\.cfg		--	gen_context(system_u:object_r:nrpe_etc_t,s0)
 
 /usr/bin/nagios			--	gen_context(system_u:object_r:nagios_exec_t,s0)
+/usr/bin/nrpe			--	gen_context(system_u:object_r:nrpe_exec_t,s0)
 
 /usr/lib(64)?/cgi-bin/netsaint/.+ --	gen_context(system_u:object_r:nagios_cgi_exec_t,s0)
 /usr/lib(64)?/nagios/cgi/.+	--	gen_context(system_u:object_r:nagios_cgi_exec_t,s0)

refpolicy/policy/modules/services/nagios.if

@@ -62,3 +62,25 @@ interface(`nagios_domtrans_cgi',`
 	allow nagios_cgi_t $1:fifo_file rw_file_perms;
 	allow nagios_cgi_t $1:process sigchld;
 ')
+
+########################################
+## <summary>
+##	Execute the nagios NRPE with
+##	a domain transition.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`nagios_domtrans_nrpe',`
+	gen_require(`
+		type nrpe_t, nrpe_exec_t;
+	')
+
+	domain_auto_trans($1,nrpe_exec_t,nrpe_t)
+	allow nrpe_t $1:fd use;
+	allow nrpe_t $1:fifo_file rw_file_perms;
+	allow nrpe_t $1:process sigchld;
+')

refpolicy/policy/modules/services/nagios.te

@@ -1,5 +1,5 @@
 
-policy_module(nagios,1.0.0)
+policy_module(nagios,1.0.1)
 
 ########################################
 #
@@ -26,6 +26,13 @@ files_tmp_file(nagios_tmp_t)
 type nagios_var_run_t;
 files_pid_file(nagios_var_run_t)
 
+type nrpe_t;
+type nrpe_exec_t;
+init_daemon_domain(nrpe_t,nrpe_exec_t)
+
+type nrpe_etc_t;
+files_config_file(nrpe_etc_t)
+
 ########################################
 #
 # Nagios local policy
@@ -181,3 +188,63 @@ miscfiles_read_localization(nagios_cgi_t)
 optional_policy(`
 	apache_append_log(nagios_cgi_t)
 ')
+
+########################################
+#
+# Nagios remote plugin executor local policy
+#
+
+dontaudit nrpe_t self:capability sys_tty_config;
+allow nrpe_t self:process { setpgid signal_perms };
+allow nrpe_t self:fifo_file rw_file_perms;
+
+allow nrpe_t nrpe_etc_t:file { getattr read };
+files_search_etc(nrpe_t)
+
+kernel_read_system_state(nrpe_t)
+kernel_read_kernel_sysctls(nrpe_t)
+
+corecmd_exec_bin(nrpe_t)
+corecmd_exec_shell(nrpe_t)
+corecmd_exec_ls(nrpe_t)
+
+dev_read_sysfs(nrpe_t)
+dev_read_urand(nrpe_t)
+
+domain_use_interactive_fds(nrpe_t)
+
+files_read_etc_runtime_files(nrpe_t)
+
+fs_search_auto_mountpoints(nrpe_t)
+
+term_dontaudit_use_console(nrpe_t)
+
+init_use_fds(nrpe_t)
+init_use_script_ptys(nrpe_t)
+
+libs_use_ld_so(nrpe_t)
+libs_use_shared_libs(nrpe_t)
+
+logging_send_syslog_msg(nrpe_t)
+
+miscfiles_read_localization(nrpe_t)
+
+userdom_dontaudit_use_unpriv_user_fds(nrpe_t)
+
+ifdef(`targeted_policy',`
+        term_dontaudit_use_unallocated_ttys(nrpe_t)
+        term_dontaudit_use_generic_ptys(nrpe_t)
+        files_dontaudit_read_root_files(nrpe_t)
+')
+
+optional_policy(`
+	inetd_tcp_service_domain(nrpe_t,nrpe_exec_t)
+')
+
+optional_policy(`
+        seutil_sigchld_newrole(nrpe_t)
+')
+
+optional_policy(`
+        udev_read_db(nrpe_t)
+')

refpolicy/policy/modules/services/tcpd.te

@@ -1,5 +1,5 @@
 
-policy_module(tcpd,1.0.1)
+policy_module(tcpd,1.0.2)
 
 ########################################
 #
@@ -60,6 +60,10 @@ optional_policy(`
 	nis_use_ypbind(tcpd_t)
 ')
 
+optional_policy(`
+	nagios_domtrans_nrpe(tcpd_t)
+')
+
 optional_policy(`
 	portmap_udp_send(tcpd_t)
 ')