## policy for icinga2
########################################
##
## Execute TEMPLATE in the icinga2 domin.
##
##
##
## Domain allowed to transition.
##
##
#
interface(`icinga2_domtrans',`
gen_require(`
type icinga2_t, icinga2_exec_t;
')
corecmd_search_bin($1)
domtrans_pattern($1, icinga2_exec_t, icinga2_t)
')
########################################
##
## Execute icinga2 server in the icinga2 domain.
##
##
##
## Domain allowed access.
##
##
#
interface(`icinga2_initrc_domtrans',`
gen_require(`
type icinga2_initrc_exec_t;
')
init_labeled_script_domtrans($1, icinga2_initrc_exec_t)
')
########################################
##
## Read icinga2's log files.
##
##
##
## Domain allowed access.
##
##
##
#
interface(`icinga2_read_log',`
gen_require(`
type icinga2_log_t;
')
logging_search_logs($1)
read_files_pattern($1, icinga2_log_t, icinga2_log_t)
')
########################################
##
## Append to icinga2 log files.
##
##
##
## Domain allowed access.
##
##
#
interface(`icinga2_append_log',`
gen_require(`
type icinga2_log_t;
')
logging_search_logs($1)
append_files_pattern($1, icinga2_log_t, icinga2_log_t)
')
########################################
##
## Manage icinga2 log files
##
##
##
## Domain allowed access.
##
##
#
interface(`icinga2_manage_log',`
gen_require(`
type icinga2_log_t;
')
logging_search_logs($1)
manage_dirs_pattern($1, icinga2_log_t, icinga2_log_t)
manage_files_pattern($1, icinga2_log_t, icinga2_log_t)
manage_lnk_files_pattern($1, icinga2_log_t, icinga2_log_t)
')
########################################
##
## Search icinga2 lib directories.
##
##
##
## Domain allowed access.
##
##
#
interface(`icinga2_search_lib',`
gen_require(`
type icinga2_var_lib_t;
')
allow $1 icinga2_var_lib_t:dir search_dir_perms;
files_search_var_lib($1)
')
########################################
##
## Read icinga2 lib files.
##
##
##
## Domain allowed access.
##
##
#
interface(`icinga2_read_lib_files',`
gen_require(`
type icinga2_var_lib_t;
')
files_search_var_lib($1)
read_files_pattern($1, icinga2_var_lib_t, icinga2_var_lib_t)
')
########################################
##
## Manage icinga2 lib files.
##
##
##
## Domain allowed access.
##
##
#
interface(`icinga2_manage_lib_files',`
gen_require(`
type icinga2_var_lib_t;
')
files_search_var_lib($1)
manage_files_pattern($1, icinga2_var_lib_t, icinga2_var_lib_t)
')
########################################
##
## Manage icinga2 lib directories.
##
##
##
## Domain allowed access.
##
##
#
interface(`icinga2_manage_lib_dirs',`
gen_require(`
type icinga2_var_lib_t;
')
files_search_var_lib($1)
manage_dirs_pattern($1, icinga2_var_lib_t, icinga2_var_lib_t)
')
########################################
##
## All of the rules required to administrate
## an icinga2 environment
##
##
##
## Domain allowed access.
##
##
##
##
## Role allowed access.
##
##
##
#
interface(`icinga2_admin',`
gen_require(`
type icinga2_t;
type icinga2_initrc_exec_t;
type icinga2_log_t;
type icinga2_var_lib_t;
')
allow $1 icinga2_t:process { signal_perms };
ps_process_pattern($1, icinga2_t)
tunable_policy(`deny_ptrace',`',`
allow $1 icinga2_t:process ptrace;
')
icinga2_initrc_domtrans($1)
domain_system_change_exemption($1)
role_transition $2 icinga2_initrc_exec_t system_r;
allow $2 system_r;
logging_search_logs($1)
admin_pattern($1, icinga2_log_t)
files_search_var_lib($1)
admin_pattern($1, icinga2_var_lib_t)
optional_policy(`
systemd_passwd_agent_exec($1)
systemd_read_fifo_file_passwd_run($1)
')
')
########################################
###
### Send icinga2 commands through pipe
###
###
###
### Domain allowed to send commands.
###
###
#
interface(`icinga2_send_commands',`
gen_require(`
type icinga2_var_run_t;
')
files_search_pids($1)
read_files_pattern($1, icinga2_var_run_t, icinga2_var_run_t)
read_files_pattern($1, icinga2_command_t, icinga2_command_t)
write_fifo_files_pattern($1, icinga2_command_t, icinga2_command_t)
')
########################################
##
## For domains icinga should transition to (e.g. Plugins).
##
##
##
## Context of the executable.
##
##
##
##
## Domain icinga should transition to.
##
##
#
interface(`icinga2_execstrans',`
gen_require(`
type icinga2_t;
')
domtrans_pattern(icinga2_t, $1, $2)
')
######################################
##
## Dontaudit read and write an leaked file descriptors
##
##
##
## Domain to not audit.
##
##
#
interface(`icinga2_dontaudit_leaks_fifo',`
gen_require(`
type icinga2_t;
')
dontaudit $1 icinga2_t:fifo_file write;
')