Chris PeBenito 0fbfa5
#DESC MRTG - Network traffic graphing
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
# Author:  Russell Coker <russell@coker.com.au>
Chris PeBenito 0fbfa5
# X-Debian-Packages: mrtg
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
#################################
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
# Rules for the mrtg_t domain.
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
# mrtg_exec_t is the type of the mrtg executable.
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
daemon_base_domain(mrtg)
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
allow mrtg_t fs_t:filesystem getattr;
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
ifdef(`crond.te', `
Chris PeBenito 0fbfa5
system_crond_entry(mrtg_exec_t, mrtg_t)
Chris PeBenito 0fbfa5
allow system_crond_t mrtg_log_t:dir rw_dir_perms;
Chris PeBenito 0fbfa5
allow system_crond_t mrtg_log_t:file { create append getattr };
Chris PeBenito 0fbfa5
')
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
allow mrtg_t usr_t:{ file lnk_file } { getattr read };
Chris PeBenito 0fbfa5
dontaudit mrtg_t usr_t:file ioctl;
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
logdir_domain(mrtg)
Chris PeBenito 0fbfa5
etcdir_domain(mrtg)
Chris PeBenito 0fbfa5
typealias mrtg_etc_t alias etc_mrtg_t;
Chris PeBenito 2705f9
type mrtg_var_lib_t, file_type, sysadmfile;
Chris PeBenito 2705f9
typealias mrtg_var_lib_t alias var_lib_mrtg_t;
Chris PeBenito 0fbfa5
type mrtg_lock_t, file_type, sysadmfile, lockfile;
Chris PeBenito 0fbfa5
r_dir_file(mrtg_t, lib_t)
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# Use the network.
Chris PeBenito 0fbfa5
can_network_client(mrtg_t)
Chris PeBenito 2705f9
allow mrtg_t port_type:tcp_socket name_connect;
Chris PeBenito 0fbfa5
can_ypbind(mrtg_t)
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
allow mrtg_t self:fifo_file { getattr read write ioctl };
Chris PeBenito 0fbfa5
allow mrtg_t { admin_tty_type devtty_t }:chr_file rw_file_perms;
Chris PeBenito 0fbfa5
allow mrtg_t urandom_device_t:chr_file { getattr read };
Chris PeBenito 0fbfa5
allow mrtg_t self:unix_stream_socket create_socket_perms;
Chris PeBenito 0fbfa5
ifdef(`apache.te', `
Chris PeBenito 0fbfa5
rw_dir_create_file(mrtg_t, httpd_sys_content_t)
Chris PeBenito 0fbfa5
')
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
can_exec(mrtg_t, { shell_exec_t bin_t sbin_t })
Chris PeBenito 0fbfa5
allow mrtg_t { bin_t sbin_t }:dir { getattr search };
Chris PeBenito 0fbfa5
allow mrtg_t bin_t:lnk_file read;
Chris PeBenito 0fbfa5
allow mrtg_t var_t:dir { getattr search };
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
ifdef(`snmpd.te', `
Chris PeBenito 0fbfa5
can_udp_send(mrtg_t, snmpd_t)
Chris PeBenito 0fbfa5
can_udp_send(snmpd_t, mrtg_t)
Chris PeBenito 0fbfa5
r_dir_file(mrtg_t, snmpd_var_lib_t)
Chris PeBenito 0fbfa5
')
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
allow mrtg_t proc_net_t:dir search;
Chris PeBenito 0fbfa5
allow mrtg_t { proc_t proc_net_t }:file { read getattr };
Chris PeBenito 0fbfa5
dontaudit mrtg_t proc_t:file ioctl;
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
allow mrtg_t { var_lock_t var_lib_t }:dir search;
Chris PeBenito 2705f9
rw_dir_create_file(mrtg_t, mrtg_var_lib_t)
Chris PeBenito 0fbfa5
rw_dir_create_file(mrtg_t, mrtg_lock_t)
Chris PeBenito 0fbfa5
ifdef(`distro_redhat', `
Chris PeBenito 0fbfa5
file_type_auto_trans(mrtg_t, mrtg_etc_t, mrtg_lock_t, file)
Chris PeBenito 0fbfa5
')
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# read config files
Chris PeBenito 0fbfa5
allow mrtg_t etc_t:file { read getattr };
Chris PeBenito 0fbfa5
dontaudit mrtg_t mrtg_etc_t:dir write;
Chris PeBenito 0fbfa5
dontaudit mrtg_t mrtg_etc_t:file { write ioctl };
Chris PeBenito 0fbfa5
read_locale(mrtg_t)
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# for /.autofsck
Chris PeBenito 0fbfa5
dontaudit mrtg_t root_t:file getattr;
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
dontaudit mrtg_t security_t:dir getattr;
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
read_sysctl(mrtg_t)
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# for uptime
Chris PeBenito 0fbfa5
allow mrtg_t var_run_t:dir search;
Chris PeBenito 2705f9
allow mrtg_t initrc_var_run_t:file { getattr read };
Chris PeBenito 0fbfa5
dontaudit mrtg_t initrc_var_run_t:file { write lock };
Chris PeBenito 0fbfa5
allow mrtg_t etc_runtime_t:file { getattr read };
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
allow mrtg_t tmp_t:dir getattr;
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# should not need this!
Chris PeBenito 0fbfa5
dontaudit mrtg_t { staff_home_dir_t sysadm_home_dir_t }:dir { search read getattr };
Chris PeBenito 0fbfa5
dontaudit mrtg_t { boot_t device_t file_t lost_found_t }:dir getattr;
Chris PeBenito 0fbfa5
ifdef(`quota.te', `
Chris PeBenito 0fbfa5
dontaudit mrtg_t quota_db_t:file getattr;
Chris PeBenito 0fbfa5
')
Chris PeBenito 0fbfa5
dontaudit mrtg_t root_t:lnk_file getattr;
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
allow mrtg_t self:capability { setgid setuid };
Chris PeBenito 2705f9
ifdef(`hostname.te', `can_exec(mrtg_t, hostname_exec_t)')
Chris PeBenito 0fbfa5
allow mrtg_t var_spool_t:dir search;