granicus.if.org Git - icinga2/blob - tools/selinux/icinga2.if

   1
   2 ## <summary>policy for icinga2</summary>
   3
   4 ########################################
   5 ## <summary>
   6 ##      Execute TEMPLATE in the icinga2 domin.
   7 ## </summary>
   8 ## <param name="domain">
   9 ## <summary>
  10 ##      Domain allowed to transition.
  11 ## </summary>
  12 ## </param>
  13 #
  14 interface(`icinga2_domtrans',`
  15         gen_require(`
  16                 type icinga2_t, icinga2_exec_t;
  17         ')
  18
  19         corecmd_search_bin($1)
  20         domtrans_pattern($1, icinga2_exec_t, icinga2_t)
  21 ')
  22
  23 ########################################
  24 ## <summary>
  25 ##      Execute icinga2 server in the icinga2 domain.
  26 ## </summary>
  27 ## <param name="domain">
  28 ##      <summary>
  29 ##      Domain allowed access.
  30 ##      </summary>
  31 ## </param>
  32 #
  33 interface(`icinga2_initrc_domtrans',`
  34         gen_require(`
  35                 type icinga2_initrc_exec_t;
  36         ')
  37
  38         init_labeled_script_domtrans($1, icinga2_initrc_exec_t)
  39 ')
  40 ########################################
  41 ## <summary>
  42 ##      Read icinga2's log files.
  43 ## </summary>
  44 ## <param name="domain">
  45 ##      <summary>
  46 ##      Domain allowed access.
  47 ##      </summary>
  48 ## </param>
  49 ## <rolecap/>
  50 #
  51 interface(`icinga2_read_log',`
  52         gen_require(`
  53                 type icinga2_log_t;
  54         ')
  55
  56         logging_search_logs($1)
  57         read_files_pattern($1, icinga2_log_t, icinga2_log_t)
  58 ')
  59
  60 ########################################
  61 ## <summary>
  62 ##      Append to icinga2 log files.
  63 ## </summary>
  64 ## <param name="domain">
  65 ##      <summary>
  66 ##      Domain allowed access.
  67 ##      </summary>
  68 ## </param>
  69 #
  70 interface(`icinga2_append_log',`
  71         gen_require(`
  72                 type icinga2_log_t;
  73         ')
  74
  75         logging_search_logs($1)
  76         append_files_pattern($1, icinga2_log_t, icinga2_log_t)
  77 ')
  78
  79 ########################################
  80 ## <summary>
  81 ##      Manage icinga2 log files
  82 ## </summary>
  83 ## <param name="domain">
  84 ##      <summary>
  85 ##      Domain allowed access.
  86 ##      </summary>
  87 ## </param>
  88 #
  89 interface(`icinga2_manage_log',`
  90         gen_require(`
  91                 type icinga2_log_t;
  92         ')
  93
  94         logging_search_logs($1)
  95         manage_dirs_pattern($1, icinga2_log_t, icinga2_log_t)
  96         manage_files_pattern($1, icinga2_log_t, icinga2_log_t)
  97         manage_lnk_files_pattern($1, icinga2_log_t, icinga2_log_t)
  98 ')
  99
 100 ########################################
 101 ## <summary>
 102 ##      Search icinga2 lib directories.
 103 ## </summary>
 104 ## <param name="domain">
 105 ##      <summary>
 106 ##      Domain allowed access.
 107 ##      </summary>
 108 ## </param>
 109 #
 110 interface(`icinga2_search_lib',`
 111         gen_require(`
 112                 type icinga2_var_lib_t;
 113         ')
 114
 115         allow $1 icinga2_var_lib_t:dir search_dir_perms;
 116         files_search_var_lib($1)
 117 ')
 118
 119 ########################################
 120 ## <summary>
 121 ##      Read icinga2 lib files.
 122 ## </summary>
 123 ## <param name="domain">
 124 ##      <summary>
 125 ##      Domain allowed access.
 126 ##      </summary>
 127 ## </param>
 128 #
 129 interface(`icinga2_read_lib_files',`
 130         gen_require(`
 131                 type icinga2_var_lib_t;
 132         ')
 133
 134         files_search_var_lib($1)
 135         read_files_pattern($1, icinga2_var_lib_t, icinga2_var_lib_t)
 136 ')
 137
 138 ########################################
 139 ## <summary>
 140 ##      Manage icinga2 lib files.
 141 ## </summary>
 142 ## <param name="domain">
 143 ##      <summary>
 144 ##      Domain allowed access.
 145 ##      </summary>
 146 ## </param>
 147 #
 148 interface(`icinga2_manage_lib_files',`
 149         gen_require(`
 150                 type icinga2_var_lib_t;
 151         ')
 152
 153         files_search_var_lib($1)
 154         manage_files_pattern($1, icinga2_var_lib_t, icinga2_var_lib_t)
 155 ')
 156
 157 ########################################
 158 ## <summary>
 159 ##      Manage icinga2 lib directories.
 160 ## </summary>
 161 ## <param name="domain">
 162 ##      <summary>
 163 ##      Domain allowed access.
 164 ##      </summary>
 165 ## </param>
 166 #
 167 interface(`icinga2_manage_lib_dirs',`
 168         gen_require(`
 169                 type icinga2_var_lib_t;
 170         ')
 171
 172         files_search_var_lib($1)
 173         manage_dirs_pattern($1, icinga2_var_lib_t, icinga2_var_lib_t)
 174 ')
 175
 176
 177 ########################################
 178 ## <summary>
 179 ##      All of the rules required to administrate
 180 ##      an icinga2 environment
 181 ## </summary>
 182 ## <param name="domain">
 183 ##      <summary>
 184 ##      Domain allowed access.
 185 ##      </summary>
 186 ## </param>
 187 ## <param name="role">
 188 ##      <summary>
 189 ##      Role allowed access.
 190 ##      </summary>
 191 ## </param>
 192 ## <rolecap/>
 193 #
 194 interface(`icinga2_admin',`
 195         gen_require(`
 196                 type icinga2_t;
 197                 type icinga2_initrc_exec_t;
 198                 type icinga2_log_t;
 199                 type icinga2_var_lib_t;
 200         ')
 201
 202         allow $1 icinga2_t:process { signal_perms };
 203         ps_process_pattern($1, icinga2_t)
 204
 205     tunable_policy(`deny_ptrace',`',`
 206         allow $1 icinga2_t:process ptrace;
 207     ')
 208
 209         icinga2_initrc_domtrans($1)
 210         domain_system_change_exemption($1)
 211         role_transition $2 icinga2_initrc_exec_t system_r;
 212         allow $2 system_r;
 213
 214         logging_search_logs($1)
 215         admin_pattern($1, icinga2_log_t)
 216
 217         files_search_var_lib($1)
 218         admin_pattern($1, icinga2_var_lib_t)
 219         optional_policy(`
 220                 systemd_passwd_agent_exec($1)
 221                 systemd_read_fifo_file_passwd_run($1)
 222         ')
 223 ')
 224
 225 ########################################
 226 ### <summary>
 227 ###      Send icinga2 commands through pipe
 228 ### </summary>
 229 ### <param name="domain">
 230 ###      <summary>
 231 ###      Domain allowed to send commands.
 232 ###      </summary>
 233 ### </param>
 234 #
 235 interface(`icinga2_send_commands',`
 236         gen_require(`
 237                 type icinga2_var_run_t;
 238         ')
 239
 240         files_search_pids($1)
 241         read_files_pattern($1, icinga2_var_run_t, icinga2_var_run_t)
 242         read_files_pattern($1, icina2_command_t, icinga2_command_t)
 243         write_fifo_files_pattern($1, icinga2_command_t, icinga2_command_t)
 244 ')
 245