policy/modules/services/munin.te

   1 policy_module(munin, 1.8.0)
   2
   3 ########################################
   4 #
   5 # Declarations
   6 #
   7
   8 attribute munin_plugin_domain;
   9
  10 type munin_t alias lrrd_t;
  11 type munin_exec_t alias lrrd_exec_t;
  12 init_daemon_domain(munin_t, munin_exec_t)
  13
  14 type munin_etc_t alias lrrd_etc_t;
  15 files_config_file(munin_etc_t)
  16
  17 type munin_initrc_exec_t;
  18 init_script_file(munin_initrc_exec_t)
  19
  20 type munin_log_t alias lrrd_log_t;
  21 logging_log_file(munin_log_t)
  22
  23 type munin_tmp_t alias lrrd_tmp_t;
  24 files_tmp_file(munin_tmp_t)
  25
  26 type munin_var_lib_t alias lrrd_var_lib_t;
  27 files_type(munin_var_lib_t)
  28
  29 type munin_plugin_state_t;
  30 files_type(munin_plugin_state_t)
  31
  32 type munin_var_run_t alias lrrd_var_run_t;
  33 files_pid_file(munin_var_run_t)
  34
  35 munin_plugin_template(disk)
  36
  37 munin_plugin_template(mail)
  38
  39 munin_plugin_template(services)
  40
  41 munin_plugin_template(system)
  42
  43 ########################################
  44 #
  45 # Local policy
  46 #
  47
  48 allow munin_t self:capability { chown dac_override kill setgid setuid sys_rawio };
  49 dontaudit munin_t self:capability sys_tty_config;
  50 allow munin_t self:process { getsched setsched signal_perms };
  51 allow munin_t self:unix_stream_socket { create_stream_socket_perms connectto };
  52 allow munin_t self:unix_dgram_socket { create_socket_perms sendto };
  53 allow munin_t self:tcp_socket create_stream_socket_perms;
  54 allow munin_t self:udp_socket create_socket_perms;
  55 allow munin_t self:fifo_file manage_fifo_file_perms;
  56
  57 allow munin_t munin_etc_t:dir list_dir_perms;
  58 read_files_pattern(munin_t, munin_etc_t, munin_etc_t)
  59 read_lnk_files_pattern(munin_t, munin_etc_t, munin_etc_t)
  60 files_search_etc(munin_t)
  61
  62 can_exec(munin_t, munin_exec_t)
  63
  64 manage_dirs_pattern(munin_t, munin_log_t, munin_log_t)
  65 manage_files_pattern(munin_t, munin_log_t, munin_log_t)
  66 logging_log_filetrans(munin_t, munin_log_t, { file dir })
  67
  68 manage_dirs_pattern(munin_t, munin_tmp_t, munin_tmp_t)
  69 manage_files_pattern(munin_t, munin_tmp_t, munin_tmp_t)
  70 manage_sock_files_pattern(munin_t, munin_tmp_t, munin_tmp_t)
  71 files_tmp_filetrans(munin_t, munin_tmp_t, { file dir sock_file })
  72
  73 # Allow access to the munin databases
  74 manage_dirs_pattern(munin_t, munin_var_lib_t, munin_var_lib_t)
  75 manage_files_pattern(munin_t, munin_var_lib_t, munin_var_lib_t)
  76 manage_lnk_files_pattern(munin_t, munin_var_lib_t, munin_var_lib_t)
  77 files_search_var_lib(munin_t)
  78
  79 manage_dirs_pattern(munin_t, munin_var_run_t, munin_var_run_t)
  80 manage_files_pattern(munin_t, munin_var_run_t, munin_var_run_t)
  81 manage_sock_files_pattern(munin_t, munin_var_run_t, munin_var_run_t)
  82 files_pid_filetrans(munin_t, munin_var_run_t, { file dir })
  83
  84 read_files_pattern(munin_t, munin_plugin_state_t, munin_plugin_state_t)
  85
  86 kernel_read_system_state(munin_t)
  87 kernel_read_network_state(munin_t)
  88 kernel_read_all_sysctls(munin_t)
  89
  90 corecmd_exec_bin(munin_t)
  91 corecmd_exec_shell(munin_t)
  92
  93 corenet_all_recvfrom_unlabeled(munin_t)
  94 corenet_all_recvfrom_netlabel(munin_t)
  95 corenet_tcp_sendrecv_generic_if(munin_t)
  96 corenet_udp_sendrecv_generic_if(munin_t)
  97 corenet_tcp_sendrecv_generic_node(munin_t)
  98 corenet_udp_sendrecv_generic_node(munin_t)
  99 corenet_tcp_sendrecv_all_ports(munin_t)
 100 corenet_udp_sendrecv_all_ports(munin_t)
 101 corenet_tcp_bind_generic_node(munin_t)
 102 corenet_tcp_bind_munin_port(munin_t)
 103 corenet_tcp_connect_munin_port(munin_t)
 104 corenet_tcp_connect_http_port(munin_t)
 105
 106 dev_read_sysfs(munin_t)
 107 dev_read_urand(munin_t)
 108
 109 domain_use_interactive_fds(munin_t)
 110 domain_read_all_domains_state(munin_t)
 111
 112 files_read_etc_files(munin_t)
 113 files_read_etc_runtime_files(munin_t)
 114 files_read_usr_files(munin_t)
 115 files_list_spool(munin_t)
 116
 117 fs_getattr_all_fs(munin_t)
 118 fs_search_auto_mountpoints(munin_t)
 119
 120 auth_use_nsswitch(munin_t)
 121
 122 logging_send_syslog_msg(munin_t)
 123 logging_read_all_logs(munin_t)
 124
 125 miscfiles_read_fonts(munin_t)
 126 miscfiles_read_localization(munin_t)
 127 miscfiles_setattr_fonts_cache_dirs(munin_t)
 128
 129 sysnet_exec_ifconfig(munin_t)
 130
 131 userdom_dontaudit_use_unpriv_user_fds(munin_t)
 132 userdom_dontaudit_search_user_home_dirs(munin_t)
 133
 134 optional_policy(`
 135         apache_content_template(munin)
 136
 137         manage_dirs_pattern(munin_t, httpd_munin_content_t, httpd_munin_content_t)
 138         manage_files_pattern(munin_t, httpd_munin_content_t, httpd_munin_content_t)
 139         apache_search_sys_content(munin_t)
 140 ')
 141
 142 optional_policy(`
 143         cron_system_entry(munin_t, munin_exec_t)
 144 ')
 145
 146 optional_policy(`
 147         fstools_domtrans(munin_t)
 148 ')
 149
 150 optional_policy(`
 151         lpd_domtrans_lpr(munin_t)
 152 ')
 153
 154 optional_policy(`
 155         mta_read_config(munin_t)
 156         mta_send_mail(munin_t)
 157         mta_list_queue(munin_t)
 158         mta_read_queue(munin_t)
 159 ')
 160
 161 optional_policy(`
 162         mysql_read_config(munin_t)
 163         mysql_stream_connect(munin_t)
 164 ')
 165
 166 optional_policy(`
 167         netutils_domtrans_ping(munin_t)
 168 ')
 169
 170 optional_policy(`
 171         postfix_list_spool(munin_t)
 172         postfix_getattr_spool_files(munin_t)
 173 ')
 174
 175 optional_policy(`
 176         rpc_search_nfs_state_data(munin_t)
 177 ')
 178
 179 optional_policy(`
 180         sendmail_read_log(munin_t)
 181 ')
 182
 183 optional_policy(`
 184         seutil_sigchld_newrole(munin_t)
 185 ')
 186
 187 optional_policy(`
 188         udev_read_db(munin_t)
 189 ')
 190
 191 ###################################
 192 #
 193 # local policy for disk plugins
 194 #
 195
 196 allow munin_disk_plugin_t self:capability { sys_admin sys_rawio };
 197 allow disk_munin_plugin_t self:tcp_socket create_stream_socket_perms;
 198
 199 rw_files_pattern(disk_munin_plugin_t, munin_var_lib_t, munin_var_lib_t)
 200
 201 corecmd_exec_shell(disk_munin_plugin_t)
 202
 203 corenet_tcp_connect_hddtemp_port(disk_munin_plugin_t)
 204
 205 files_read_etc_runtime_files(disk_munin_plugin_t)
 206
 207 dev_getattr_lvm_control(disk_munin_plugin_t)
 208 dev_read_sysfs(disk_munin_plugin_t)
 209 dev_read_urand(disk_munin_plugin_t)
 210
 211 storage_raw_read_fixed_disk(disk_munin_plugin_t)
 212
 213 sysnet_read_config(disk_munin_plugin_t)
 214
 215 optional_policy(`
 216         hddtemp_exec(disk_munin_plugin_t)
 217 ')
 218
 219 optional_policy(`
 220         fstools_exec(disk_munin_plugin_t)
 221 ')
 222
 223 ####################################
 224 #
 225 # local policy for mail plugins
 226 #
 227
 228 allow mail_munin_plugin_t self:capability dac_override;
 229
 230 rw_files_pattern(mail_munin_plugin_t, munin_var_lib_t, munin_var_lib_t)
 231
 232 dev_read_urand(mail_munin_plugin_t)
 233
 234 logging_read_generic_logs(mail_munin_plugin_t)
 235
 236 optional_policy(`
 237         mta_read_config(mail_munin_plugin_t)
 238         mta_send_mail(mail_munin_plugin_t)
 239         mta_list_queue(mail_munin_plugin_t)
 240         mta_read_queue(mail_munin_plugin_t)
 241 ')
 242
 243 optional_policy(`
 244         nscd_socket_use(mail_munin_plugin_t)
 245 ')
 246
 247 optional_policy(`
 248         postfix_read_config(mail_munin_plugin_t)
 249         postfix_list_spool(mail_munin_plugin_t)
 250         postfix_getattr_spool_files(mail_munin_plugin_t)
 251 ')
 252
 253 optional_policy(`
 254         sendmail_read_log(mail_munin_plugin_t)
 255 ')
 256
 257 ###################################
 258 #
 259 # local policy for service plugins
 260 #
 261
 262 allow services_munin_plugin_t self:shm create_sem_perms;
 263 allow services_munin_plugin_t self:sem create_sem_perms;
 264 allow services_munin_plugin_t self:tcp_socket create_stream_socket_perms;
 265 allow services_munin_plugin_t self:udp_socket create_socket_perms;
 266 allow services_munin_plugin_t self:netlink_route_socket r_netlink_socket_perms;
 267
 268 corenet_tcp_connect_all_ports(services_munin_plugin_t)
 269 corenet_tcp_connect_http_port(services_munin_plugin_t)
 270
 271 dev_read_urand(services_munin_plugin_t)
 272 dev_read_rand(services_munin_plugin_t)
 273
 274 sysnet_read_config(services_munin_plugin_t)
 275
 276 optional_policy(`
 277         cups_read_config(services_munin_plugin_t)
 278         cups_stream_connect(services_munin_plugin_t)
 279 ')
 280
 281 optional_policy(`
 282         lpd_exec_lpr(services_munin_plugin_t)
 283 ')
 284
 285 optional_policy(`
 286         mysql_read_config(services_munin_plugin_t)
 287         mysql_stream_connect(services_munin_plugin_t)
 288 ')
 289
 290 optional_policy(`
 291         netutils_domtrans_ping(services_munin_plugin_t)
 292 ')
 293
 294 optional_policy(`
 295         nscd_socket_use(services_munin_plugin_t)
 296 ')
 297
 298 optional_policy(`
 299         postgresql_stream_connect(services_munin_plugin_t)
 300 ')
 301
 302 optional_policy(`
 303         snmp_read_snmp_var_lib_files(services_munin_plugin_t)
 304 ')
 305
 306 optional_policy(`
 307         varnishd_read_lib_files(services_munin_plugin_t)
 308 ')
 309
 310 ##################################
 311 #
 312 # local policy for system plugins
 313 #
 314
 315 allow system_munin_plugin_t self:udp_socket create_socket_perms;
 316
 317 rw_files_pattern(system_munin_plugin_t, munin_var_lib_t, munin_var_lib_t)
 318
 319 # needed by munin_* plugins
 320 allow system_munin_plugin_t munin_log_t:file read_file_perms;
 321
 322 kernel_read_network_state(system_munin_plugin_t)
 323 kernel_read_all_sysctls(system_munin_plugin_t)
 324
 325 dev_read_sysfs(system_munin_plugin_t)
 326 dev_read_urand(system_munin_plugin_t)
 327
 328 domain_read_all_domains_state(system_munin_plugin_t)
 329
 330 # needed by users plugin
 331 init_read_utmp(system_munin_plugin_t)
 332
 333 sysnet_exec_ifconfig(system_munin_plugin_t)
 334
 335 term_getattr_unallocated_ttys(system_munin_plugin_t)
 336 term_getattr_all_ttys(system_munin_plugin_t)
 337 term_getattr_all_ptys(system_munin_plugin_t)
 338
 339 ################################
 340 #
 341 # local policy for munin plugin domains
 342 #
 343
 344 allow munin_plugin_domain munin_exec_t:file read_file_perms;
 345 allow munin_plugin_domain munin_t:tcp_socket rw_socket_perms;
 346
 347 # creates plugin state files
 348 manage_files_pattern(munin_plugin_domain, munin_plugin_state_t, munin_plugin_state_t)
 349
 350 read_lnk_files_pattern(munin_plugin_domain, munin_etc_t, munin_etc_t)
 351
 352 kernel_read_system_state(munin_plugin_domain)
 353
 354 corecmd_exec_bin(munin_plugin_domain)
 355 corecmd_exec_shell(munin_plugin_domain)
 356
 357 files_search_var_lib(munin_plugin_domain)
 358 files_read_etc_files(munin_plugin_domain)
 359 files_read_usr_files(munin_plugin_domain)
 360
 361 fs_getattr_all_fs(munin_plugin_domain)
 362
 363 miscfiles_read_localization(munin_plugin_domain)