tyler.durden
/
icinga2
mirror of https://github.com/Icinga/icinga2.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Selinux: Added file contexts and port 

refs #8332

Signed-off-by: Michael Friedrich <michael.friedrich@netways.de>
This commit is contained in:
Dirk Goetz 2015-02-11 22:56:12 +01:00 committed by Michael Friedrich
parent 22d179e97f
commit 1911209a45
4 changed files with 86 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
tools/selinux/icinga2.fc
View File

@ -9,3 +9,7 @@
/var/run/icinga2(/.*)? gen_context(system_u:object_r:icinga2_var_run_t,s0)
/var/run/icinga2/cmd(/.*)? gen_context(system_u:object_r:icinga2_command_t,s0)
/var/spool/icinga2(/.*)? gen_context(system_u:object_r:icinga2_spool_t,s0)
/var/cache/icinga2(/.*)? gen_context(system_u:object_r:icinga2_cache_t,s0)

24
tools/selinux/icinga2.if
View File

@ -239,7 +239,29 @@ interface(`icinga2_send_commands',`
files_search_pids($1)
read_files_pattern($1, icinga2_var_run_t, icinga2_var_run_t)
read_files_pattern($1, icina2_command_t, icinga2_command_t)
read_files_pattern($1, icinga2_command_t, icinga2_command_t)
write_fifo_files_pattern($1, icinga2_command_t, icinga2_command_t)
')
########################################
## <summary>
## For domains icinga should transition to (e.g. Plugins).
## </summary>
## <param name="executable">
## <summary>
## Context of the executable.
## </summary>
## </param>
## <param name="domain">
## <summary>
## Domain icinga should transition to.
## </summary>
## </param>
#
interface(`icinga2_execstrans',`
gen_require(`
type icinga2_t;
')
domtrans_pattern(icinga2_t, $1, $2)
')

14
tools/selinux/icinga2.sh
View File

@ -47,12 +47,22 @@ sepolicy manpage -p . -d icinga2_t
# Fixing the file context on /usr/sbin/icinga2
/sbin/restorecon -F -R -v /usr/sbin/icinga2
# Fixing the file context on /etc/rc\.d/init\.d/icinga2
/sbin/restorecon -F -R -v /etc/rc\.d/init\.d/icinga2
#/sbin/restorecon -F -R -v /etc/rc\.d/init\.d/icinga2
# Fixing the file context on /var/log/icinga2
/sbin/restorecon -F -R -v /var/log/icinga2
# Fixing the file context on /var/lib/icinga2
/sbin/restorecon -F -R -v /var/lib/icinga2
# Fixing the file context on /var/run/icinga2
/sbin/restorecon -F -R -v /var/run/icinga2
# Fixing the file context on /var/cache/icinga2
/sbin/restorecon -F -R -v /var/cache/icinga2
# Fixing the file context on /var/spool/icinga2
/sbin/restorecon -F -R -v /var/spool/icinga2
# Label the port 5665
/sbin/semanage port -a -t icinga2_port_t -p tcp 5665
# Generate a rpm package for the newly generated policy
pwd=$(pwd)
rpmbuild --define "_sourcedir ${pwd}" --define "_specdir ${pwd}" --define "_builddir ${pwd}" --define "_srcrpmdir ${pwd}" --define "_rpmdir ${pwd}" --define "_buildrootdir ${pwd}/.build" -ba icinga2_selinux.spec
#rpmbuild --define "_sourcedir ${pwd}" --define "_specdir ${pwd}" --define "_builddir ${pwd}" --define "_srcrpmdir ${pwd}" --define "_rpmdir ${pwd}" --define "_buildrootdir ${pwd}/.build" -ba icinga2_selinux.spec

50
tools/selinux/icinga2.te
View File

@ -1,10 +1,19 @@
policy_module(icinga2, 0.1.0)
policy_module(icinga2, 0.1.1)
########################################
#
# Declarations
#
require {
type nagios_admin_plugin_t; type nagios_admin_plugin_exec_t;
type nagios_checkdisk_plugin_t; type nagios_checkdisk_plugin_exec_t;
type nagios_mail_plugin_t; type nagios_mail_plugin_exec_t;
type nagios_services_plugin_t; type nagios_services_plugin_exec_t;
type nagios_system_plugin_t; type nagios_system_plugin_exec_t;
type httpd_t;
}
type icinga2_t;
type icinga2_exec_t;
init_daemon_domain(icinga2_t, icinga2_exec_t)
@ -20,11 +29,20 @@ logging_log_file(icinga2_log_t)
type icinga2_var_lib_t;
files_type(icinga2_var_lib_t)
type icinga2_var_run_t;
files_pid_file(icinga2_var_run_t)
type icinga2_command_t;
files_type(icinga2_command_t)
type icinga2_var_run_t;
files_pid_file(icinga2_var_run_t)
type icinga2_spool_t;
files_type(icinga2_spool_t)
type icinga2_cache_t;
files_type(icinga2_cache_t)
type icinga2_port_t;
corenet_port(icinga2_port_t)
########################################
#
@ -52,6 +70,12 @@ manage_dirs_pattern(icinga2_t, icinga2_command_t, icinga2_command_t)
manage_files_pattern(icinga2_t, icinga2_command_t, icinga2_command_t)
manage_fifo_files_pattern(icinga2_t, icinga2_command_t, icinga2_command_t)
manage_dirs_pattern(icinga2_t, icinga2_spool_t, icinga2_spool_t)
manage_files_pattern(icinga2_t, icinga2_spool_t, icinga2_spool_t)
files_spool_filetrans(icinga2_t, icinga2_spool_t, { dir file })
manage_dirs_pattern(icinga2_t, icinga2_cache_t, icinga2_cache_t)
manage_files_pattern(icinga2_t, icinga2_cache_t, icinga2_cache_t)
domain_use_interactive_fds(icinga2_t)
@ -60,3 +84,23 @@ files_read_etc_files(icinga2_t)
auth_use_nsswitch(icinga2_t)
miscfiles_read_localization(icinga2_t)
# should be moved to nagios_plugin_template in nagios.if
icinga2_execstrans(nagios_admin_plugin_exec_t, nagios_admin_plugin_t)
icinga2_execstrans(nagios_checkdisk_plugin_exec_t, nagios_checkdisk_plugin_t)
icinga2_execstrans(nagios_mail_plugin_exec_t, nagios_mail_plugin_t)
icinga2_execstrans(nagios_services_plugin_exec_t, nagios_services_plugin_t)
icinga2_execstrans(nagios_system_plugin_exec_t, nagios_system_plugin_t)
allow icinga2_t icinga2_port_t:tcp_socket name_bind;
allow icinga2_t self:tcp_socket create_stream_socket_perms;
########################################
#
# Icinga Webinterfaces
#
optional_policy(`
# should be a boolean in apache-policy
icinga2_send_commands(httpd_t)
')