diff options
Diffstat (limited to 'tools/selinux')
| -rw-r--r-- | tools/selinux/icinga2.fc | 23 | ||||
| -rw-r--r-- | tools/selinux/icinga2.if | 453 | ||||
| -rwxr-xr-x | tools/selinux/icinga2.sh | 74 | ||||
| -rw-r--r-- | tools/selinux/icinga2.te | 290 |
4 files changed, 840 insertions, 0 deletions
diff --git a/tools/selinux/icinga2.fc b/tools/selinux/icinga2.fc new file mode 100644 index 0000000..325728d --- /dev/null +++ b/tools/selinux/icinga2.fc @@ -0,0 +1,23 @@ +/etc/rc\.d/init\.d/icinga2 -- gen_context(system_u:object_r:icinga2_initrc_exec_t,s0) + +/usr/lib/systemd/system/icinga2.* -- gen_context(system_u:object_r:icinga2_unit_file_t,s0) + +/etc/icinga2(/.*)? gen_context(system_u:object_r:icinga2_etc_t,s0) + +/etc/icinga2/scripts(/.*)? -- gen_context(system_u:object_r:nagios_notification_plugin_exec_t,s0) + +/usr/sbin/icinga2 -- gen_context(system_u:object_r:icinga2_exec_t,s0) +/usr/lib/icinga2/sbin/icinga2 -- gen_context(system_u:object_r:icinga2_exec_t,s0) +/usr/lib/icinga2/safe-reload -- gen_context(system_u:object_r:icinga2_exec_t,s0) + +/var/lib/icinga2(/.*)? gen_context(system_u:object_r:icinga2_var_lib_t,s0) + +/var/log/icinga2(/.*)? gen_context(system_u:object_r:icinga2_log_t,s0) + +/var/run/icinga2(/.*)? gen_context(system_u:object_r:icinga2_var_run_t,s0) + +/var/run/icinga2/cmd(/.*)? gen_context(system_u:object_r:icinga2_command_t,s0) + +/var/spool/icinga2(/.*)? gen_context(system_u:object_r:icinga2_spool_t,s0) + +/var/cache/icinga2(/.*)? gen_context(system_u:object_r:icinga2_cache_t,s0) diff --git a/tools/selinux/icinga2.if b/tools/selinux/icinga2.if new file mode 100644 index 0000000..15fb034 --- /dev/null +++ b/tools/selinux/icinga2.if @@ -0,0 +1,453 @@ + +## <summary>policy for icinga2</summary> + +######################################## +## <summary> +## Execute TEMPLATE in the icinga2 domin. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed to transition. +## </summary> +## </param> +# +interface(`icinga2_domtrans',` + gen_require(` + type icinga2_t, icinga2_exec_t; + ') + + corecmd_search_bin($1) + domtrans_pattern($1, icinga2_exec_t, icinga2_t) +') + +######################################## +## <summary> +## Execute icinga2 server in the icinga2 domain. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`icinga2_initrc_domtrans',` + gen_require(` + type icinga2_initrc_exec_t; + ') + + init_labeled_script_domtrans($1, icinga2_initrc_exec_t) +') + +######################################## +## <summary> +## Execute icinga2 daemon in the icinga2 domain. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed to transition. +## </summary> +## </param> +# +interface(`icinga2_systemctl',` + gen_require(` + type icinga2_t; + type icinga2_unit_file_t; + ') + + systemd_exec_systemctl($1) + allow $1 icinga2_unit_file_t:file read_file_perms; + allow $1 icinga2_unit_file_t:service manage_service_perms; + + ps_process_pattern($1, icinga2_t) + init_dbus_chat($1) +') + +######################################## +## <summary> +## Allow the specified domain to read +## icinga2 configuration files. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +## <rolecap/> +# +interface(`icinga2_read_config',` + gen_require(` + type icinga2_etc_t; + ') + + files_search_etc($1) + list_dirs_pattern($1, icinga2_etc_t, icinga2_etc_t) + read_files_pattern($1, icinga2_etc_t, icinga2_etc_t) +') + +######################################## +## <summary> +## Allow the specified domain to read +## and write icinga2 configuration files. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +## <rolecap/> +# +interface(`icinga2_manage_config',` + gen_require(` + type icinga2_etc_t; + ') + + files_search_etc($1) + manage_dirs_pattern($1, icinga2_etc_t, icinga2_etc_t) + manage_files_pattern($1, icinga2_etc_t, icinga2_etc_t) +') + +######################################## +## <summary> +## Read icinga2's log files. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +## <rolecap/> +# +interface(`icinga2_read_log',` + gen_require(` + type icinga2_log_t; + ') + + logging_search_logs($1) + read_files_pattern($1, icinga2_log_t, icinga2_log_t) +') + +######################################## +## <summary> +## Append to icinga2 log files. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`icinga2_append_log',` + gen_require(` + type icinga2_log_t; + ') + + logging_search_logs($1) + append_files_pattern($1, icinga2_log_t, icinga2_log_t) +') + +######################################## +## <summary> +## Manage icinga2 log files +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`icinga2_manage_log',` + gen_require(` + type icinga2_log_t; + ') + + logging_search_logs($1) + manage_dirs_pattern($1, icinga2_log_t, icinga2_log_t) + manage_files_pattern($1, icinga2_log_t, icinga2_log_t) + manage_lnk_files_pattern($1, icinga2_log_t, icinga2_log_t) +') + +######################################## +## <summary> +## Search icinga2 lib directories. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`icinga2_search_lib',` + gen_require(` + type icinga2_var_lib_t; + ') + + allow $1 icinga2_var_lib_t:dir search_dir_perms; + files_search_var_lib($1) +') + +######################################## +## <summary> +## Read icinga2 lib files. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`icinga2_read_lib_files',` + gen_require(` + type icinga2_var_lib_t; + ') + + files_search_var_lib($1) + read_files_pattern($1, icinga2_var_lib_t, icinga2_var_lib_t) +') + +######################################## +## <summary> +## Manage icinga2 lib files. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`icinga2_manage_lib_files',` + gen_require(` + type icinga2_var_lib_t; + ') + + files_search_var_lib($1) + manage_files_pattern($1, icinga2_var_lib_t, icinga2_var_lib_t) +') + +######################################## +## <summary> +## Manage icinga2 lib directories. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`icinga2_manage_lib_dirs',` + gen_require(` + type icinga2_var_lib_t; + ') + + files_search_var_lib($1) + manage_dirs_pattern($1, icinga2_var_lib_t, icinga2_var_lib_t) +') + +######################################## +## <summary> +## Manage icinga2 spool files. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`icinga2_manage_spool_files',` + gen_require(` + type icinga2_spool_t; + ') + + files_search_var_lib($1) + manage_files_pattern($1, icinga2_spool_t, icinga2_spool_t) +') + +######################################## +## <summary> +## All of the rules required to administrate +## an icinga2 environment +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +## <param name="role"> +## <summary> +## Role allowed access. +## </summary> +## </param> +## <rolecap/> +# +interface(`icinga2_admin',` + gen_require(` + type icinga2_t; + type icinga2_initrc_exec_t; + type icinga2_log_t; + type icinga2_var_lib_t; + ') + + allow $1 icinga2_t:process { signal_perms }; + ps_process_pattern($1, icinga2_t) + + tunable_policy(`deny_ptrace',`',` + allow $1 icinga2_t:process ptrace; + ') + + icinga2_initrc_domtrans($1) + domain_system_change_exemption($1) + role_transition $2 icinga2_initrc_exec_t system_r; + allow $2 system_r; + + files_list_etc($1) + admin_pattern($1, icinga2_etc_t) + + logging_search_logs($1) + admin_pattern($1, icinga2_log_t) + + files_search_var_lib($1) + admin_pattern($1, icinga2_var_lib_t) + + admin_pattern($1, icinga2_var_run_t) + admin_pattern($1, icinga2_command_t) + admin_pattern($1, icinga2_spool_t) + admin_pattern($1, icinga2_cache_t) + + icinga2_systemctl($1) + admin_pattern($1, icinga2_unit_file_t) + allow $1 icinga2_unit_file_t:service all_service_perms; + + optional_policy(` + systemd_passwd_agent_exec($1) + systemd_read_fifo_file_passwd_run($1) + ') +') + +######################################## +### <summary> +### Send icinga2 commands through pipe +### </summary> +### <param name="domain"> +### <summary> +### Domain allowed to send commands. +### </summary> +### </param> +# +interface(`icinga2_send_commands',` + gen_require(` + type icinga2_var_run_t; + ') + + files_search_pids($1) + read_files_pattern($1, icinga2_var_run_t, icinga2_var_run_t) + read_files_pattern($1, icinga2_command_t, icinga2_command_t) + write_fifo_files_pattern($1, icinga2_command_t, icinga2_command_t) +') + +######################################## +## <summary> +## For domains icinga2 should transition to (e.g. Plugins). +## </summary> +## <param name="executable"> +## <summary> +## Context of the executable. +## </summary> +## </param> +## <param name="domain"> +## <summary> +## Domain icinga should transition to. +## </summary> +## </param> +# +interface(`icinga2_execstrans',` + gen_require(` + type icinga2_t; + ') + + domtrans_pattern(icinga2_t, $1, $2) + allow icinga2_t $2:process sigkill; +') + +###################################### +## <summary> +## Dontaudit read and write an leaked file descriptors +## </summary> +## <param name="domain"> +## <summary> +## Domain to not audit. +## </summary> +## </param> +# +interface(`icinga2_dontaudit_leaks_fifo',` + gen_require(` + type icinga2_t; + ') + + dontaudit $1 icinga2_t:fifo_file write; +') + +## <summary>Icinga2 administrator role.</summary> + +######################################## +## <summary> +## Change to the Icinga2 administrator role. +## </summary> +## <param name="role"> +## <summary> +## Role allowed access. +## </summary> +## </param> +## <rolecap/> +# +interface(`icinga2adm_role_change',` + gen_require(` + role icinga2adm_r; + ') + + allow $1 icinga2adm_r; +') + +######################################## +## <summary> +## For domains icinga2adm should transition to (e.g. Plugins). +## </summary> +## <param name="executable"> +## <summary> +## Context of the executable. +## </summary> +## </param> +## <param name="domain"> +## <summary> +## Domain icinga should transition to. +## </summary> +## </param> +# +interface(`icinga2adm_execstrans',` + gen_require(` + type icinga2adm_t; + ') + + role icinga2adm_r types $2; + allow icinga2adm_r system_r; + type_transition icinga2adm_t $1:process $2; + allow icinga2adm_t $2:process transition; + allow $2 icinga2adm_t:process sigchld; + role_transition icinga2adm_r $1 system_r; +') + +######################################## +## <summary> +## Make a TCP connection to the icinga2 port. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`corenet_tcp_connect_icinga2_port',` + gen_require(` + type icinga2_port_t; + ') + + allow $1 icinga2_port_t:tcp_socket name_connect; +') diff --git a/tools/selinux/icinga2.sh b/tools/selinux/icinga2.sh new file mode 100755 index 0000000..9d5dd59 --- /dev/null +++ b/tools/selinux/icinga2.sh @@ -0,0 +1,74 @@ +#!/bin/sh -e + +DIRNAME=`dirname $0` +cd $DIRNAME +USAGE="$0 [ --update ]" +if [ `id -u` != 0 ]; then +echo 'You must be root to run this script' +exit 1 +fi + +if [ $# -eq 1 ]; then + if [ "$1" = "--update" ] ; then + time=`ls -l --time-style="+%x %X" icinga2.te | awk '{ printf "%s %s", $6, $7 }'` + rules=`ausearch --start $time -m avc --raw -se icinga2` + if [ x"$rules" != "x" ] ; then + echo "Found avc's to update policy with" + echo -e "$rules" | audit2allow -R + echo "Do you want these changes added to policy [y/n]?" + read ANS + if [ "$ANS" = "y" -o "$ANS" = "Y" ] ; then + echo "Updating policy" + echo -e "$rules" | audit2allow -R >> icinga2.te + # Fall though and rebuild policy + else + exit 0 + fi + else + echo "No new avcs found" + exit 0 + fi + else + echo -e $USAGE + exit 1 + fi +elif [ $# -ge 2 ] ; then + echo -e $USAGE + exit 1 +fi + +echo "Building and Loading Policy" +set -x +make -f /usr/share/selinux/devel/Makefile icinga2.pp || exit +/usr/sbin/semodule -i icinga2.pp + +# Generate a man page off the installed module +sepolicy manpage -p . -d icinga2_t +# Fixing the file context on /usr/sbin/icinga2 +/sbin/restorecon -F -R -v /usr/sbin/icinga2 +/sbin/restorecon -F -R -v /usr/lib64/icinga2/sbin/icinga2 +/sbin/restorecon -F -R -v /usr/lib/icinga2/safe-reload +# Fixing the file context on /etc/rc\.d/init\.d/icinga2 +#/sbin/restorecon -F -R -v /etc/rc\.d/init\.d/icinga2 +# Fixing the file context on /usr/lib/systemd/system/icinga2.* +/sbin/restorecon -F -R -v /usr/lib/systemd/system/icinga2.* +# Fixing the file context on /etc/icinga2 +/sbin/restorecon -F -R -v /etc/icinga2 +# Fixing the file context on /var/log/icinga2 +/sbin/restorecon -F -R -v /var/log/icinga2 +# Fixing the file context on /var/lib/icinga2 +/sbin/restorecon -F -R -v /var/lib/icinga2 +# Fixing the file context on /var/run/icinga2 +/sbin/restorecon -F -R -v /var/run/icinga2 +# Fixing the file context on /var/cache/icinga2 +/sbin/restorecon -F -R -v /var/cache/icinga2 +# Fixing the file context on /var/spool/icinga2 +/sbin/restorecon -F -R -v /var/spool/icinga2 + +# Label the port 5665 +/sbin/semanage port -a -t icinga2_port_t -p tcp 5665 +/sbin/semanage port -a -t redis_port_t -p tcp 6380 + +# Generate a rpm package for the newly generated policy +pwd=$(pwd) +#rpmbuild --define "_sourcedir ${pwd}" --define "_specdir ${pwd}" --define "_builddir ${pwd}" --define "_srcrpmdir ${pwd}" --define "_rpmdir ${pwd}" --define "_buildrootdir ${pwd}/.build" -ba icinga2_selinux.spec diff --git a/tools/selinux/icinga2.te b/tools/selinux/icinga2.te new file mode 100644 index 0000000..1b9f051 --- /dev/null +++ b/tools/selinux/icinga2.te @@ -0,0 +1,290 @@ +policy_module(icinga2, 0.2.2) + +######################################## +# +# Declarations +# + +## <desc> +## <p> +## Allow Icinga 2 to connect to all ports +## </p> +## </desc> +gen_tunable(icinga2_can_connect_all, false) + +## <desc> +## <p> +## Allow Apache to connect to Icinga 2 API +## </p> +## </desc> +gen_tunable(httpd_can_connect_icinga2_api, true) + +## <desc> +## <p> +## Allow Apache to write into Icinga 2 Commandpipe +## </p> +## </desc> +gen_tunable(httpd_can_write_icinga2_command, true) + +## <desc> +## <p> +## Allow Icinga 2 to run plugins via sudo +## </p> +## </desc> +gen_tunable(icinga2_run_sudo, false) + +require { + type nagios_admin_plugin_t; type nagios_admin_plugin_exec_t; + type nagios_checkdisk_plugin_t; type nagios_checkdisk_plugin_exec_t; + type nagios_mail_plugin_t; type nagios_mail_plugin_exec_t; + type nagios_services_plugin_t; type nagios_services_plugin_exec_t; + type nagios_system_plugin_t; type nagios_system_plugin_exec_t; + type nagios_unconfined_plugin_t; type nagios_unconfined_plugin_exec_t; + type nagios_eventhandler_plugin_t; type nagios_eventhandler_plugin_exec_t; + type nagios_openshift_plugin_t; type nagios_openshift_plugin_exec_t; + type httpd_t; type system_mail_t; + type redis_t; type redis_var_run_t; type redis_port_t; + type devlog_t; + role staff_r; + attribute unreserved_port_type; +} + +type icinga2_t; +type icinga2_exec_t; +init_daemon_domain(icinga2_t, icinga2_exec_t) + +#permissive icinga2_t; + +type icinga2_initrc_exec_t; +init_script_file(icinga2_initrc_exec_t) + +type icinga2_unit_file_t; +systemd_unit_file(icinga2_unit_file_t) + +type icinga2_etc_t; +files_config_file(icinga2_etc_t) + +type icinga2_log_t; +logging_log_file(icinga2_log_t) + +type icinga2_var_lib_t; +files_type(icinga2_var_lib_t) + +type icinga2_var_run_t; +files_pid_file(icinga2_var_run_t) + +type icinga2_command_t; +files_type(icinga2_command_t) + +type icinga2_spool_t; +files_type(icinga2_spool_t) + +type icinga2_cache_t; +files_type(icinga2_cache_t) + +type icinga2_tmp_t; +files_tmp_file(icinga2_tmp_t) + +type icinga2_port_t; +# There is no interface for unreserved_port_type +typeattribute icinga2_port_t unreserved_port_type; +corenet_port(icinga2_port_t) + +######################################## +# +# icinga2 local policy +# +allow icinga2_t self:capability { setgid setuid sys_resource kill }; +allow icinga2_t self:process { setsched signal setrlimit }; +allow icinga2_t self:fifo_file rw_fifo_file_perms; +allow icinga2_t self:unix_dgram_socket create_socket_perms; +allow icinga2_t self:unix_stream_socket create_stream_socket_perms; + +allow icinga2_t icinga2_exec_t:file execute_no_trans; + +list_dirs_pattern(icinga2_t, icinga2_etc_t, icinga2_etc_t) +read_files_pattern(icinga2_t, icinga2_etc_t, icinga2_etc_t) +read_lnk_files_pattern(icinga2_t, icinga2_etc_t, icinga2_etc_t) + +manage_dirs_pattern(icinga2_t, icinga2_log_t, icinga2_log_t) +manage_files_pattern(icinga2_t, icinga2_log_t, icinga2_log_t) +manage_lnk_files_pattern(icinga2_t, icinga2_log_t, icinga2_log_t) +logging_log_filetrans(icinga2_t, icinga2_log_t, { dir file lnk_file }) +logging_send_syslog_msg(icinga2_t) + +manage_dirs_pattern(icinga2_t, icinga2_var_lib_t, icinga2_var_lib_t) +manage_files_pattern(icinga2_t, icinga2_var_lib_t, icinga2_var_lib_t) +manage_lnk_files_pattern(icinga2_t, icinga2_var_lib_t, icinga2_var_lib_t) +files_var_lib_filetrans(icinga2_t, icinga2_var_lib_t, { dir file lnk_file }) + +manage_dirs_pattern(icinga2_t, icinga2_var_run_t, icinga2_var_run_t) +manage_files_pattern(icinga2_t, icinga2_var_run_t, icinga2_var_run_t) +files_pid_filetrans(icinga2_t, icinga2_var_run_t, { dir file }) + +manage_dirs_pattern(icinga2_t, icinga2_command_t, icinga2_command_t) +manage_files_pattern(icinga2_t, icinga2_command_t, icinga2_command_t) +manage_fifo_files_pattern(icinga2_t, icinga2_command_t, icinga2_command_t) + +manage_dirs_pattern(icinga2_t, icinga2_spool_t, icinga2_spool_t) +manage_files_pattern(icinga2_t, icinga2_spool_t, icinga2_spool_t) +files_spool_filetrans(icinga2_t, icinga2_spool_t, { dir file }) + +manage_dirs_pattern(icinga2_t, icinga2_cache_t, icinga2_cache_t) +manage_files_pattern(icinga2_t, icinga2_cache_t, icinga2_cache_t) + +manage_files_pattern(icinga2_t, icinga2_tmp_t, icinga2_tmp_t) +manage_dirs_pattern(icinga2_t, icinga2_tmp_t, icinga2_tmp_t) +files_tmp_filetrans(icinga2_t, icinga2_tmp_t, { dir file }) + +domain_use_interactive_fds(icinga2_t) + +files_read_etc_files(icinga2_t) + +auth_use_nsswitch(icinga2_t) + +miscfiles_read_localization(icinga2_t) + +corecmd_exec_shell(icinga2_t) +corecmd_exec_bin(icinga2_t) + +kernel_read_system_state(icinga2_t) +kernel_read_network_state(icinga2_t) +kernel_dgram_send(icinga2_t) + +# should be moved to nagios_plugin_template in nagios.if +icinga2_execstrans(nagios_admin_plugin_exec_t, nagios_admin_plugin_t) +icinga2_execstrans(nagios_checkdisk_plugin_exec_t, nagios_checkdisk_plugin_t) +icinga2_execstrans(nagios_mail_plugin_exec_t, nagios_mail_plugin_t) +icinga2_execstrans(nagios_services_plugin_exec_t, nagios_services_plugin_t) +icinga2_execstrans(nagios_system_plugin_exec_t, nagios_system_plugin_t) +icinga2_execstrans(nagios_unconfined_plugin_exec_t, nagios_unconfined_plugin_t) +icinga2_execstrans(nagios_eventhandler_plugin_exec_t, nagios_eventhandler_plugin_t) +icinga2_execstrans(nagios_openshift_plugin_exec_t, nagios_openshift_plugin_t) + +# should be moved nagios.te +nagios_plugin_template(notification) +icinga2_execstrans(nagios_notification_plugin_exec_t, nagios_notification_plugin_t) +allow nagios_notification_plugin_t icinga2_etc_t:dir search; +allow nagios_notification_plugin_t nagios_notification_plugin_exec_t:dir search; +#permissive nagios_notification_plugin_t; +corecmd_exec_bin(nagios_notification_plugin_t) +hostname_exec(nagios_notification_plugin_t) +type nagios_notification_plugin_tmp_t; +files_tmp_file(nagios_notification_plugin_tmp_t) +manage_files_pattern(nagios_notification_plugin_t, nagios_notification_plugin_tmp_t, nagios_notification_plugin_tmp_t) +manage_dirs_pattern(nagios_notification_plugin_t, nagios_notification_plugin_tmp_t, nagios_notification_plugin_tmp_t) +files_tmp_filetrans(nagios_notification_plugin_t, nagios_notification_plugin_tmp_t, { dir file }) +fs_dontaudit_getattr_xattr_fs(nagios_notification_plugin_t) +optional_policy(` + mta_send_mail(nagios_notification_plugin_t) +') +icinga2_dontaudit_leaks_fifo(system_mail_t) +# direct smtp notification +corenet_tcp_connect_smtp_port(nagios_notification_plugin_t) +# hipsaint notification +auth_read_passwd(nagios_notification_plugin_t) +sysnet_read_config(nagios_notification_plugin_t) +allow nagios_notification_plugin_t self:udp_socket create_stream_socket_perms; +allow nagios_notification_plugin_t self:tcp_socket create_stream_socket_perms; +allow nagios_notification_plugin_t self:netlink_route_socket create_netlink_socket_perms; +corenet_tcp_connect_http_port(nagios_notification_plugin_t) +miscfiles_read_generic_certs(nagios_notification_plugin_t) + +allow icinga2_t icinga2_port_t:tcp_socket name_bind; +allow icinga2_t self:tcp_socket create_stream_socket_perms; +corenet_tcp_connect_icinga2_port(icinga2_t) + +mysql_stream_connect(icinga2_t) +mysql_tcp_connect(icinga2_t) +postgresql_stream_connect(icinga2_t) +postgresql_tcp_connect(icinga2_t) + +# graphite is using port 2003 which is lmtp_port_t +corenet_tcp_connect_lmtp_port(icinga2_t) + +# Allow icinga2 to connect to redis using unix domain sockets +stream_connect_pattern(icinga2_t, redis_var_run_t, redis_var_run_t, redis_t) + +# Just like `redis_tcp_connect(icinga2_t)`, though this interface does not exist on centos7 +corenet_tcp_recvfrom_labeled(icinga2_t, redis_t) +corenet_tcp_sendrecv_redis_port(icinga2_t) +corenet_tcp_connect_redis_port(icinga2_t) + +# This is for other feature that do not use a confined port +# or if you run one one with a non standard port. +tunable_policy(`icinga2_can_connect_all',` + corenet_tcp_connect_all_ports(icinga2_t) +') + +# This is for plugins requiring to be executed via sudo +tunable_policy(`icinga2_run_sudo',` + allow icinga2_t self:capability { audit_write net_admin }; + allow icinga2_t self:netlink_audit_socket { create_netlink_socket_perms nlmsg_relay }; + allow icinga2_t devlog_t:sock_file write; + + init_read_utmp(icinga2_t) + + auth_domtrans_chkpwd(icinga2_t) + allow icinga2_t chkpwd_t:process { noatsecure rlimitinh siginh }; + + selinux_compute_access_vector(icinga2_t) + + dbus_send_system_bus(icinga2_t) + dbus_stream_connect_system_dbusd(icinga2_t) + systemd_dbus_chat_logind(icinga2_t) + # Without this it works but is very slow + systemd_write_inherited_logind_sessions_pipes(icinga2_t) +') + +optional_policy(` + tunable_policy(`icinga2_run_sudo',` + sudo_exec(icinga2_t) + ') +') + + + +######################################## +# +# Icinga Webinterfaces +# + +optional_policy(` + # should be a boolean in apache-policy + tunable_policy(`httpd_can_write_icinga2_command',` + icinga2_send_commands(httpd_t) + ') +') + +optional_policy(` + # should be a boolean in apache-policy + tunable_policy(`httpd_can_connect_icinga2_api',` + corenet_tcp_connect_icinga2_port(httpd_t) + ') +') + +######################################## +# +# Icinga2 Admin Role +# + +role icinga2adm_r; +userdom_unpriv_user_template(icinga2adm) + +icinga2_admin(icinga2adm_t, icinga2adm_r) + +allow icinga2adm_t self:capability { dac_read_search dac_override }; + +# should be moved to staff.te +icinga2adm_role_change(staff_r) + +# should be moved to nagios_plugin_template in nagios.if +icinga2adm_execstrans(nagios_admin_plugin_exec_t, nagios_admin_plugin_t) +icinga2adm_execstrans(nagios_checkdisk_plugin_exec_t, nagios_checkdisk_plugin_t) +icinga2adm_execstrans(nagios_mail_plugin_exec_t, nagios_mail_plugin_t) +icinga2adm_execstrans(nagios_services_plugin_exec_t, nagios_services_plugin_t) +icinga2adm_execstrans(nagios_system_plugin_exec_t, nagios_system_plugin_t) +icinga2adm_execstrans(nagios_unconfined_plugin_exec_t, nagios_unconfined_plugin_t) +icinga2adm_execstrans(nagios_eventhandler_plugin_exec_t, nagios_eventhandler_plugin_t) +icinga2adm_execstrans(nagios_openshift_plugin_exec_t, nagios_openshift_plugin_t) +icinga2adm_execstrans(nagios_notification_plugin_exec_t, nagios_notification_plugin_t) |