diff --git a/policy/modules/services/smokeping.fc b/policy/modules/services/smokeping.fc new file mode 100644 index 000000000..c79e02341 --- /dev/null +++ b/policy/modules/services/smokeping.fc @@ -0,0 +1,11 @@ +/etc/rc\.d/init\.d/smokeping -- gen_context(system_u:object_r:smokeping_initrc_exec_t,s0) + +/usr/sbin/smokeping -- gen_context(system_u:object_r:smokeping_exec_t,s0) + +/usr/share/smokeping/cgi(/.*)? gen_context(system_u:object_r:httpd_smokeping_cgi_script_exec_t,s0) + +/var/lib/smokeping(/.*)? gen_context(system_u:object_r:smokeping_var_lib_t,s0) + +/var/run/smokeping(/.*)? gen_context(system_u:object_r:smokeping_var_run_t,s0) + + diff --git a/policy/modules/services/smokeping.if b/policy/modules/services/smokeping.if new file mode 100644 index 000000000..4e5e18b5a --- /dev/null +++ b/policy/modules/services/smokeping.if @@ -0,0 +1,168 @@ + +## policy for smokeping + +######################################## +## +## Execute a domain transition to run smokeping. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`smokeping_domtrans',` + gen_require(` + type smokeping_t, smokeping_exec_t; + ') + + domtrans_pattern($1, smokeping_exec_t, smokeping_t) +') + +######################################## +## +## Execute smokeping server in the smokeping domain. +## +## +## +## Domain allowed access. +## +## +# +interface(`smokeping_initrc_domtrans',` + gen_require(` + type smokeping_initrc_exec_t; + ') + + init_labeled_script_domtrans($1, smokeping_initrc_exec_t) +') + +######################################## +## +## Read smokeping PID files. +## +## +## +## Domain allowed access. +## +## +# +interface(`smokeping_read_pid_files',` + gen_require(` + type smokeping_var_run_t; + ') + + files_search_pids($1) + allow $1 smokeping_var_run_t:file read_file_perms; +') + +######################################## +## +## Manage smokeping PID files. +## +## +## +## Domain allowed access. +## +## +# +interface(`smokeping_manage_pid_files',` + gen_require(` + type smokeping_var_run_t; + ') + + files_search_pids($1) + manage_files_pattern($1, smokeping_var_run_t, smokeping_var_run_t) +') + +######################################## +## +## Get attributes of smokeping lib files. +## +## +## +## Domain allowed access. +## +## +# +interface(`smokeping_getattr_lib_files',` + gen_require(` + type smokeping_var_lib_t; + ') + + getattr_files_pattern($1, smokeping_var_lib_t, smokeping_var_lib_t) + files_search_var_lib($1) +') + +######################################## +## +## Read smokeping lib files. +## +## +## +## Domain allowed access. +## +## +# +interface(`smokeping_read_lib_files',` + gen_require(` + type smokeping_var_lib_t; + ') + + files_search_var_lib($1) + read_files_pattern($1, smokeping_var_lib_t, smokeping_var_lib_t) +') + +######################################## +## +## Manage smokeping lib files. +## +## +## +## Domain allowed access. +## +## +# +interface(`smokeping_manage_lib_files',` + gen_require(` + type smokeping_var_lib_t; + ') + + files_search_var_lib($1) + manage_files_pattern($1, smokeping_var_lib_t, smokeping_var_lib_t) +') + +######################################## +## +## All of the rules required to administrate +## a smokeping environment +## +## +## +## Domain allowed access. +## +## +## +## +## Role allowed access. +## +## +## +# +interface(`smokeping_admin',` + gen_require(` + type smokeping_t, smokeping_initrc_exec_t; + ') + + allow $1 smokeping_t:process { ptrace signal_perms }; + ps_process_pattern($1, smokeping_t) + + smokeping_initrc_domtrans($1) + domain_system_change_exemption($1) + role_transition $2 smokeping_initrc_exec_t system_r; + allow $2 system_r; + + smokeping_manage_pid_files($1) + + smokeping_manage_lib_files($1) +') diff --git a/policy/modules/services/smokeping.te b/policy/modules/services/smokeping.te new file mode 100644 index 000000000..c311a16f7 --- /dev/null +++ b/policy/modules/services/smokeping.te @@ -0,0 +1,75 @@ + +policy_module(smokeping,1.0.0) + +######################################## +# +# Declarations +# + +type smokeping_t; +type smokeping_exec_t; +init_daemon_domain(smokeping_t, smokeping_exec_t) + +type smokeping_initrc_exec_t; +init_script_file(smokeping_initrc_exec_t) + +type smokeping_var_run_t; +files_pid_file(smokeping_var_run_t) + +type smokeping_var_lib_t; +files_type(smokeping_var_lib_t) + +######################################## +# +# smokeping local policy +# + +allow smokeping_t self:fifo_file rw_fifo_file_perms; +allow smokeping_t self:udp_socket create_socket_perms; +allow smokeping_t self:unix_stream_socket create_stream_socket_perms; + +manage_dirs_pattern(smokeping_t, smokeping_var_run_t, smokeping_var_run_t) +manage_files_pattern(smokeping_t, smokeping_var_run_t, smokeping_var_run_t) +files_pid_filetrans(smokeping_t, smokeping_var_run_t, { file dir }) + +manage_dirs_pattern(smokeping_t, smokeping_var_lib_t, smokeping_var_lib_t) +manage_files_pattern(smokeping_t, smokeping_var_lib_t, smokeping_var_lib_t) +files_var_lib_filetrans(smokeping_t, smokeping_var_lib_t, { file dir } ) + +corecmd_read_bin_symlinks(smokeping_t) + +dev_read_urand(smokeping_t) + +files_read_etc_files(smokeping_t) +files_read_usr_files(smokeping_t) +files_search_tmp(smokeping_t) + +auth_use_nsswitch(smokeping_t) + +logging_send_syslog_msg(smokeping_t) + +miscfiles_read_localization(smokeping_t) + +mta_send_mail(smokeping_t) + +netutils_domtrans_ping(smokeping_t) + +####################################### +# +# local policy for smokeping cgi scripts +# + +optional_policy(` + apache_content_template(smokeping_cgi) + + allow httpd_smokeping_cgi_script_t self:udp_socket create_socket_perms; + + manage_files_pattern(httpd_smokeping_cgi_script_t, smokeping_var_lib_t, smokeping_var_lib_t) + + getattr_files_pattern(httpd_smokeping_cgi_script_t, smokeping_var_run_t, smokeping_var_run_t) + + files_search_tmp(httpd_smokeping_cgi_script_t) + files_search_var_lib(httpd_smokeping_cgi_script_t) + + sysnet_dns_name_resolve(httpd_smokeping_cgi_script_t) +')