#DESC Net Saint / NAGIOS - network monitoring server

#

# Author:  Russell Coker <russell@coker.com.au>

# X-Debian-Packages: netsaint, nagios

# Depends: mta.te

#

#################################

#

# Rules for the nagios_t domain.

#

# nagios_exec_t is the type of the netsaint/nagios executable.

#

daemon_domain(nagios, `, privmail')

etcdir_domain(nagios)

typealias nagios_etc_t alias etc_nagios_t;

logdir_domain(nagios)

allow nagios_t nagios_log_t:fifo_file create_file_perms;

allow initrc_t nagios_log_t:dir rw_dir_perms;

tmp_domain(nagios)

allow system_mail_t nagios_tmp_t:file { getattr read };

# for open file handles

dontaudit system_mail_t nagios_etc_t:file read;

dontaudit system_mail_t nagios_log_t:fifo_file read;

# Use the network.

allow nagios_t self:fifo_file rw_file_perms;

allow nagios_t self:unix_stream_socket create_socket_perms;

allow nagios_t self:unix_dgram_socket create_socket_perms;

# Use capabilities

allow nagios_t self:capability { dac_override setgid setuid };

allow nagios_t self:process setpgid;

allow nagios_t { bin_t sbin_t }:dir search;

allow nagios_t bin_t:lnk_file read;

can_exec(nagios_t, { shell_exec_t bin_t })

allow nagios_t proc_t:file { getattr read };

can_network_server(nagios_t)

can_ypbind(nagios_t)

# read config files

allow nagios_t { etc_t etc_runtime_t }:file { getattr read };

allow nagios_t etc_t:lnk_file read;

allow nagios_t etc_t:dir r_dir_perms;

# for ps

r_dir_file(nagios_t, domain)

allow nagios_t boot_t:dir search;

allow nagios_t system_map_t:file { getattr read };

# for who

allow nagios_t initrc_var_run_t:file { getattr read lock };

system_domain(nagios_cgi)

allow nagios_cgi_t device_t:dir search;

r_dir_file(nagios_cgi_t, nagios_etc_t)

allow nagios_cgi_t var_log_t:dir search;

r_dir_file(nagios_cgi_t, nagios_log_t)

allow nagios_cgi_t self:process { fork signal_perms };

allow nagios_cgi_t self:fifo_file rw_file_perms;

allow nagios_cgi_t bin_t:dir search;

can_exec(nagios_cgi_t, bin_t)

read_locale(nagios_cgi_t)

# for ps

allow nagios_cgi_t { etc_runtime_t etc_t }:file { getattr read };

r_dir_file(nagios_cgi_t, { proc_t self nagios_t })

allow nagios_cgi_t boot_t:dir search;

allow nagios_cgi_t system_map_t:file { getattr read };

dontaudit nagios_cgi_t domain:dir getattr;

allow nagios_cgi_t self:unix_stream_socket create_socket_perms;

ifdef(`apache.te', `

r_dir_file(httpd_t, nagios_etc_t)

domain_auto_trans({ httpd_t httpd_suexec_t }, nagios_cgi_exec_t, nagios_cgi_t)

allow nagios_cgi_t httpd_log_t:file append;

')

ifdef(`ping.te', `

domain_auto_trans(nagios_t, ping_exec_t, ping_t)

allow nagios_t ping_t:process { sigkill signal };

dontaudit ping_t nagios_etc_t:file read;

dontaudit ping_t nagios_log_t:fifo_file read;

')