tyler.durden
/
icinga2
mirror of https://github.com/Icinga/icinga2.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

added chcon to systemd safe-reload script 

Selinux: Added support for notifications

refs #8332
This commit is contained in:
Dirk Goetz 2015-03-17 21:23:02 +00:00 committed by Michael Friedrich
parent 5d93b968fe
commit 167f43a231
5 changed files with 59 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
etc/initsystem/safe-reload
View File

@ -11,6 +11,10 @@ fi
printf "Validating config files: "
OUTPUTFILE=`mktemp`
if [ $(which chcon) ]; then
chcon -t icinga2_tmp_t $OUTPUTFILE
fi
if ! $DAEMON daemon --validate --color > $OUTPUTFILE; then
echo "Failed"

2
tools/selinux/icinga2.fc
View File

@ -1,5 +1,7 @@
/etc/rc\.d/init\.d/icinga2 -- gen_context(system_u:object_r:icinga2_initrc_exec_t,s0)
/etc/icinga2/scripts(/.*)? gen_context(system_u:object_r:nagios_notification_plugin_exec_t,s0)
/usr/sbin/icinga2 -- gen_context(system_u:object_r:icinga2_exec_t,s0)
/var/lib/icinga2(/.*)? gen_context(system_u:object_r:icinga2_var_lib_t,s0)

19
tools/selinux/icinga2.if
View File

@ -265,3 +265,22 @@ interface(`icinga2_execstrans',`
domtrans_pattern(icinga2_t, $1, $2)
')
######################################
## <summary>
## Dontaudit read and write an leaked file descriptors
## </summary>
## <param name="domain">
## <summary>
## Domain to not audit.
## </summary>
## </param>
#
interface(`icinga2_dontaudit_leaks_fifo',`
gen_require(`
type icinga2_t;
')
dontaudit $1 icinga2_t:fifo_file write;
')

7
tools/selinux/icinga2.sh
View File

@ -48,6 +48,8 @@ sepolicy manpage -p . -d icinga2_t
/sbin/restorecon -F -R -v /usr/sbin/icinga2
# Fixing the file context on /etc/rc\.d/init\.d/icinga2
#/sbin/restorecon -F -R -v /etc/rc\.d/init\.d/icinga2
# Fixing the file context on /etc/icinga2/scripts
/sbin/restorecon -F -R -v /etc/icinga2/scripts
# Fixing the file context on /var/log/icinga2
/sbin/restorecon -F -R -v /var/log/icinga2
# Fixing the file context on /var/lib/icinga2
@ -59,10 +61,13 @@ sepolicy manpage -p . -d icinga2_t
# Fixing the file context on /var/spool/icinga2
/sbin/restorecon -F -R -v /var/spool/icinga2
# Fix dir permissions until we have it in the package
chown root /etc/icinga2
chown root /etc/icinga2/init.conf
# Label the port 5665
/sbin/semanage port -a -t icinga2_port_t -p tcp 5665
# Generate a rpm package for the newly generated policy
pwd=$(pwd)
#rpmbuild --define "_sourcedir ${pwd}" --define "_specdir ${pwd}" --define "_builddir ${pwd}" --define "_srcrpmdir ${pwd}" --define "_rpmdir ${pwd}" --define "_buildrootdir ${pwd}/.build" -ba icinga2_selinux.spec

29
tools/selinux/icinga2.te
View File

@ -11,7 +11,7 @@ require {
type nagios_mail_plugin_t; type nagios_mail_plugin_exec_t;
type nagios_services_plugin_t; type nagios_services_plugin_exec_t;
type nagios_system_plugin_t; type nagios_system_plugin_exec_t;
type httpd_t;
type httpd_t; type system_mail_t;
}
type icinga2_t;
@ -41,6 +41,9 @@ files_type(icinga2_spool_t)
type icinga2_cache_t;
files_type(icinga2_cache_t)
type icinga2_tmp_t;
files_tmp_file(icinga2_tmp_t)
type icinga2_port_t;
corenet_port(icinga2_port_t)
@ -78,6 +81,10 @@ files_spool_filetrans(icinga2_t, icinga2_spool_t, { dir file })
manage_dirs_pattern(icinga2_t, icinga2_cache_t, icinga2_cache_t)
manage_files_pattern(icinga2_t, icinga2_cache_t, icinga2_cache_t)
manage_files_pattern(icinga2_t, icinga2_tmp_t, icinga2_tmp_t)
manage_dirs_pattern(icinga2_t, icinga2_tmp_t, icinga2_tmp_t)
files_tmp_filetrans(icinga2_t, icinga2_tmp_t, { dir file })
domain_use_interactive_fds(icinga2_t)
files_read_etc_files(icinga2_t)
@ -86,6 +93,8 @@ auth_use_nsswitch(icinga2_t)
miscfiles_read_localization(icinga2_t)
corecmd_check_exec_shell(icinga2_t)
# should be moved to nagios_plugin_template in nagios.if
icinga2_execstrans(nagios_admin_plugin_exec_t, nagios_admin_plugin_t)
icinga2_execstrans(nagios_checkdisk_plugin_exec_t, nagios_checkdisk_plugin_t)
@ -93,6 +102,24 @@ icinga2_execstrans(nagios_mail_plugin_exec_t, nagios_mail_plugin_t)
icinga2_execstrans(nagios_services_plugin_exec_t, nagios_services_plugin_t)
icinga2_execstrans(nagios_system_plugin_exec_t, nagios_system_plugin_t)
# should be moved nagios.te
nagios_plugin_template(notification)
icinga2_execstrans(nagios_notification_plugin_exec_t, nagios_notification_plugin_t)
allow nagios_notification_plugin_t nagios_notification_plugin_exec_t:dir search;
#permissive nagios_notification_plugin_t;
corecmd_exec_bin(nagios_notification_plugin_t)
type nagios_notification_plugin_tmp_t;
files_tmp_file(nagios_notification_plugin_tmp_t)
manage_files_pattern(nagios_notification_plugin_t, nagios_notification_plugin_tmp_t, nagios_notification_plugin_tmp_t)
manage_dirs_pattern(nagios_notification_plugin_t, nagios_notification_plugin_tmp_t, nagios_notification_plugin_tmp_t)
files_tmp_filetrans(nagios_notification_plugin_t, nagios_notification_plugin_tmp_t, { dir file })
auth_dontaudit_read_passwd(nagios_notification_plugin_t)
fs_dontaudit_getattr_xattr_fs(nagios_notification_plugin_t)
optional_policy(`
mta_send_mail(nagios_notification_plugin_t)
')
icinga2_dontaudit_leaks_fifo(system_mail_t)
allow icinga2_t icinga2_port_t:tcp_socket name_bind;
allow icinga2_t self:tcp_socket create_stream_socket_perms;