diff --git a/policy/modules/kernel/corenetwork.te.in b/policy/modules/kernel/corenetwork.te.in index f4937b971..fb5dd13bc 100644 --- a/policy/modules/kernel/corenetwork.te.in +++ b/policy/modules/kernel/corenetwork.te.in @@ -224,6 +224,7 @@ network_port(xfs, tcp,7100,s0) network_port(xserver, tcp,6000-6020,s0) network_port(zarafa, tcp,236,s0, tcp,237,s0) network_port(zabbix, tcp,10051,s0) +network_port(zabbix_agent, tcp,10050,s0) network_port(zookeeper_client, tcp,2181,s0) network_port(zookeeper_election, tcp,3888,s0) network_port(zookeeper_leader, tcp,2888,s0) diff --git a/policy/modules/services/zabbix.if b/policy/modules/services/zabbix.if index d77e631f4..e1cc9b5b9 100644 --- a/policy/modules/services/zabbix.if +++ b/policy/modules/services/zabbix.if @@ -77,6 +77,27 @@ interface(`zabbix_read_pid_files',` allow $1 zabbix_var_run_t:file read_file_perms; ') +######################################## +## +## Allow connectivity to the zabbix server +## +## +## +## Domain allowed access. +## +## +# +interface(`zabbix_tcp_connect',` + gen_require(` + type zabbix_t; + ') + + corenet_sendrecv_zabbix_agent_packets($1) + corenet_tcp_connect_zabbix_port($1) + corenet_tcp_recvfrom_labeled($1, zabbix_t) + corenet_tcp_sendrecv_zabbix_port($1) +') + ######################################## ## ## All of the rules required to administrate diff --git a/policy/modules/services/zabbix.te b/policy/modules/services/zabbix.te index ac77dcb5d..bfdcc41f1 100644 --- a/policy/modules/services/zabbix.te +++ b/policy/modules/services/zabbix.te @@ -97,6 +97,9 @@ manage_files_pattern(zabbix_agent_t, zabbix_log_t, zabbix_log_t) manage_files_pattern(zabbix_agent_t, zabbix_var_run_t, zabbix_var_run_t) files_pid_filetrans(zabbix_agent_t, zabbix_var_run_t, file) +# Network access to zabbix server +zabbix_tcp_connect(zabbix_agent_t) + # Shared Memory support rw_files_pattern(zabbix_agent_t, zabbix_tmpfs_t, zabbix_tmpfs_t) fs_tmpfs_filetrans(zabbix_agent_t, zabbix_tmpfs_t, file) @@ -104,3 +107,7 @@ fs_tmpfs_filetrans(zabbix_agent_t, zabbix_tmpfs_t, file) ## Kernel layer module calls ## System layer module calls + +# sysnetwork module +sysnet_dns_name_resolve(zabbix_agent_t) +