Add selinux policy (first draft)

refs #8332

tools/selinux/icinga2.fc

@@ -0,0 +1,11 @@
+/etc/rc\.d/init\.d/icinga2	--	gen_context(system_u:object_r:icinga2_initrc_exec_t,s0)
+
+/usr/sbin/icinga2		--	gen_context(system_u:object_r:icinga2_exec_t,s0)
+
+/var/lib/icinga2(/.*)?		gen_context(system_u:object_r:icinga2_var_lib_t,s0)
+
+/var/log/icinga2(/.*)?		gen_context(system_u:object_r:icinga2_log_t,s0)
+
+/var/run/icinga2(/.*)?		gen_context(system_u:object_r:icinga2_var_run_t,s0)
+
+/var/run/icinga2/cmd(/.*)?	gen_context(system_u:object_r:icinga2_command_t,s0)

tools/selinux/icinga2.if

@@ -0,0 +1,245 @@
+
+## <summary>policy for icinga2</summary>
+
+########################################
+## <summary>
+##	Execute TEMPLATE in the icinga2 domin.
+## </summary>
+## <param name="domain">
+## <summary>
+##	Domain allowed to transition.
+## </summary>
+## </param>
+#
+interface(`icinga2_domtrans',`
+	gen_require(`
+		type icinga2_t, icinga2_exec_t;
+	')
+
+	corecmd_search_bin($1)
+	domtrans_pattern($1, icinga2_exec_t, icinga2_t)
+')
+
+########################################
+## <summary>
+##	Execute icinga2 server in the icinga2 domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`icinga2_initrc_domtrans',`
+	gen_require(`
+		type icinga2_initrc_exec_t;
+	')
+
+	init_labeled_script_domtrans($1, icinga2_initrc_exec_t)
+')
+########################################
+## <summary>
+##	Read icinga2's log files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`icinga2_read_log',`
+	gen_require(`
+		type icinga2_log_t;
+	')
+
+	logging_search_logs($1)
+	read_files_pattern($1, icinga2_log_t, icinga2_log_t)
+')
+
+########################################
+## <summary>
+##	Append to icinga2 log files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`icinga2_append_log',`
+	gen_require(`
+		type icinga2_log_t;
+	')
+
+	logging_search_logs($1)
+	append_files_pattern($1, icinga2_log_t, icinga2_log_t)
+')
+
+########################################
+## <summary>
+##	Manage icinga2 log files
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`icinga2_manage_log',`
+	gen_require(`
+		type icinga2_log_t;
+	')
+
+	logging_search_logs($1)
+	manage_dirs_pattern($1, icinga2_log_t, icinga2_log_t)
+	manage_files_pattern($1, icinga2_log_t, icinga2_log_t)
+	manage_lnk_files_pattern($1, icinga2_log_t, icinga2_log_t)
+')
+
+########################################
+## <summary>
+##	Search icinga2 lib directories.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`icinga2_search_lib',`
+	gen_require(`
+		type icinga2_var_lib_t;
+	')
+
+	allow $1 icinga2_var_lib_t:dir search_dir_perms;
+	files_search_var_lib($1)
+')
+
+########################################
+## <summary>
+##	Read icinga2 lib files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`icinga2_read_lib_files',`
+	gen_require(`
+		type icinga2_var_lib_t;
+	')
+
+	files_search_var_lib($1)
+	read_files_pattern($1, icinga2_var_lib_t, icinga2_var_lib_t)
+')
+
+########################################
+## <summary>
+##	Manage icinga2 lib files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`icinga2_manage_lib_files',`
+	gen_require(`
+		type icinga2_var_lib_t;
+	')
+
+	files_search_var_lib($1)
+	manage_files_pattern($1, icinga2_var_lib_t, icinga2_var_lib_t)
+')
+
+########################################
+## <summary>
+##	Manage icinga2 lib directories.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`icinga2_manage_lib_dirs',`
+	gen_require(`
+		type icinga2_var_lib_t;
+	')
+
+	files_search_var_lib($1)
+	manage_dirs_pattern($1, icinga2_var_lib_t, icinga2_var_lib_t)
+')
+
+
+########################################
+## <summary>
+##	All of the rules required to administrate
+##	an icinga2 environment
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="role">
+##	<summary>
+##	Role allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`icinga2_admin',`
+	gen_require(`
+		type icinga2_t;
+		type icinga2_initrc_exec_t;
+		type icinga2_log_t;
+		type icinga2_var_lib_t;
+	')
+
+	allow $1 icinga2_t:process { signal_perms };
+	ps_process_pattern($1, icinga2_t)
+
+    tunable_policy(`deny_ptrace',`',`
+        allow $1 icinga2_t:process ptrace;
+    ')
+
+	icinga2_initrc_domtrans($1)
+	domain_system_change_exemption($1)
+	role_transition $2 icinga2_initrc_exec_t system_r;
+	allow $2 system_r;
+
+	logging_search_logs($1)
+	admin_pattern($1, icinga2_log_t)
+
+	files_search_var_lib($1)
+	admin_pattern($1, icinga2_var_lib_t)
+	optional_policy(`
+		systemd_passwd_agent_exec($1)
+		systemd_read_fifo_file_passwd_run($1)
+	')
+')
+
+########################################
+### <summary>
+###      Send icinga2 commands through pipe
+### </summary>
+### <param name="domain">
+###      <summary>
+###      Domain allowed to send commands.
+###      </summary>
+### </param>
+#
+interface(`icinga2_send_commands',`
+	gen_require(`
+		type icinga2_var_run_t;
+	')
+
+	files_search_pids($1)
+	read_files_pattern($1, icinga2_var_run_t, icinga2_var_run_t)
+	read_files_pattern($1, icina2_command_t, icinga2_command_t)
+	write_fifo_files_pattern($1, icinga2_command_t, icinga2_command_t)
+')
+

tools/selinux/icinga2.sh

@@ -0,0 +1,58 @@
+#!/bin/sh -e
+
+DIRNAME=`dirname $0`
+cd $DIRNAME
+USAGE="$0 [ --update ]"
+if [ `id -u` != 0 ]; then
+echo 'You must be root to run this script'
+exit 1
+fi
+
+if [ $# -eq 1 ]; then
+	if [ "$1" = "--update" ] ; then
+		time=`ls -l --time-style="+%x %X" icinga2.te | awk '{ printf "%s %s", $6, $7 }'`
+		rules=`ausearch --start $time -m avc --raw -se icinga2`
+		if [ x"$rules" != "x" ] ; then
+			echo "Found avc's to update policy with"
+			echo -e "$rules" | audit2allow -R
+			echo "Do you want these changes added to policy [y/n]?"
+			read ANS
+			if [ "$ANS" = "y" -o "$ANS" = "Y" ] ; then
+				echo "Updating policy"
+				echo -e "$rules" | audit2allow -R >> icinga2.te
+				# Fall though and rebuild policy
+			else
+				exit 0
+			fi
+		else
+			echo "No new avcs found"
+			exit 0
+		fi
+	else
+		echo -e $USAGE
+		exit 1
+	fi
+elif [ $# -ge 2 ] ; then
+	echo -e $USAGE
+	exit 1
+fi
+
+echo "Building and Loading Policy"
+set -x
+make -f /usr/share/selinux/devel/Makefile icinga2.pp || exit
+/usr/sbin/semodule -i icinga2.pp
+
+# Generate a man page off the installed module
+sepolicy manpage -p . -d icinga2_t
+# Fixing the file context on /usr/sbin/icinga2
+/sbin/restorecon -F -R -v /usr/sbin/icinga2
+# Fixing the file context on /etc/rc\.d/init\.d/icinga2
+/sbin/restorecon -F -R -v /etc/rc\.d/init\.d/icinga2
+# Fixing the file context on /var/log/icinga2
+/sbin/restorecon -F -R -v /var/log/icinga2
+# Fixing the file context on /var/lib/icinga2
+/sbin/restorecon -F -R -v /var/lib/icinga2
+# Generate a rpm package for the newly generated policy
+
+pwd=$(pwd)
+rpmbuild --define "_sourcedir ${pwd}" --define "_specdir ${pwd}" --define "_builddir ${pwd}" --define "_srcrpmdir ${pwd}" --define "_rpmdir ${pwd}" --define "_buildrootdir ${pwd}/.build"  -ba icinga2_selinux.spec

tools/selinux/icinga2.te

@@ -0,0 +1,62 @@
+policy_module(icinga2, 0.1.0)
+
+########################################
+#
+# Declarations
+#
+
+type icinga2_t;
+type icinga2_exec_t;
+init_daemon_domain(icinga2_t, icinga2_exec_t)
+
+permissive icinga2_t;
+
+type icinga2_initrc_exec_t;
+init_script_file(icinga2_initrc_exec_t)
+
+type icinga2_log_t;
+logging_log_file(icinga2_log_t)
+
+type icinga2_var_lib_t;
+files_type(icinga2_var_lib_t)
+
+type icinga2_command_t;
+files_type(icinga2_command_t)
+
+type icinga2_var_run_t;
+files_pid_file(icinga2_var_run_t)
+
+########################################
+#
+# icinga2 local policy
+#
+allow icinga2_t self:capability { setgid setuid };
+allow icinga2_t self:fifo_file rw_fifo_file_perms;
+allow icinga2_t self:unix_stream_socket create_stream_socket_perms;
+
+manage_dirs_pattern(icinga2_t, icinga2_log_t, icinga2_log_t)
+manage_files_pattern(icinga2_t, icinga2_log_t, icinga2_log_t)
+manage_lnk_files_pattern(icinga2_t, icinga2_log_t, icinga2_log_t)
+logging_log_filetrans(icinga2_t, icinga2_log_t, { dir file lnk_file })
+
+manage_dirs_pattern(icinga2_t, icinga2_var_lib_t, icinga2_var_lib_t)
+manage_files_pattern(icinga2_t, icinga2_var_lib_t, icinga2_var_lib_t)
+manage_lnk_files_pattern(icinga2_t, icinga2_var_lib_t, icinga2_var_lib_t)
+files_var_lib_filetrans(icinga2_t, icinga2_var_lib_t, { dir file lnk_file })
+
+manage_dirs_pattern(icinga2_t, icinga2_var_run_t, icinga2_var_run_t)
+manage_files_pattern(icinga2_t, icinga2_var_run_t, icinga2_var_run_t)
+files_pid_filetrans(icinga2_t, icinga2_var_run_t, { dir file })
+
+manage_dirs_pattern(icinga2_t, icinga2_command_t, icinga2_command_t)
+manage_files_pattern(icinga2_t, icinga2_command_t, icinga2_command_t)
+manage_fifo_files_pattern(icinga2_t, icinga2_command_t, icinga2_command_t)
+
+
+domain_use_interactive_fds(icinga2_t)
+
+files_read_etc_files(icinga2_t)
+
+auth_use_nsswitch(icinga2_t)
+
+miscfiles_read_localization(icinga2_t)