mirror of
https://github.com/Icinga/icinga2.git
synced 2025-11-03 21:25:56 +01:00
454 lines
9.5 KiB
Plaintext
454 lines
9.5 KiB
Plaintext
|
|
## <summary>policy for icinga2</summary>
|
|
|
|
########################################
|
|
## <summary>
|
|
## Execute TEMPLATE in the icinga2 domin.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed to transition.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`icinga2_domtrans',`
|
|
gen_require(`
|
|
type icinga2_t, icinga2_exec_t;
|
|
')
|
|
|
|
corecmd_search_bin($1)
|
|
domtrans_pattern($1, icinga2_exec_t, icinga2_t)
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Execute icinga2 server in the icinga2 domain.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`icinga2_initrc_domtrans',`
|
|
gen_require(`
|
|
type icinga2_initrc_exec_t;
|
|
')
|
|
|
|
init_labeled_script_domtrans($1, icinga2_initrc_exec_t)
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Execute icinga2 daemon in the icinga2 domain.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed to transition.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`icinga2_systemctl',`
|
|
gen_require(`
|
|
type icinga2_t;
|
|
type icinga2_unit_file_t;
|
|
')
|
|
|
|
systemd_exec_systemctl($1)
|
|
allow $1 icinga2_unit_file_t:file read_file_perms;
|
|
allow $1 icinga2_unit_file_t:service manage_service_perms;
|
|
|
|
ps_process_pattern($1, icinga2_t)
|
|
init_dbus_chat($1)
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Allow the specified domain to read
|
|
## icinga2 configuration files.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
## <rolecap/>
|
|
#
|
|
interface(`icinga2_read_config',`
|
|
gen_require(`
|
|
type icinga2_etc_t;
|
|
')
|
|
|
|
files_search_etc($1)
|
|
list_dirs_pattern($1, icinga2_etc_t, icinga2_etc_t)
|
|
read_files_pattern($1, icinga2_etc_t, icinga2_etc_t)
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Allow the specified domain to read
|
|
## and write icinga2 configuration files.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
## <rolecap/>
|
|
#
|
|
interface(`icinga2_manage_config',`
|
|
gen_require(`
|
|
type icinga2_etc_t;
|
|
')
|
|
|
|
files_search_etc($1)
|
|
manage_dirs_pattern($1, icinga2_etc_t, icinga2_etc_t)
|
|
manage_files_pattern($1, icinga2_etc_t, icinga2_etc_t)
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Read icinga2's log files.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
## <rolecap/>
|
|
#
|
|
interface(`icinga2_read_log',`
|
|
gen_require(`
|
|
type icinga2_log_t;
|
|
')
|
|
|
|
logging_search_logs($1)
|
|
read_files_pattern($1, icinga2_log_t, icinga2_log_t)
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Append to icinga2 log files.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`icinga2_append_log',`
|
|
gen_require(`
|
|
type icinga2_log_t;
|
|
')
|
|
|
|
logging_search_logs($1)
|
|
append_files_pattern($1, icinga2_log_t, icinga2_log_t)
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Manage icinga2 log files
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`icinga2_manage_log',`
|
|
gen_require(`
|
|
type icinga2_log_t;
|
|
')
|
|
|
|
logging_search_logs($1)
|
|
manage_dirs_pattern($1, icinga2_log_t, icinga2_log_t)
|
|
manage_files_pattern($1, icinga2_log_t, icinga2_log_t)
|
|
manage_lnk_files_pattern($1, icinga2_log_t, icinga2_log_t)
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Search icinga2 lib directories.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`icinga2_search_lib',`
|
|
gen_require(`
|
|
type icinga2_var_lib_t;
|
|
')
|
|
|
|
allow $1 icinga2_var_lib_t:dir search_dir_perms;
|
|
files_search_var_lib($1)
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Read icinga2 lib files.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`icinga2_read_lib_files',`
|
|
gen_require(`
|
|
type icinga2_var_lib_t;
|
|
')
|
|
|
|
files_search_var_lib($1)
|
|
read_files_pattern($1, icinga2_var_lib_t, icinga2_var_lib_t)
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Manage icinga2 lib files.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`icinga2_manage_lib_files',`
|
|
gen_require(`
|
|
type icinga2_var_lib_t;
|
|
')
|
|
|
|
files_search_var_lib($1)
|
|
manage_files_pattern($1, icinga2_var_lib_t, icinga2_var_lib_t)
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Manage icinga2 lib directories.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`icinga2_manage_lib_dirs',`
|
|
gen_require(`
|
|
type icinga2_var_lib_t;
|
|
')
|
|
|
|
files_search_var_lib($1)
|
|
manage_dirs_pattern($1, icinga2_var_lib_t, icinga2_var_lib_t)
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Manage icinga2 spool files.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`icinga2_manage_spool_files',`
|
|
gen_require(`
|
|
type icinga2_spool_t;
|
|
')
|
|
|
|
files_search_var_lib($1)
|
|
manage_files_pattern($1, icinga2_spool_t, icinga2_spool_t)
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## All of the rules required to administrate
|
|
## an icinga2 environment
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
## <param name="role">
|
|
## <summary>
|
|
## Role allowed access.
|
|
## </summary>
|
|
## </param>
|
|
## <rolecap/>
|
|
#
|
|
interface(`icinga2_admin',`
|
|
gen_require(`
|
|
type icinga2_t;
|
|
type icinga2_initrc_exec_t;
|
|
type icinga2_log_t;
|
|
type icinga2_var_lib_t;
|
|
')
|
|
|
|
allow $1 icinga2_t:process { signal_perms };
|
|
ps_process_pattern($1, icinga2_t)
|
|
|
|
tunable_policy(`deny_ptrace',`',`
|
|
allow $1 icinga2_t:process ptrace;
|
|
')
|
|
|
|
icinga2_initrc_domtrans($1)
|
|
domain_system_change_exemption($1)
|
|
role_transition $2 icinga2_initrc_exec_t system_r;
|
|
allow $2 system_r;
|
|
|
|
files_list_etc($1)
|
|
admin_pattern($1, icinga2_etc_t)
|
|
|
|
logging_search_logs($1)
|
|
admin_pattern($1, icinga2_log_t)
|
|
|
|
files_search_var_lib($1)
|
|
admin_pattern($1, icinga2_var_lib_t)
|
|
|
|
admin_pattern($1, icinga2_var_run_t)
|
|
admin_pattern($1, icinga2_command_t)
|
|
admin_pattern($1, icinga2_spool_t)
|
|
admin_pattern($1, icinga2_cache_t)
|
|
|
|
icinga2_systemctl($1)
|
|
admin_pattern($1, icinga2_unit_file_t)
|
|
allow $1 icinga2_unit_file_t:service all_service_perms;
|
|
|
|
optional_policy(`
|
|
systemd_passwd_agent_exec($1)
|
|
systemd_read_fifo_file_passwd_run($1)
|
|
')
|
|
')
|
|
|
|
########################################
|
|
### <summary>
|
|
### Send icinga2 commands through pipe
|
|
### </summary>
|
|
### <param name="domain">
|
|
### <summary>
|
|
### Domain allowed to send commands.
|
|
### </summary>
|
|
### </param>
|
|
#
|
|
interface(`icinga2_send_commands',`
|
|
gen_require(`
|
|
type icinga2_var_run_t;
|
|
')
|
|
|
|
files_search_pids($1)
|
|
read_files_pattern($1, icinga2_var_run_t, icinga2_var_run_t)
|
|
read_files_pattern($1, icinga2_command_t, icinga2_command_t)
|
|
write_fifo_files_pattern($1, icinga2_command_t, icinga2_command_t)
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## For domains icinga2 should transition to (e.g. Plugins).
|
|
## </summary>
|
|
## <param name="executable">
|
|
## <summary>
|
|
## Context of the executable.
|
|
## </summary>
|
|
## </param>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain icinga should transition to.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`icinga2_execstrans',`
|
|
gen_require(`
|
|
type icinga2_t;
|
|
')
|
|
|
|
domtrans_pattern(icinga2_t, $1, $2)
|
|
allow icinga2_t $2:process sigkill;
|
|
')
|
|
|
|
######################################
|
|
## <summary>
|
|
## Dontaudit read and write an leaked file descriptors
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain to not audit.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`icinga2_dontaudit_leaks_fifo',`
|
|
gen_require(`
|
|
type icinga2_t;
|
|
')
|
|
|
|
dontaudit $1 icinga2_t:fifo_file write;
|
|
')
|
|
|
|
## <summary>Icinga2 administrator role.</summary>
|
|
|
|
########################################
|
|
## <summary>
|
|
## Change to the Icinga2 administrator role.
|
|
## </summary>
|
|
## <param name="role">
|
|
## <summary>
|
|
## Role allowed access.
|
|
## </summary>
|
|
## </param>
|
|
## <rolecap/>
|
|
#
|
|
interface(`icinga2adm_role_change',`
|
|
gen_require(`
|
|
role icinga2adm_r;
|
|
')
|
|
|
|
allow $1 icinga2adm_r;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## For domains icinga2adm should transition to (e.g. Plugins).
|
|
## </summary>
|
|
## <param name="executable">
|
|
## <summary>
|
|
## Context of the executable.
|
|
## </summary>
|
|
## </param>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain icinga should transition to.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`icinga2adm_execstrans',`
|
|
gen_require(`
|
|
type icinga2adm_t;
|
|
')
|
|
|
|
role icinga2adm_r types $2;
|
|
allow icinga2adm_r system_r;
|
|
type_transition icinga2adm_t $1:process $2;
|
|
allow icinga2adm_t $2:process transition;
|
|
allow $2 icinga2adm_t:process sigchld;
|
|
role_transition icinga2adm_r $1 system_r;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Make a TCP connection to the icinga2 port.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`corenet_tcp_connect_icinga2_port',`
|
|
gen_require(`
|
|
type icinga2_port_t;
|
|
')
|
|
|
|
allow $1 icinga2_port_t:tcp_socket name_connect;
|
|
')
|