selinux-policy/strict/domains/program/unused/nrpe.te
2005-04-29 17:45:15 +00:00

41 lines
1.1 KiB
Plaintext

# DESC nrpe - Nagios Remote Plugin Execution
#
# Author: Thomas Bleher <ThomasBleher@gmx.de>
#
# Depends: tcpd.te
# X-Debian-Packages: nagios-nrpe-server
#
# This policy assumes that nrpe is called from inetd
daemon_base_domain(nrpe)
ifdef(`tcpd.te', `
domain_auto_trans(tcpd_t, nrpe_exec_t, nrpe_t)
')
domain_auto_trans(inetd_t, nrpe_exec_t, nrpe_t)
allow nrpe_t urandom_device_t:chr_file { getattr ioctl read };
allow nrpe_t self:fifo_file rw_file_perms;
allow nrpe_t self:unix_dgram_socket create_socket_perms;
# use sockets inherited from inetd
allow nrpe_t inetd_t:tcp_socket { ioctl read write };
allow nrpe_t devtty_t:chr_file { read write };
allow nrpe_t self:process setpgid;
etc_domain(nrpe)
read_locale(nrpe_t)
# permissions for the scripts executed by nrpe
#
# call shell programs
can_exec(nrpe_t, { bin_t shell_exec_t ls_exec_t })
allow nrpe_t { bin_t sbin_t }:dir search;
# for /bin/sh
allow nrpe_t bin_t:lnk_file read;
# read /proc/meminfo, /proc/self/mounts and /etc/mtab
allow nrpe_t { self proc_t etc_runtime_t }:file { getattr read };
# you will have to add more permissions here, depending on the scripts you call!