summaryrefslogtreecommitdiffstats
path: root/tools/selinux
diff options
context:
space:
mode:
Diffstat (limited to 'tools/selinux')
-rw-r--r--tools/selinux/icinga2.fc23
-rw-r--r--tools/selinux/icinga2.if453
-rwxr-xr-xtools/selinux/icinga2.sh74
-rw-r--r--tools/selinux/icinga2.te288
4 files changed, 838 insertions, 0 deletions
diff --git a/tools/selinux/icinga2.fc b/tools/selinux/icinga2.fc
new file mode 100644
index 0000000..325728d
--- /dev/null
+++ b/tools/selinux/icinga2.fc
@@ -0,0 +1,23 @@
+/etc/rc\.d/init\.d/icinga2 -- gen_context(system_u:object_r:icinga2_initrc_exec_t,s0)
+
+/usr/lib/systemd/system/icinga2.* -- gen_context(system_u:object_r:icinga2_unit_file_t,s0)
+
+/etc/icinga2(/.*)? gen_context(system_u:object_r:icinga2_etc_t,s0)
+
+/etc/icinga2/scripts(/.*)? -- gen_context(system_u:object_r:nagios_notification_plugin_exec_t,s0)
+
+/usr/sbin/icinga2 -- gen_context(system_u:object_r:icinga2_exec_t,s0)
+/usr/lib/icinga2/sbin/icinga2 -- gen_context(system_u:object_r:icinga2_exec_t,s0)
+/usr/lib/icinga2/safe-reload -- gen_context(system_u:object_r:icinga2_exec_t,s0)
+
+/var/lib/icinga2(/.*)? gen_context(system_u:object_r:icinga2_var_lib_t,s0)
+
+/var/log/icinga2(/.*)? gen_context(system_u:object_r:icinga2_log_t,s0)
+
+/var/run/icinga2(/.*)? gen_context(system_u:object_r:icinga2_var_run_t,s0)
+
+/var/run/icinga2/cmd(/.*)? gen_context(system_u:object_r:icinga2_command_t,s0)
+
+/var/spool/icinga2(/.*)? gen_context(system_u:object_r:icinga2_spool_t,s0)
+
+/var/cache/icinga2(/.*)? gen_context(system_u:object_r:icinga2_cache_t,s0)
diff --git a/tools/selinux/icinga2.if b/tools/selinux/icinga2.if
new file mode 100644
index 0000000..15fb034
--- /dev/null
+++ b/tools/selinux/icinga2.if
@@ -0,0 +1,453 @@
+
+## <summary>policy for icinga2</summary>
+
+########################################
+## <summary>
+## Execute TEMPLATE in the icinga2 domin.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed to transition.
+## </summary>
+## </param>
+#
+interface(`icinga2_domtrans',`
+ gen_require(`
+ type icinga2_t, icinga2_exec_t;
+ ')
+
+ corecmd_search_bin($1)
+ domtrans_pattern($1, icinga2_exec_t, icinga2_t)
+')
+
+########################################
+## <summary>
+## Execute icinga2 server in the icinga2 domain.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`icinga2_initrc_domtrans',`
+ gen_require(`
+ type icinga2_initrc_exec_t;
+ ')
+
+ init_labeled_script_domtrans($1, icinga2_initrc_exec_t)
+')
+
+########################################
+## <summary>
+## Execute icinga2 daemon in the icinga2 domain.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed to transition.
+## </summary>
+## </param>
+#
+interface(`icinga2_systemctl',`
+ gen_require(`
+ type icinga2_t;
+ type icinga2_unit_file_t;
+ ')
+
+ systemd_exec_systemctl($1)
+ allow $1 icinga2_unit_file_t:file read_file_perms;
+ allow $1 icinga2_unit_file_t:service manage_service_perms;
+
+ ps_process_pattern($1, icinga2_t)
+ init_dbus_chat($1)
+')
+
+########################################
+## <summary>
+## Allow the specified domain to read
+## icinga2 configuration files.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+## <rolecap/>
+#
+interface(`icinga2_read_config',`
+ gen_require(`
+ type icinga2_etc_t;
+ ')
+
+ files_search_etc($1)
+ list_dirs_pattern($1, icinga2_etc_t, icinga2_etc_t)
+ read_files_pattern($1, icinga2_etc_t, icinga2_etc_t)
+')
+
+########################################
+## <summary>
+## Allow the specified domain to read
+## and write icinga2 configuration files.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+## <rolecap/>
+#
+interface(`icinga2_manage_config',`
+ gen_require(`
+ type icinga2_etc_t;
+ ')
+
+ files_search_etc($1)
+ manage_dirs_pattern($1, icinga2_etc_t, icinga2_etc_t)
+ manage_files_pattern($1, icinga2_etc_t, icinga2_etc_t)
+')
+
+########################################
+## <summary>
+## Read icinga2's log files.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+## <rolecap/>
+#
+interface(`icinga2_read_log',`
+ gen_require(`
+ type icinga2_log_t;
+ ')
+
+ logging_search_logs($1)
+ read_files_pattern($1, icinga2_log_t, icinga2_log_t)
+')
+
+########################################
+## <summary>
+## Append to icinga2 log files.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`icinga2_append_log',`
+ gen_require(`
+ type icinga2_log_t;
+ ')
+
+ logging_search_logs($1)
+ append_files_pattern($1, icinga2_log_t, icinga2_log_t)
+')
+
+########################################
+## <summary>
+## Manage icinga2 log files
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`icinga2_manage_log',`
+ gen_require(`
+ type icinga2_log_t;
+ ')
+
+ logging_search_logs($1)
+ manage_dirs_pattern($1, icinga2_log_t, icinga2_log_t)
+ manage_files_pattern($1, icinga2_log_t, icinga2_log_t)
+ manage_lnk_files_pattern($1, icinga2_log_t, icinga2_log_t)
+')
+
+########################################
+## <summary>
+## Search icinga2 lib directories.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`icinga2_search_lib',`
+ gen_require(`
+ type icinga2_var_lib_t;
+ ')
+
+ allow $1 icinga2_var_lib_t:dir search_dir_perms;
+ files_search_var_lib($1)
+')
+
+########################################
+## <summary>
+## Read icinga2 lib files.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`icinga2_read_lib_files',`
+ gen_require(`
+ type icinga2_var_lib_t;
+ ')
+
+ files_search_var_lib($1)
+ read_files_pattern($1, icinga2_var_lib_t, icinga2_var_lib_t)
+')
+
+########################################
+## <summary>
+## Manage icinga2 lib files.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`icinga2_manage_lib_files',`
+ gen_require(`
+ type icinga2_var_lib_t;
+ ')
+
+ files_search_var_lib($1)
+ manage_files_pattern($1, icinga2_var_lib_t, icinga2_var_lib_t)
+')
+
+########################################
+## <summary>
+## Manage icinga2 lib directories.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`icinga2_manage_lib_dirs',`
+ gen_require(`
+ type icinga2_var_lib_t;
+ ')
+
+ files_search_var_lib($1)
+ manage_dirs_pattern($1, icinga2_var_lib_t, icinga2_var_lib_t)
+')
+
+########################################
+## <summary>
+## Manage icinga2 spool files.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`icinga2_manage_spool_files',`
+ gen_require(`
+ type icinga2_spool_t;
+ ')
+
+ files_search_var_lib($1)
+ manage_files_pattern($1, icinga2_spool_t, icinga2_spool_t)
+')
+
+########################################
+## <summary>
+## All of the rules required to administrate
+## an icinga2 environment
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+## <param name="role">
+## <summary>
+## Role allowed access.
+## </summary>
+## </param>
+## <rolecap/>
+#
+interface(`icinga2_admin',`
+ gen_require(`
+ type icinga2_t;
+ type icinga2_initrc_exec_t;
+ type icinga2_log_t;
+ type icinga2_var_lib_t;
+ ')
+
+ allow $1 icinga2_t:process { signal_perms };
+ ps_process_pattern($1, icinga2_t)
+
+ tunable_policy(`deny_ptrace',`',`
+ allow $1 icinga2_t:process ptrace;
+ ')
+
+ icinga2_initrc_domtrans($1)
+ domain_system_change_exemption($1)
+ role_transition $2 icinga2_initrc_exec_t system_r;
+ allow $2 system_r;
+
+ files_list_etc($1)
+ admin_pattern($1, icinga2_etc_t)
+
+ logging_search_logs($1)
+ admin_pattern($1, icinga2_log_t)
+
+ files_search_var_lib($1)
+ admin_pattern($1, icinga2_var_lib_t)
+
+ admin_pattern($1, icinga2_var_run_t)
+ admin_pattern($1, icinga2_command_t)
+ admin_pattern($1, icinga2_spool_t)
+ admin_pattern($1, icinga2_cache_t)
+
+ icinga2_systemctl($1)
+ admin_pattern($1, icinga2_unit_file_t)
+ allow $1 icinga2_unit_file_t:service all_service_perms;
+
+ optional_policy(`
+ systemd_passwd_agent_exec($1)
+ systemd_read_fifo_file_passwd_run($1)
+ ')
+')
+
+########################################
+### <summary>
+### Send icinga2 commands through pipe
+### </summary>
+### <param name="domain">
+### <summary>
+### Domain allowed to send commands.
+### </summary>
+### </param>
+#
+interface(`icinga2_send_commands',`
+ gen_require(`
+ type icinga2_var_run_t;
+ ')
+
+ files_search_pids($1)
+ read_files_pattern($1, icinga2_var_run_t, icinga2_var_run_t)
+ read_files_pattern($1, icinga2_command_t, icinga2_command_t)
+ write_fifo_files_pattern($1, icinga2_command_t, icinga2_command_t)
+')
+
+########################################
+## <summary>
+## For domains icinga2 should transition to (e.g. Plugins).
+## </summary>
+## <param name="executable">
+## <summary>
+## Context of the executable.
+## </summary>
+## </param>
+## <param name="domain">
+## <summary>
+## Domain icinga should transition to.
+## </summary>
+## </param>
+#
+interface(`icinga2_execstrans',`
+ gen_require(`
+ type icinga2_t;
+ ')
+
+ domtrans_pattern(icinga2_t, $1, $2)
+ allow icinga2_t $2:process sigkill;
+')
+
+######################################
+## <summary>
+## Dontaudit read and write an leaked file descriptors
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain to not audit.
+## </summary>
+## </param>
+#
+interface(`icinga2_dontaudit_leaks_fifo',`
+ gen_require(`
+ type icinga2_t;
+ ')
+
+ dontaudit $1 icinga2_t:fifo_file write;
+')
+
+## <summary>Icinga2 administrator role.</summary>
+
+########################################
+## <summary>
+## Change to the Icinga2 administrator role.
+## </summary>
+## <param name="role">
+## <summary>
+## Role allowed access.
+## </summary>
+## </param>
+## <rolecap/>
+#
+interface(`icinga2adm_role_change',`
+ gen_require(`
+ role icinga2adm_r;
+ ')
+
+ allow $1 icinga2adm_r;
+')
+
+########################################
+## <summary>
+## For domains icinga2adm should transition to (e.g. Plugins).
+## </summary>
+## <param name="executable">
+## <summary>
+## Context of the executable.
+## </summary>
+## </param>
+## <param name="domain">
+## <summary>
+## Domain icinga should transition to.
+## </summary>
+## </param>
+#
+interface(`icinga2adm_execstrans',`
+ gen_require(`
+ type icinga2adm_t;
+ ')
+
+ role icinga2adm_r types $2;
+ allow icinga2adm_r system_r;
+ type_transition icinga2adm_t $1:process $2;
+ allow icinga2adm_t $2:process transition;
+ allow $2 icinga2adm_t:process sigchld;
+ role_transition icinga2adm_r $1 system_r;
+')
+
+########################################
+## <summary>
+## Make a TCP connection to the icinga2 port.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`corenet_tcp_connect_icinga2_port',`
+ gen_require(`
+ type icinga2_port_t;
+ ')
+
+ allow $1 icinga2_port_t:tcp_socket name_connect;
+')
diff --git a/tools/selinux/icinga2.sh b/tools/selinux/icinga2.sh
new file mode 100755
index 0000000..9d5dd59
--- /dev/null
+++ b/tools/selinux/icinga2.sh
@@ -0,0 +1,74 @@
+#!/bin/sh -e
+
+DIRNAME=`dirname $0`
+cd $DIRNAME
+USAGE="$0 [ --update ]"
+if [ `id -u` != 0 ]; then
+echo 'You must be root to run this script'
+exit 1
+fi
+
+if [ $# -eq 1 ]; then
+ if [ "$1" = "--update" ] ; then
+ time=`ls -l --time-style="+%x %X" icinga2.te | awk '{ printf "%s %s", $6, $7 }'`
+ rules=`ausearch --start $time -m avc --raw -se icinga2`
+ if [ x"$rules" != "x" ] ; then
+ echo "Found avc's to update policy with"
+ echo -e "$rules" | audit2allow -R
+ echo "Do you want these changes added to policy [y/n]?"
+ read ANS
+ if [ "$ANS" = "y" -o "$ANS" = "Y" ] ; then
+ echo "Updating policy"
+ echo -e "$rules" | audit2allow -R >> icinga2.te
+ # Fall though and rebuild policy
+ else
+ exit 0
+ fi
+ else
+ echo "No new avcs found"
+ exit 0
+ fi
+ else
+ echo -e $USAGE
+ exit 1
+ fi
+elif [ $# -ge 2 ] ; then
+ echo -e $USAGE
+ exit 1
+fi
+
+echo "Building and Loading Policy"
+set -x
+make -f /usr/share/selinux/devel/Makefile icinga2.pp || exit
+/usr/sbin/semodule -i icinga2.pp
+
+# Generate a man page off the installed module
+sepolicy manpage -p . -d icinga2_t
+# Fixing the file context on /usr/sbin/icinga2
+/sbin/restorecon -F -R -v /usr/sbin/icinga2
+/sbin/restorecon -F -R -v /usr/lib64/icinga2/sbin/icinga2
+/sbin/restorecon -F -R -v /usr/lib/icinga2/safe-reload
+# Fixing the file context on /etc/rc\.d/init\.d/icinga2
+#/sbin/restorecon -F -R -v /etc/rc\.d/init\.d/icinga2
+# Fixing the file context on /usr/lib/systemd/system/icinga2.*
+/sbin/restorecon -F -R -v /usr/lib/systemd/system/icinga2.*
+# Fixing the file context on /etc/icinga2
+/sbin/restorecon -F -R -v /etc/icinga2
+# Fixing the file context on /var/log/icinga2
+/sbin/restorecon -F -R -v /var/log/icinga2
+# Fixing the file context on /var/lib/icinga2
+/sbin/restorecon -F -R -v /var/lib/icinga2
+# Fixing the file context on /var/run/icinga2
+/sbin/restorecon -F -R -v /var/run/icinga2
+# Fixing the file context on /var/cache/icinga2
+/sbin/restorecon -F -R -v /var/cache/icinga2
+# Fixing the file context on /var/spool/icinga2
+/sbin/restorecon -F -R -v /var/spool/icinga2
+
+# Label the port 5665
+/sbin/semanage port -a -t icinga2_port_t -p tcp 5665
+/sbin/semanage port -a -t redis_port_t -p tcp 6380
+
+# Generate a rpm package for the newly generated policy
+pwd=$(pwd)
+#rpmbuild --define "_sourcedir ${pwd}" --define "_specdir ${pwd}" --define "_builddir ${pwd}" --define "_srcrpmdir ${pwd}" --define "_rpmdir ${pwd}" --define "_buildrootdir ${pwd}/.build" -ba icinga2_selinux.spec
diff --git a/tools/selinux/icinga2.te b/tools/selinux/icinga2.te
new file mode 100644
index 0000000..1573256
--- /dev/null
+++ b/tools/selinux/icinga2.te
@@ -0,0 +1,288 @@
+policy_module(icinga2, 0.2.2)
+
+########################################
+#
+# Declarations
+#
+
+## <desc>
+## <p>
+## Allow Icinga 2 to connect to all ports
+## </p>
+## </desc>
+gen_tunable(icinga2_can_connect_all, false)
+
+## <desc>
+## <p>
+## Allow Apache to connect to Icinga 2 API
+## </p>
+## </desc>
+gen_tunable(httpd_can_connect_icinga2_api, true)
+
+## <desc>
+## <p>
+## Allow Apache to write into Icinga 2 Commandpipe
+## </p>
+## </desc>
+gen_tunable(httpd_can_write_icinga2_command, true)
+
+## <desc>
+## <p>
+## Allow Icinga 2 to run plugins via sudo
+## </p>
+## </desc>
+gen_tunable(icinga2_run_sudo, false)
+
+require {
+ type nagios_admin_plugin_t; type nagios_admin_plugin_exec_t;
+ type nagios_checkdisk_plugin_t; type nagios_checkdisk_plugin_exec_t;
+ type nagios_mail_plugin_t; type nagios_mail_plugin_exec_t;
+ type nagios_services_plugin_t; type nagios_services_plugin_exec_t;
+ type nagios_system_plugin_t; type nagios_system_plugin_exec_t;
+ type nagios_unconfined_plugin_t; type nagios_unconfined_plugin_exec_t;
+ type nagios_eventhandler_plugin_t; type nagios_eventhandler_plugin_exec_t;
+ type nagios_openshift_plugin_t; type nagios_openshift_plugin_exec_t;
+ type httpd_t; type system_mail_t;
+ type redis_t; type redis_var_run_t; type redis_port_t;
+ type devlog_t;
+ role staff_r;
+ attribute unreserved_port_type;
+}
+
+type icinga2_t;
+type icinga2_exec_t;
+init_daemon_domain(icinga2_t, icinga2_exec_t)
+
+#permissive icinga2_t;
+
+type icinga2_initrc_exec_t;
+init_script_file(icinga2_initrc_exec_t)
+
+type icinga2_unit_file_t;
+systemd_unit_file(icinga2_unit_file_t)
+
+type icinga2_etc_t;
+files_config_file(icinga2_etc_t)
+
+type icinga2_log_t;
+logging_log_file(icinga2_log_t)
+
+type icinga2_var_lib_t;
+files_type(icinga2_var_lib_t)
+
+type icinga2_var_run_t;
+files_pid_file(icinga2_var_run_t)
+
+type icinga2_command_t;
+files_type(icinga2_command_t)
+
+type icinga2_spool_t;
+files_type(icinga2_spool_t)
+
+type icinga2_cache_t;
+files_type(icinga2_cache_t)
+
+type icinga2_tmp_t;
+files_tmp_file(icinga2_tmp_t)
+
+type icinga2_port_t;
+# There is no interface for unreserved_port_type
+typeattribute icinga2_port_t unreserved_port_type;
+corenet_port(icinga2_port_t)
+
+########################################
+#
+# icinga2 local policy
+#
+allow icinga2_t self:capability { setgid setuid sys_resource kill };
+allow icinga2_t self:process { setsched signal setrlimit };
+allow icinga2_t self:fifo_file rw_fifo_file_perms;
+allow icinga2_t self:unix_dgram_socket create_socket_perms;
+allow icinga2_t self:unix_stream_socket create_stream_socket_perms;
+
+allow icinga2_t icinga2_exec_t:file execute_no_trans;
+
+list_dirs_pattern(icinga2_t, icinga2_etc_t, icinga2_etc_t)
+read_files_pattern(icinga2_t, icinga2_etc_t, icinga2_etc_t)
+read_lnk_files_pattern(icinga2_t, icinga2_etc_t, icinga2_etc_t)
+
+manage_dirs_pattern(icinga2_t, icinga2_log_t, icinga2_log_t)
+manage_files_pattern(icinga2_t, icinga2_log_t, icinga2_log_t)
+manage_lnk_files_pattern(icinga2_t, icinga2_log_t, icinga2_log_t)
+logging_log_filetrans(icinga2_t, icinga2_log_t, { dir file lnk_file })
+
+manage_dirs_pattern(icinga2_t, icinga2_var_lib_t, icinga2_var_lib_t)
+manage_files_pattern(icinga2_t, icinga2_var_lib_t, icinga2_var_lib_t)
+manage_lnk_files_pattern(icinga2_t, icinga2_var_lib_t, icinga2_var_lib_t)
+files_var_lib_filetrans(icinga2_t, icinga2_var_lib_t, { dir file lnk_file })
+
+manage_dirs_pattern(icinga2_t, icinga2_var_run_t, icinga2_var_run_t)
+manage_files_pattern(icinga2_t, icinga2_var_run_t, icinga2_var_run_t)
+files_pid_filetrans(icinga2_t, icinga2_var_run_t, { dir file })
+
+manage_dirs_pattern(icinga2_t, icinga2_command_t, icinga2_command_t)
+manage_files_pattern(icinga2_t, icinga2_command_t, icinga2_command_t)
+manage_fifo_files_pattern(icinga2_t, icinga2_command_t, icinga2_command_t)
+
+manage_dirs_pattern(icinga2_t, icinga2_spool_t, icinga2_spool_t)
+manage_files_pattern(icinga2_t, icinga2_spool_t, icinga2_spool_t)
+files_spool_filetrans(icinga2_t, icinga2_spool_t, { dir file })
+
+manage_dirs_pattern(icinga2_t, icinga2_cache_t, icinga2_cache_t)
+manage_files_pattern(icinga2_t, icinga2_cache_t, icinga2_cache_t)
+
+manage_files_pattern(icinga2_t, icinga2_tmp_t, icinga2_tmp_t)
+manage_dirs_pattern(icinga2_t, icinga2_tmp_t, icinga2_tmp_t)
+files_tmp_filetrans(icinga2_t, icinga2_tmp_t, { dir file })
+
+domain_use_interactive_fds(icinga2_t)
+
+files_read_etc_files(icinga2_t)
+
+auth_use_nsswitch(icinga2_t)
+
+miscfiles_read_localization(icinga2_t)
+
+corecmd_exec_shell(icinga2_t)
+corecmd_exec_bin(icinga2_t)
+
+kernel_read_system_state(icinga2_t)
+kernel_read_network_state(icinga2_t)
+kernel_dgram_send(icinga2_t)
+
+# should be moved to nagios_plugin_template in nagios.if
+icinga2_execstrans(nagios_admin_plugin_exec_t, nagios_admin_plugin_t)
+icinga2_execstrans(nagios_checkdisk_plugin_exec_t, nagios_checkdisk_plugin_t)
+icinga2_execstrans(nagios_mail_plugin_exec_t, nagios_mail_plugin_t)
+icinga2_execstrans(nagios_services_plugin_exec_t, nagios_services_plugin_t)
+icinga2_execstrans(nagios_system_plugin_exec_t, nagios_system_plugin_t)
+icinga2_execstrans(nagios_unconfined_plugin_exec_t, nagios_unconfined_plugin_t)
+icinga2_execstrans(nagios_eventhandler_plugin_exec_t, nagios_eventhandler_plugin_t)
+icinga2_execstrans(nagios_openshift_plugin_exec_t, nagios_openshift_plugin_t)
+
+# should be moved nagios.te
+nagios_plugin_template(notification)
+icinga2_execstrans(nagios_notification_plugin_exec_t, nagios_notification_plugin_t)
+allow nagios_notification_plugin_t icinga2_etc_t:dir search;
+allow nagios_notification_plugin_t nagios_notification_plugin_exec_t:dir search;
+#permissive nagios_notification_plugin_t;
+corecmd_exec_bin(nagios_notification_plugin_t)
+hostname_exec(nagios_notification_plugin_t)
+type nagios_notification_plugin_tmp_t;
+files_tmp_file(nagios_notification_plugin_tmp_t)
+manage_files_pattern(nagios_notification_plugin_t, nagios_notification_plugin_tmp_t, nagios_notification_plugin_tmp_t)
+manage_dirs_pattern(nagios_notification_plugin_t, nagios_notification_plugin_tmp_t, nagios_notification_plugin_tmp_t)
+files_tmp_filetrans(nagios_notification_plugin_t, nagios_notification_plugin_tmp_t, { dir file })
+fs_dontaudit_getattr_xattr_fs(nagios_notification_plugin_t)
+optional_policy(`
+ mta_send_mail(nagios_notification_plugin_t)
+')
+icinga2_dontaudit_leaks_fifo(system_mail_t)
+# direct smtp notification
+corenet_tcp_connect_smtp_port(nagios_notification_plugin_t)
+# hipsaint notification
+auth_read_passwd(nagios_notification_plugin_t)
+sysnet_read_config(nagios_notification_plugin_t)
+allow nagios_notification_plugin_t self:udp_socket create_stream_socket_perms;
+allow nagios_notification_plugin_t self:tcp_socket create_stream_socket_perms;
+allow nagios_notification_plugin_t self:netlink_route_socket create_netlink_socket_perms;
+corenet_tcp_connect_http_port(nagios_notification_plugin_t)
+miscfiles_read_generic_certs(nagios_notification_plugin_t)
+
+allow icinga2_t icinga2_port_t:tcp_socket name_bind;
+allow icinga2_t self:tcp_socket create_stream_socket_perms;
+corenet_tcp_connect_icinga2_port(icinga2_t)
+
+mysql_stream_connect(icinga2_t)
+mysql_tcp_connect(icinga2_t)
+postgresql_stream_connect(icinga2_t)
+postgresql_tcp_connect(icinga2_t)
+
+# graphite is using port 2003 which is lmtp_port_t
+corenet_tcp_connect_lmtp_port(icinga2_t)
+
+# Allow icinga2 to connect to redis using unix domain sockets
+stream_connect_pattern(icinga2_t, redis_var_run_t, redis_var_run_t, redis_t)
+
+# Just like `redis_tcp_connect(icinga2_t)`, though this interface does not exist on centos7
+corenet_tcp_recvfrom_labeled(icinga2_t, redis_t)
+corenet_tcp_sendrecv_redis_port(icinga2_t)
+corenet_tcp_connect_redis_port(icinga2_t)
+
+# This is for other feature that do not use a confined port
+# or if you run one one with a non standard port.
+tunable_policy(`icinga2_can_connect_all',`
+ corenet_tcp_connect_all_ports(icinga2_t)
+')
+
+# This is for plugins requiring to be executed via sudo
+tunable_policy(`icinga2_run_sudo',`
+ allow icinga2_t self:capability { audit_write net_admin };
+ allow icinga2_t self:netlink_audit_socket { create_netlink_socket_perms nlmsg_relay };
+ allow icinga2_t devlog_t:sock_file write;
+
+ init_read_utmp(icinga2_t)
+
+ auth_domtrans_chkpwd(icinga2_t)
+ allow icinga2_t chkpwd_t:process { noatsecure rlimitinh siginh };
+
+ selinux_compute_access_vector(icinga2_t)
+
+ dbus_send_system_bus(icinga2_t)
+ dbus_stream_connect_system_dbusd(icinga2_t)
+ systemd_dbus_chat_logind(icinga2_t)
+ # Without this it works but is very slow
+ systemd_write_inherited_logind_sessions_pipes(icinga2_t)
+')
+
+optional_policy(`
+ tunable_policy(`icinga2_run_sudo',`
+ sudo_exec(icinga2_t)
+ ')
+')
+
+
+
+########################################
+#
+# Icinga Webinterfaces
+#
+
+optional_policy(`
+ # should be a boolean in apache-policy
+ tunable_policy(`httpd_can_write_icinga2_command',`
+ icinga2_send_commands(httpd_t)
+ ')
+')
+
+optional_policy(`
+ # should be a boolean in apache-policy
+ tunable_policy(`httpd_can_connect_icinga2_api',`
+ corenet_tcp_connect_icinga2_port(httpd_t)
+ ')
+')
+
+########################################
+#
+# Icinga2 Admin Role
+#
+
+userdom_unpriv_user_template(icinga2adm)
+
+icinga2_admin(icinga2adm_t, icinga2adm_r)
+
+allow icinga2adm_t self:capability { dac_read_search dac_override };
+
+# should be moved to staff.te
+icinga2adm_role_change(staff_r)
+
+# should be moved to nagios_plugin_template in nagios.if
+icinga2adm_execstrans(nagios_admin_plugin_exec_t, nagios_admin_plugin_t)
+icinga2adm_execstrans(nagios_checkdisk_plugin_exec_t, nagios_checkdisk_plugin_t)
+icinga2adm_execstrans(nagios_mail_plugin_exec_t, nagios_mail_plugin_t)
+icinga2adm_execstrans(nagios_services_plugin_exec_t, nagios_services_plugin_t)
+icinga2adm_execstrans(nagios_system_plugin_exec_t, nagios_system_plugin_t)
+icinga2adm_execstrans(nagios_unconfined_plugin_exec_t, nagios_unconfined_plugin_t)
+icinga2adm_execstrans(nagios_eventhandler_plugin_exec_t, nagios_eventhandler_plugin_t)
+icinga2adm_execstrans(nagios_openshift_plugin_exec_t, nagios_openshift_plugin_t)
+icinga2adm_execstrans(nagios_notification_plugin_exec_t, nagios_notification_plugin_t)