Add selinux policy (first draft)

refs #8332

diff --git a/tools/selinux/icinga2.fc b/tools/selinux/icinga2.fc
new file mode 100644 (file)
index 0000000..b958ab9
--- /dev/null
+++ b/tools/selinux/icinga2.fc
@@ -0,0 +1,11 @@
+/etc/rc\.d/init\.d/icinga2     --      gen_context(system_u:object_r:icinga2_initrc_exec_t,s0)
+
+/usr/sbin/icinga2              --      gen_context(system_u:object_r:icinga2_exec_t,s0)
+
+/var/lib/icinga2(/.*)?         gen_context(system_u:object_r:icinga2_var_lib_t,s0)
+
+/var/log/icinga2(/.*)?         gen_context(system_u:object_r:icinga2_log_t,s0)
+
+/var/run/icinga2(/.*)?         gen_context(system_u:object_r:icinga2_var_run_t,s0)
+
+/var/run/icinga2/cmd(/.*)?     gen_context(system_u:object_r:icinga2_command_t,s0)

diff --git a/tools/selinux/icinga2.if b/tools/selinux/icinga2.if
new file mode 100644 (file)
index 0000000..6885f6e
--- /dev/null
+++ b/tools/selinux/icinga2.if
@@ -0,0 +1,245 @@
+
+## <summary>policy for icinga2</summary>
+
+########################################
+## <summary>
+##     Execute TEMPLATE in the icinga2 domin.
+## </summary>
+## <param name="domain">
+## <summary>
+##     Domain allowed to transition.
+## </summary>
+## </param>
+#
+interface(`icinga2_domtrans',`
+       gen_require(`
+               type icinga2_t, icinga2_exec_t;
+       ')
+
+       corecmd_search_bin($1)
+       domtrans_pattern($1, icinga2_exec_t, icinga2_t)
+')
+
+########################################
+## <summary>
+##     Execute icinga2 server in the icinga2 domain.
+## </summary>
+## <param name="domain">
+##     <summary>
+##     Domain allowed access.
+##     </summary>
+## </param>
+#
+interface(`icinga2_initrc_domtrans',`
+       gen_require(`
+               type icinga2_initrc_exec_t;
+       ')
+
+       init_labeled_script_domtrans($1, icinga2_initrc_exec_t)
+')
+########################################
+## <summary>
+##     Read icinga2's log files.
+## </summary>
+## <param name="domain">
+##     <summary>
+##     Domain allowed access.
+##     </summary>
+## </param>
+## <rolecap/>
+#
+interface(`icinga2_read_log',`
+       gen_require(`
+               type icinga2_log_t;
+       ')
+
+       logging_search_logs($1)
+       read_files_pattern($1, icinga2_log_t, icinga2_log_t)
+')
+
+########################################
+## <summary>
+##     Append to icinga2 log files.
+## </summary>
+## <param name="domain">
+##     <summary>
+##     Domain allowed access.
+##     </summary>
+## </param>
+#
+interface(`icinga2_append_log',`
+       gen_require(`
+               type icinga2_log_t;
+       ')
+
+       logging_search_logs($1)
+       append_files_pattern($1, icinga2_log_t, icinga2_log_t)
+')
+
+########################################
+## <summary>
+##     Manage icinga2 log files
+## </summary>
+## <param name="domain">
+##     <summary>
+##     Domain allowed access.
+##     </summary>
+## </param>
+#
+interface(`icinga2_manage_log',`
+       gen_require(`
+               type icinga2_log_t;
+       ')
+
+       logging_search_logs($1)
+       manage_dirs_pattern($1, icinga2_log_t, icinga2_log_t)
+       manage_files_pattern($1, icinga2_log_t, icinga2_log_t)
+       manage_lnk_files_pattern($1, icinga2_log_t, icinga2_log_t)
+')
+
+########################################
+## <summary>
+##     Search icinga2 lib directories.
+## </summary>
+## <param name="domain">
+##     <summary>
+##     Domain allowed access.
+##     </summary>
+## </param>
+#
+interface(`icinga2_search_lib',`
+       gen_require(`
+               type icinga2_var_lib_t;
+       ')
+
+       allow $1 icinga2_var_lib_t:dir search_dir_perms;
+       files_search_var_lib($1)
+')
+
+########################################
+## <summary>
+##     Read icinga2 lib files.
+## </summary>
+## <param name="domain">
+##     <summary>
+##     Domain allowed access.
+##     </summary>
+## </param>
+#
+interface(`icinga2_read_lib_files',`
+       gen_require(`
+               type icinga2_var_lib_t;
+       ')
+
+       files_search_var_lib($1)
+       read_files_pattern($1, icinga2_var_lib_t, icinga2_var_lib_t)
+')
+
+########################################
+## <summary>
+##     Manage icinga2 lib files.
+## </summary>
+## <param name="domain">
+##     <summary>
+##     Domain allowed access.
+##     </summary>
+## </param>
+#
+interface(`icinga2_manage_lib_files',`
+       gen_require(`
+               type icinga2_var_lib_t;
+       ')
+
+       files_search_var_lib($1)
+       manage_files_pattern($1, icinga2_var_lib_t, icinga2_var_lib_t)
+')
+
+########################################
+## <summary>
+##     Manage icinga2 lib directories.
+## </summary>
+## <param name="domain">
+##     <summary>
+##     Domain allowed access.
+##     </summary>
+## </param>
+#
+interface(`icinga2_manage_lib_dirs',`
+       gen_require(`
+               type icinga2_var_lib_t;
+       ')
+
+       files_search_var_lib($1)
+       manage_dirs_pattern($1, icinga2_var_lib_t, icinga2_var_lib_t)
+')
+
+
+########################################
+## <summary>
+##     All of the rules required to administrate
+##     an icinga2 environment
+## </summary>
+## <param name="domain">
+##     <summary>
+##     Domain allowed access.
+##     </summary>
+## </param>
+## <param name="role">
+##     <summary>
+##     Role allowed access.
+##     </summary>
+## </param>
+## <rolecap/>
+#
+interface(`icinga2_admin',`
+       gen_require(`
+               type icinga2_t;
+               type icinga2_initrc_exec_t;
+               type icinga2_log_t;
+               type icinga2_var_lib_t;
+       ')
+
+       allow $1 icinga2_t:process { signal_perms };
+       ps_process_pattern($1, icinga2_t)
+
+    tunable_policy(`deny_ptrace',`',`
+        allow $1 icinga2_t:process ptrace;
+    ')
+
+       icinga2_initrc_domtrans($1)
+       domain_system_change_exemption($1)
+       role_transition $2 icinga2_initrc_exec_t system_r;
+       allow $2 system_r;
+
+       logging_search_logs($1)
+       admin_pattern($1, icinga2_log_t)
+
+       files_search_var_lib($1)
+       admin_pattern($1, icinga2_var_lib_t)
+       optional_policy(`
+               systemd_passwd_agent_exec($1)
+               systemd_read_fifo_file_passwd_run($1)
+       ')
+')
+
+########################################
+### <summary>
+###      Send icinga2 commands through pipe
+### </summary>
+### <param name="domain">
+###      <summary>
+###      Domain allowed to send commands.
+###      </summary>
+### </param>
+#
+interface(`icinga2_send_commands',`
+       gen_require(`
+               type icinga2_var_run_t;
+       ')
+
+       files_search_pids($1)
+       read_files_pattern($1, icinga2_var_run_t, icinga2_var_run_t)
+       read_files_pattern($1, icina2_command_t, icinga2_command_t)
+       write_fifo_files_pattern($1, icinga2_command_t, icinga2_command_t)
+')
+

diff --git a/tools/selinux/icinga2.sh b/tools/selinux/icinga2.sh
new file mode 100755 (executable)
index 0000000..d9a8aa7
--- /dev/null
+++ b/tools/selinux/icinga2.sh
@@ -0,0 +1,58 @@
+#!/bin/sh -e
+
+DIRNAME=`dirname $0`
+cd $DIRNAME
+USAGE="$0 [ --update ]"
+if [ `id -u` != 0 ]; then
+echo 'You must be root to run this script'
+exit 1
+fi
+
+if [ $# -eq 1 ]; then
+       if [ "$1" = "--update" ] ; then
+               time=`ls -l --time-style="+%x %X" icinga2.te | awk '{ printf "%s %s", $6, $7 }'`
+               rules=`ausearch --start $time -m avc --raw -se icinga2`
+               if [ x"$rules" != "x" ] ; then
+                       echo "Found avc's to update policy with"
+                       echo -e "$rules" | audit2allow -R
+                       echo "Do you want these changes added to policy [y/n]?"
+                       read ANS
+                       if [ "$ANS" = "y" -o "$ANS" = "Y" ] ; then
+                               echo "Updating policy"
+                               echo -e "$rules" | audit2allow -R >> icinga2.te
+                               # Fall though and rebuild policy
+                       else
+                               exit 0
+                       fi
+               else
+                       echo "No new avcs found"
+                       exit 0
+               fi
+       else
+               echo -e $USAGE
+               exit 1
+       fi
+elif [ $# -ge 2 ] ; then
+       echo -e $USAGE
+       exit 1
+fi
+
+echo "Building and Loading Policy"
+set -x
+make -f /usr/share/selinux/devel/Makefile icinga2.pp || exit
+/usr/sbin/semodule -i icinga2.pp
+
+# Generate a man page off the installed module
+sepolicy manpage -p . -d icinga2_t
+# Fixing the file context on /usr/sbin/icinga2
+/sbin/restorecon -F -R -v /usr/sbin/icinga2
+# Fixing the file context on /etc/rc\.d/init\.d/icinga2
+/sbin/restorecon -F -R -v /etc/rc\.d/init\.d/icinga2
+# Fixing the file context on /var/log/icinga2
+/sbin/restorecon -F -R -v /var/log/icinga2
+# Fixing the file context on /var/lib/icinga2
+/sbin/restorecon -F -R -v /var/lib/icinga2
+# Generate a rpm package for the newly generated policy
+
+pwd=$(pwd)
+rpmbuild --define "_sourcedir ${pwd}" --define "_specdir ${pwd}" --define "_builddir ${pwd}" --define "_srcrpmdir ${pwd}" --define "_rpmdir ${pwd}" --define "_buildrootdir ${pwd}/.build"  -ba icinga2_selinux.spec

diff --git a/tools/selinux/icinga2.te b/tools/selinux/icinga2.te
new file mode 100644 (file)
index 0000000..531212f
--- /dev/null
+++ b/tools/selinux/icinga2.te
@@ -0,0 +1,62 @@
+policy_module(icinga2, 0.1.0)
+
+########################################
+#
+# Declarations
+#
+
+type icinga2_t;
+type icinga2_exec_t;
+init_daemon_domain(icinga2_t, icinga2_exec_t)
+
+permissive icinga2_t;
+
+type icinga2_initrc_exec_t;
+init_script_file(icinga2_initrc_exec_t)
+
+type icinga2_log_t;
+logging_log_file(icinga2_log_t)
+
+type icinga2_var_lib_t;
+files_type(icinga2_var_lib_t)
+
+type icinga2_command_t;
+files_type(icinga2_command_t)
+
+type icinga2_var_run_t;
+files_pid_file(icinga2_var_run_t)
+
+########################################
+#
+# icinga2 local policy
+#
+allow icinga2_t self:capability { setgid setuid };
+allow icinga2_t self:fifo_file rw_fifo_file_perms;
+allow icinga2_t self:unix_stream_socket create_stream_socket_perms;
+
+manage_dirs_pattern(icinga2_t, icinga2_log_t, icinga2_log_t)
+manage_files_pattern(icinga2_t, icinga2_log_t, icinga2_log_t)
+manage_lnk_files_pattern(icinga2_t, icinga2_log_t, icinga2_log_t)
+logging_log_filetrans(icinga2_t, icinga2_log_t, { dir file lnk_file })
+
+manage_dirs_pattern(icinga2_t, icinga2_var_lib_t, icinga2_var_lib_t)
+manage_files_pattern(icinga2_t, icinga2_var_lib_t, icinga2_var_lib_t)
+manage_lnk_files_pattern(icinga2_t, icinga2_var_lib_t, icinga2_var_lib_t)
+files_var_lib_filetrans(icinga2_t, icinga2_var_lib_t, { dir file lnk_file })
+
+manage_dirs_pattern(icinga2_t, icinga2_var_run_t, icinga2_var_run_t)
+manage_files_pattern(icinga2_t, icinga2_var_run_t, icinga2_var_run_t)
+files_pid_filetrans(icinga2_t, icinga2_var_run_t, { dir file })
+
+manage_dirs_pattern(icinga2_t, icinga2_command_t, icinga2_command_t)
+manage_files_pattern(icinga2_t, icinga2_command_t, icinga2_command_t)
+manage_fifo_files_pattern(icinga2_t, icinga2_command_t, icinga2_command_t)
+
+
+domain_use_interactive_fds(icinga2_t)
+
+files_read_etc_files(icinga2_t)
+
+auth_use_nsswitch(icinga2_t)
+
+miscfiles_read_localization(icinga2_t)