rpms
/
selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity

add nagios, bug 1531

This commit is contained in:
Chris PeBenito 2006-04-06 15:03:23 +00:00
parent a478b5edae
commit f1e604bb03
11 changed files with 352 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
refpolicy/Changelog
View File

@ -40,6 +40,7 @@
games
mozilla
mplayer
nagios
nessus
postgrey
pxe

58
refpolicy/policy/modules/admin/netutils.if
View File

@ -6,7 +6,7 @@
## </summary>
## <param name="domain">
## <summary>
## The type of the process performing this action.
## Domain allowed access.
## </summary>
## </param>
#
@ -30,7 +30,7 @@ interface(`netutils_domtrans',`
## </summary>
## <param name="domain">
## <summary>
## The type of the process performing this action.
## Domain allowed access.
## </summary>
## </param>
## <param name="role">
@ -60,7 +60,7 @@ interface(`netutils_run',`
## </summary>
## <param name="domain">
## <summary>
## The type of the process performing this action.
## Domain allowed access.
## </summary>
## </param>
#
@ -78,7 +78,7 @@ interface(`netutils_exec',`
## </summary>
## <param name="domain">
## <summary>
## The type of the process performing this action.
## Domain allowed access.
## </summary>
## </param>
#
@ -95,6 +95,42 @@ interface(`netutils_domtrans_ping',`
allow ping_t $1:process sigchld;
')
########################################
## <summary>
## Send a kill (SIGKILL) signal to ping.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`netutils_kill_ping',`
gen_require(`
type ping_t;
')
allow $1 ping_t:process sigkill;
')
########################################
## <summary>
## Send generic signals to ping.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`netutils_signal_ping',`
gen_require(`
type ping_t;
')
allow $1 ping_t:process signal;
')
########################################
## <summary>
## Execute ping in the ping domain, and
@ -102,7 +138,7 @@ interface(`netutils_domtrans_ping',`
## </summary>
## <param name="domain">
## <summary>
## The type of the process performing this action.
## Domain allowed access.
## </summary>
## </param>
## <param name="role">
@ -133,7 +169,7 @@ interface(`netutils_run_ping',`
## </summary>
## <param name="domain">
## <summary>
## The type of the process performing this action.
## Domain allowed access.
## </summary>
## </param>
## <param name="role">
@ -167,7 +203,7 @@ interface(`netutils_run_ping_cond',`
## </summary>
## <param name="domain">
## <summary>
## The type of the process performing this action.
## Domain allowed access.
## </summary>
## </param>
#
@ -185,7 +221,7 @@ interface(`netutils_exec_ping',`
## </summary>
## <param name="domain">
## <summary>
## The type of the process performing this action.
## Domain allowed access.
## </summary>
## </param>
#
@ -209,7 +245,7 @@ interface(`netutils_domtrans_traceroute',`
## </summary>
## <param name="domain">
## <summary>
## The type of the process performing this action.
## Domain allowed access.
## </summary>
## </param>
## <param name="role">
@ -240,7 +276,7 @@ interface(`netutils_run_traceroute',`
## </summary>
## <param name="domain">
## <summary>
## The type of the process performing this action.
## Domain allowed access.
## </summary>
## </param>
## <param name="role">
@ -274,7 +310,7 @@ interface(`netutils_run_traceroute_cond',`
## </summary>
## <param name="domain">
## <summary>
## The type of the process performing this action.
## Domain allowed access.
## </summary>
## </param>
#

2
refpolicy/policy/modules/admin/netutils.te
View File

@ -1,5 +1,5 @@
policy_module(netutils,1.1.0)
policy_module(netutils,1.1.1)
########################################
#

2
refpolicy/policy/modules/kernel/corecommands.fc
View File

@ -126,6 +126,8 @@ ifdef(`distro_gentoo',`
/usr/lib(64)?/ipsec/.* -- gen_context(system_u:object_r:sbin_t,s0)
/usr/lib(64)?/mailman/bin(/.*)? gen_context(system_u:object_r:bin_t,s0)
/usr/lib(64)?/misc/sftp-server -- gen_context(system_u:object_r:bin_t,s0)
/usr/lib(64)?/nagios/plugins(/.*)? gen_context(system_u:object_r:bin_t,s0)
/usr/lib(64)?/netsaint/plugins(/.*)? gen_context(system_u:object_r:bin_t,s0)
/usr/lib(64)?/news/bin(/.*)? gen_context(system_u:object_r:bin_t,s0)
/usr/lib(64)?/portage/bin(/.*)? gen_context(system_u:object_r:bin_t,s0)
/usr/lib(64)?/sftp-server -- gen_context(system_u:object_r:bin_t,s0)

2
refpolicy/policy/modules/kernel/corecommands.te
View File

@ -1,5 +1,5 @@
policy_module(corecommands,1.3.7)
policy_module(corecommands,1.3.8)
########################################
#

23
refpolicy/policy/modules/services/apache.if
View File

@ -547,12 +547,33 @@ interface(`apache_read_log',`
type httpd_log_t;
')
files_search_var($1)
logging_search_logs($1)
allow $1 httpd_log_t:dir r_dir_perms;
allow $1 httpd_log_t:file r_file_perms;
allow $1 httpd_log_t:lnk_file { getattr read };
')
########################################
## <summary>
## Allow the specified domain to append
## to apache log files.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`apache_append_log',`
gen_require(`
type httpd_log_t;
')
logging_search_logs($1)
allow $1 httpd_log_t:dir r_dir_perms;
allow $1 httpd_log_t:file append;
')
########################################
## <summary>
## Do not audit attempts to append to the

11
refpolicy/policy/modules/services/apache.te
View File

@ -1,5 +1,5 @@
policy_module(apache,1.3.4)
policy_module(apache,1.3.5)
#
# NOTES:
@ -421,6 +421,11 @@ optional_policy(`
mysql_rw_db_sockets(httpd_t)
')
optional_policy(`
nagios_read_config(httpd_t)
nagios_domtrans_cgi(httpd_t)
')
optional_policy(`
nscd_socket_use(httpd_t)
')
@ -649,6 +654,10 @@ optional_policy(`
dontaudit httpd_suexec_t httpd_t:unix_stream_socket { read write };
')
optional_policy(`
nagios_domtrans_cgi(httpd_suexec_t)
')
optional_policy(`
nis_use_ypbind(httpd_suexec_t)
')

6
refpolicy/policy/modules/services/mta.te
View File

@ -1,5 +1,5 @@
policy_module(mta,1.3.1)
policy_module(mta,1.3.2)
########################################
#
@ -134,6 +134,10 @@ optional_policy(`
logwatch_read_tmp_files(system_mail_t)
')
optional_policy(`
nagios_read_tmp_files(system_mail_t)
')
optional_policy(`
allow system_mail_t etc_aliases_t:dir create_dir_perms;
allow system_mail_t etc_aliases_t:file create_file_perms;

16
refpolicy/policy/modules/services/nagios.fc Normal file
View File

@ -0,0 +1,16 @@
/etc/nagios(/.*)? gen_context(system_u:object_r:nagios_etc_t,s0)
/usr/bin/nagios -- gen_context(system_u:object_r:nagios_exec_t,s0)
/usr/lib(64)?/cgi-bin/netsaint/.+ -- gen_context(system_u:object_r:nagios_cgi_exec_t,s0)
/usr/lib(64)?/nagios/cgi/.+ -- gen_context(system_u:object_r:nagios_cgi_exec_t,s0)
/var/log/nagios(/.*)? gen_context(system_u:object_r:nagios_log_t,s0)
/var/log/netsaint(/.*)? gen_context(system_u:object_r:nagios_log_t,s0)
ifdef(`distro_debian',`
/usr/sbin/nagios -- gen_context(system_u:object_r:nagios_exec_t,s0)
/usr/lib/cgi-bin/nagios/.+ -- gen_context(system_u:object_r:nagios_cgi_exec_t,s0)
')

64
refpolicy/policy/modules/services/nagios.if Normal file
View File

@ -0,0 +1,64 @@
## <summary>Net Saint / NAGIOS - network monitoring server</summary>
########################################
## <summary>
## Allow the specified domain to read
## nagios configuration files.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`nagios_read_config',`
gen_require(`
type nagios_etc_t;
')
allow $1 nagios_etc_t:dir list_dir_perms;
allow $1 nagios_etc_t:file r_file_perms;
files_search_etc($1)
')
########################################
## <summary>
## Allow the specified domain to read
## nagios temporary files.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`nagios_read_tmp_files',`
gen_require(`
type nagios_tmp_t;
')
allow $1 nagios_tmp_t:file r_file_perms;
files_search_tmp($1)
')
########################################
## <summary>
## Execute the nagios CGI with
## a domain transition.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`nagios_domtrans_cgi',`
gen_require(`
type nagios_cgi_t, nagios_cgi_exec_t;
')
domain_auto_trans($1,nagios_cgi_exec_t,nagios_cgi_t)
allow nagios_cgi_t $1:fd use;
allow nagios_cgi_t $1:fifo_file rw_file_perms;
allow nagios_cgi_t $1:process sigchld;
')

183
refpolicy/policy/modules/services/nagios.te Normal file
View File

@ -0,0 +1,183 @@
policy_module(nagios,1.0.0)
########################################
#
# Declarations
#
type nagios_t;
type nagios_exec_t;
init_daemon_domain(nagios_t,nagios_exec_t)
type nagios_cgi_t;
type nagios_cgi_exec_t;
init_system_domain(nagios_cgi_t,nagios_cgi_exec_t)
type nagios_etc_t;
files_config_file(nagios_etc_t)
type nagios_log_t;
logging_log_file(nagios_log_t)
type nagios_tmp_t;
files_tmp_file(nagios_tmp_t)
type nagios_var_run_t;
files_pid_file(nagios_var_run_t)
########################################
#
# Nagios local policy
#
allow nagios_t self:capability { dac_override setgid setuid };
dontaudit nagios_t self:capability sys_tty_config;
allow nagios_t self:process { setpgid signal_perms };
allow nagios_t self:fifo_file rw_file_perms;
allow nagios_t self:tcp_socket create_stream_socket_perms;
allow nagios_t self:udp_socket create_socket_perms;
allow nagios_t nagios_etc_t:file r_file_perms;
allow nagios_t nagios_etc_t:dir r_dir_perms;
allow nagios_t nagios_etc_t:lnk_file { getattr read };
allow nagios_t nagios_log_t:file manage_file_perms;
allow nagios_t nagios_log_t:fifo_file manage_file_perms;
allow nagios_t nagios_log_t:dir rw_dir_perms;
logging_log_filetrans(nagios_t,nagios_log_t,{ file dir })
allow nagios_t nagios_tmp_t:dir create_dir_perms;
allow nagios_t nagios_tmp_t:file create_file_perms;
files_tmp_filetrans(nagios_t, nagios_tmp_t, { file dir })
allow nagios_t nagios_var_run_t:file create_file_perms;
allow nagios_t nagios_var_run_t:dir rw_dir_perms;
files_pid_filetrans(nagios_t,nagios_var_run_t,file)
kernel_read_system_state(nagios_t)
kernel_read_kernel_sysctls(nagios_t)
corecmd_exec_bin(nagios_t)
corecmd_exec_shell(nagios_t)
corenet_tcp_sendrecv_generic_if(nagios_t)
corenet_udp_sendrecv_generic_if(nagios_t)
corenet_raw_sendrecv_generic_if(nagios_t)
corenet_tcp_sendrecv_all_nodes(nagios_t)
corenet_udp_sendrecv_all_nodes(nagios_t)
corenet_raw_sendrecv_all_nodes(nagios_t)
corenet_tcp_sendrecv_all_ports(nagios_t)
corenet_udp_sendrecv_all_ports(nagios_t)
corenet_non_ipsec_sendrecv(nagios_t)
corenet_tcp_bind_all_nodes(nagios_t)
corenet_udp_bind_all_nodes(nagios_t)
dev_read_sysfs(nagios_t)
domain_use_interactive_fds(nagios_t)
# for ps
domain_read_all_domains_state(nagios_t)
files_read_etc_files(nagios_t)
files_read_etc_runtime_files(nagios_t)
files_read_kernel_symbol_table(nagios_t)
fs_getattr_all_fs(nagios_t)
fs_search_auto_mountpoints(nagios_t)
term_dontaudit_use_console(nagios_t)
init_use_fds(nagios_t)
init_use_script_ptys(nagios_t)
# for who
init_read_utmp(nagios_t)
libs_use_ld_so(nagios_t)
libs_use_shared_libs(nagios_t)
logging_send_syslog_msg(nagios_t)
miscfiles_read_localization(nagios_t)
sysnet_read_config(nagios_t)
userdom_dontaudit_use_unpriv_user_fds(nagios_t)
userdom_dontaudit_search_sysadm_home_dirs(nagios_t)
mta_send_mail(nagios_t)
ifdef(`targeted_policy',`
term_dontaudit_use_unallocated_ttys(nagios_t)
term_dontaudit_use_generic_ptys(nagios_t)
files_dontaudit_read_root_files(nagios_t)
')
optional_policy(`
netutils_domtrans_ping(nagios_t)
netutils_signal_ping(nagios_t)
netutils_kill_ping(nagios_t)
# cjp: leaked file descriptors:
#dontaudit ping_t nagios_etc_t:file read;
#dontaudit ping_t nagios_log_t:fifo_file read;
')
optional_policy(`
nis_use_ypbind(nagios_t)
')
optional_policy(`
seutil_sigchld_newrole(nagios_t)
')
optional_policy(`
udev_read_db(nagios_t)
')
# cjp: leaked file descriptors:
# for open file handles
#dontaudit system_mail_t nagios_etc_t:file read;
#dontaudit system_mail_t nagios_log_t:fifo_file read;
########################################
#
# Nagios CGI local policy
#
allow nagios_cgi_t self:process { fork signal_perms };
allow nagios_cgi_t self:fifo_file rw_file_perms;
allow nagios_cgi_t nagios_t:dir r_dir_perms;
allow nagios_cgi_t nagios_t:file r_file_perms;
allow nagios_cgi_t nagios_t:lnk_file { getattr read };
allow nagios_cgi_t nagios_etc_t:dir r_dir_perms;
allow nagios_cgi_t nagios_etc_t:file r_file_perms;
allow nagios_cgi_t nagios_etc_t:lnk_file { getattr read };
allow nagios_cgi_t nagios_log_t:dir r_dir_perms;
allow nagios_cgi_t nagios_log_t:file r_file_perms;
allow nagios_cgi_t nagios_log_t:lnk_file { getattr read };
kernel_read_system_state(nagios_cgi_t)
corecmd_exec_bin(nagios_cgi_t)
domain_dontaudit_read_all_domains_state(nagios_cgi_t)
files_read_etc_files(nagios_cgi_t)
files_read_etc_runtime_files(nagios_cgi_t)
files_read_kernel_symbol_table(nagios_cgi_t)
libs_use_ld_so(nagios_cgi_t)
libs_use_shared_libs(nagios_cgi_t)
logging_send_syslog_msg(nagios_cgi_t)
logging_search_logs(nagios_cgi_t)
miscfiles_read_localization(nagios_cgi_t)
optional_policy(`
apache_append_log(nagios_cgi_t)
')