remove unuse files
(cherry picked from commit ee6622a6d544268ab32e59ba782a75c835f9ddf9)
This commit is contained in:
cherry530
openeuler-sync-bot
parent
f598154a8c
commit
7224d23b6d
@ -1,7 +1,8 @@
|
|||||||
diff -up ./Makefile.in.install_config ./Makefile.in
|
diff --git a/Makefile.in b/Makefile.in
|
||||||
--- ./Makefile.in.install_config 2017-04-19 19:11:47.783707415 -0400
|
index b992ab1e..ef2a797f 100644
|
||||||
+++ ./Makefile.in 2017-04-19 19:11:47.785707384 -0400
|
--- a/Makefile.in
|
||||||
@@ -377,7 +377,7 @@ dox:
|
+++ b/Makefile.in
|
||||||
|
@@ -439,7 +439,7 @@ dox:
|
||||||
doxygen doxy.conf
|
doxygen doxy.conf
|
||||||
|
|
||||||
|
|
||||||
|
|||||||
@ -264,9 +264,9 @@ diff -up ./startup/default-service.in.fix_localstatedir ./startup/default-servic
|
|||||||
ExecStop=@BIN_KILL@ -s TERM ${MAINPID}
|
ExecStop=@BIN_KILL@ -s TERM ${MAINPID}
|
||||||
-ExecStopPost=@BIN_RM@ -f @localstatedir@/rw/nagios.cmd
|
-ExecStopPost=@BIN_RM@ -f @localstatedir@/rw/nagios.cmd
|
||||||
+ExecStopPost=@BIN_RM@ -f @localstatedir@/spool/nagios/cmd/nagios.cmd
|
+ExecStopPost=@BIN_RM@ -f @localstatedir@/spool/nagios/cmd/nagios.cmd
|
||||||
|
ExecReload=@bindir@/nagios -v @sysconfdir@/nagios.cfg
|
||||||
ExecReload=@BIN_KILL@ -s HUP ${MAINPID}
|
ExecReload=@BIN_KILL@ -s HUP ${MAINPID}
|
||||||
|
|
||||||
[Install]
|
|
||||||
diff -up ./t-tap/Makefile.in.fix_localstatedir ./t-tap/Makefile.in
|
diff -up ./t-tap/Makefile.in.fix_localstatedir ./t-tap/Makefile.in
|
||||||
--- ./t-tap/Makefile.in.fix_localstatedir 2019-01-16 14:24:14.944312569 -0600
|
--- ./t-tap/Makefile.in.fix_localstatedir 2019-01-16 14:24:14.944312569 -0600
|
||||||
+++ ./t-tap/Makefile.in 2019-01-16 14:24:42.359858604 -0600
|
+++ ./t-tap/Makefile.in 2019-01-16 14:24:42.359858604 -0600
|
||||||
|
|||||||
@ -1,6 +1,6 @@
|
|||||||
diff -up ./cgi/extinfo.c.rm_youtube ./cgi/extinfo.c
|
diff -up ./cgi/extinfo.c.remove_3rdparty_links ./cgi/extinfo.c
|
||||||
--- ./cgi/extinfo.c.rm_youtube 2018-11-28 14:23:47.609805066 -0600
|
--- ./cgi/extinfo.c.remove_3rdparty_links 2019-08-20 15:29:34.000000000 +0000
|
||||||
+++ ./cgi/extinfo.c 2018-11-28 14:28:35.513997180 -0600
|
+++ ./cgi/extinfo.c 2019-08-29 18:17:32.321544245 +0000
|
||||||
@@ -557,27 +557,6 @@ void document_header(int use_stylesheet)
|
@@ -557,27 +557,6 @@ void document_header(int use_stylesheet)
|
||||||
printf("<LINK REL='stylesheet' TYPE='text/css' HREF='%s%s'>\n", url_stylesheets_path, NAGFUNCS_CSS);
|
printf("<LINK REL='stylesheet' TYPE='text/css' HREF='%s%s'>\n", url_stylesheets_path, NAGFUNCS_CSS);
|
||||||
}
|
}
|
||||||
@ -29,10 +29,10 @@ diff -up ./cgi/extinfo.c.rm_youtube ./cgi/extinfo.c
|
|||||||
printf("</head>\n");
|
printf("</head>\n");
|
||||||
|
|
||||||
printf("<body CLASS='extinfo'>\n");
|
printf("<body CLASS='extinfo'>\n");
|
||||||
diff -up ./cgi/status.c.rm_youtube ./cgi/status.c
|
diff -up ./cgi/status.c.remove_3rdparty_links ./cgi/status.c
|
||||||
--- ./cgi/status.c.rm_youtube 2018-11-28 14:28:56.072653859 -0600
|
--- ./cgi/status.c.remove_3rdparty_links 2019-08-20 15:29:34.000000000 +0000
|
||||||
+++ ./cgi/status.c 2018-11-28 14:32:05.038498204 -0600
|
+++ ./cgi/status.c 2019-08-29 18:17:32.322544264 +0000
|
||||||
@@ -537,31 +537,8 @@ void document_header(int use_stylesheet)
|
@@ -555,31 +555,8 @@ void document_header(int use_stylesheet)
|
||||||
/* JS function to append content to elements on page */
|
/* JS function to append content to elements on page */
|
||||||
printf("<script type='text/javascript'>\n");
|
printf("<script type='text/javascript'>\n");
|
||||||
if (enable_page_tour == TRUE) {
|
if (enable_page_tour == TRUE) {
|
||||||
@ -64,9 +64,9 @@ diff -up ./cgi/status.c.rm_youtube ./cgi/status.c
|
|||||||
printf("});\n");
|
printf("});\n");
|
||||||
}
|
}
|
||||||
printf("function set_limit(url) { \nthis.location = url+'&limit='+$('#limit').val();\n }\n");
|
printf("function set_limit(url) { \nthis.location = url+'&limit='+$('#limit').val();\n }\n");
|
||||||
diff -up ./cgi/tac.c.rm_youtube ./cgi/tac.c
|
diff -up ./cgi/tac.c.remove_3rdparty_links ./cgi/tac.c
|
||||||
--- ./cgi/tac.c.rm_youtube 2018-11-28 14:32:21.595221714 -0600
|
--- ./cgi/tac.c.remove_3rdparty_links 2019-08-20 15:29:34.000000000 +0000
|
||||||
+++ ./cgi/tac.c 2018-11-28 14:34:38.960927761 -0600
|
+++ ./cgi/tac.c 2019-08-29 18:17:32.323544284 +0000
|
||||||
@@ -308,17 +308,7 @@ void document_header(int use_stylesheet)
|
@@ -308,17 +308,7 @@ void document_header(int use_stylesheet)
|
||||||
|
|
||||||
if (enable_page_tour == TRUE) {
|
if (enable_page_tour == TRUE) {
|
||||||
@ -86,10 +86,10 @@ diff -up ./cgi/tac.c.rm_youtube ./cgi/tac.c
|
|||||||
|
|
||||||
|
|
||||||
|
|
||||||
diff -up ./html/main.php.rm_youtube ./html/main.php
|
diff -up ./html/main.php.remove_3rdparty_links ./html/main.php
|
||||||
--- ./html/main.php.rm_youtube 2018-11-28 14:34:59.249588949 -0600
|
--- ./html/main.php.remove_3rdparty_links 2019-08-20 15:29:34.000000000 +0000
|
||||||
+++ ./html/main.php 2018-11-28 14:39:03.703506666 -0600
|
+++ ./html/main.php 2019-08-29 18:20:16.216716704 +0000
|
||||||
@@ -19,20 +19,7 @@ $this_year = '2018';
|
@@ -19,20 +19,7 @@ $this_year = '2019';
|
||||||
|
|
||||||
<script type='text/javascript'>
|
<script type='text/javascript'>
|
||||||
var cookie;
|
var cookie;
|
||||||
@ -100,7 +100,7 @@ diff -up ./html/main.php.rm_youtube ./html/main.php
|
|||||||
- "Click here to watch the entire Nagios Core 4 Tour!</a>";
|
- "Click here to watch the entire Nagios Core 4 Tour!</a>";
|
||||||
- <?php } ?>
|
- <?php } ?>
|
||||||
$(document).ready(function() {
|
$(document).ready(function() {
|
||||||
- var user = "<?php echo $_SERVER['REMOTE_USER']; ?>";
|
- var user = "<?php echo htmlspecialchars($_SERVER['REMOTE_USER']); ?>";
|
||||||
-
|
-
|
||||||
- <?php if ($cfg["enable_page_tour"]) { ?>
|
- <?php if ($cfg["enable_page_tour"]) { ?>
|
||||||
- vBoxId += ";" + user;
|
- vBoxId += ";" + user;
|
||||||
@ -110,7 +110,7 @@ diff -up ./html/main.php.rm_youtube ./html/main.php
|
|||||||
loadRemoteFeed( // Our top banner splash.
|
loadRemoteFeed( // Our top banner splash.
|
||||||
'#splashbox0-contents', 'corebanner', 1,
|
'#splashbox0-contents', 'corebanner', 1,
|
||||||
'', processBannerItem, ''
|
'', processBannerItem, ''
|
||||||
@@ -59,7 +46,6 @@ $this_year = '2018';
|
@@ -59,7 +46,6 @@ $this_year = '2019';
|
||||||
crossDomain: true,
|
crossDomain: true,
|
||||||
success: function(d, status, jqXHR) {
|
success: function(d, status, jqXHR) {
|
||||||
// We should have Internet access, set the playlist HTML.
|
// We should have Internet access, set the playlist HTML.
|
||||||
@ -118,7 +118,7 @@ diff -up ./html/main.php.rm_youtube ./html/main.php
|
|||||||
|
|
||||||
var text = ''; // Start with empty text by default.
|
var text = ''; // Start with empty text by default.
|
||||||
|
|
||||||
@@ -94,19 +80,6 @@ $this_year = '2018';
|
@@ -94,19 +80,6 @@ $this_year = '2019';
|
||||||
: '';
|
: '';
|
||||||
}
|
}
|
||||||
|
|
||||||
@ -138,9 +138,9 @@ diff -up ./html/main.php.rm_youtube ./html/main.php
|
|||||||
// Get the daemon status JSON.
|
// Get the daemon status JSON.
|
||||||
function getCoreStatus() {
|
function getCoreStatus() {
|
||||||
setCoreStatusHTML('passiveonly', 'Checking process status...');
|
setCoreStatusHTML('passiveonly', 'Checking process status...');
|
||||||
diff -up ./html/map.php.rm_youtube ./html/map.php
|
diff -up ./html/map.php.remove_3rdparty_links ./html/map.php
|
||||||
--- ./html/map.php.rm_youtube 2018-11-28 14:39:16.895286368 -0600
|
--- ./html/map.php.remove_3rdparty_links 2019-08-29 18:17:32.324544303 +0000
|
||||||
+++ ./html/map.php 2018-11-28 14:40:05.311477837 -0600
|
+++ ./html/map.php 2019-08-29 18:20:48.488341376 +0000
|
||||||
@@ -71,22 +71,6 @@
|
@@ -71,22 +71,6 @@
|
||||||
<script type="text/javascript" src="js/jquery-1.12.4.min.js"></script>
|
<script type="text/javascript" src="js/jquery-1.12.4.min.js"></script>
|
||||||
<script type="text/javascript" src="js/nag_funcs.js"></script>
|
<script type="text/javascript" src="js/nag_funcs.js"></script>
|
||||||
@ -152,7 +152,7 @@ diff -up ./html/map.php.rm_youtube ./html/map.php
|
|||||||
- var vboxText = "<a href=https://www.nagios.com/tours target=_blank>" +
|
- var vboxText = "<a href=https://www.nagios.com/tours target=_blank>" +
|
||||||
- "Click here to watch the entire Nagios Core 4 Tour!</a>";
|
- "Click here to watch the entire Nagios Core 4 Tour!</a>";
|
||||||
- $(document).ready(function() {
|
- $(document).ready(function() {
|
||||||
- var user = "<?php echo $_SERVER['REMOTE_USER']; ?>";
|
- var user = "<?php echo htmlspecialchars($_SERVER['REMOTE_USER']); ?>";
|
||||||
-
|
-
|
||||||
- vBoxId += ";" + user;
|
- vBoxId += ";" + user;
|
||||||
- vbox = new vidbox({pos:'lr',vidurl:'https://www.youtube.com/embed/leaRdb3BElI',
|
- vbox = new vidbox({pos:'lr',vidurl:'https://www.youtube.com/embed/leaRdb3BElI',
|
||||||
|
|||||||
@ -1,13 +1,16 @@
|
|||||||
diff -up ./contrib/Makefile.in.remove_rpmbuild ./contrib/Makefile.in
|
diff --git a/contrib/Makefile.in b/contrib/Makefile.in
|
||||||
--- ./contrib/Makefile.in.remove_rpmbuild 2019-01-16 15:00:18.627548108 -0600
|
index 72e4d4a9..62415152 100644
|
||||||
+++ ./contrib/Makefile.in 2019-01-16 15:00:38.756215308 -0600
|
--- a/contrib/Makefile.in
|
||||||
@@ -84,35 +84,3 @@ $(CGI_O): $(CGI_C)
|
+++ b/contrib/Makefile.in
|
||||||
|
@@ -84,52 +84,3 @@ $(CGI_O): $(CGI_C)
|
||||||
|
|
||||||
%.cgi : %.c
|
%.cgi : %.c
|
||||||
$(CC) $(CFLAGS) $(LDFLAGS) $< $(CGI_O) -o $@
|
$(CC) $(CFLAGS) $(LDFLAGS) $< $(CGI_O) -o $@
|
||||||
-
|
-
|
||||||
-##############################################################################
|
-##############################################################################
|
||||||
-# rpm making automation for CentOS/RHEL.
|
-# making similiar EPEL rpm for Fedora/RHEL/CentOS
|
||||||
|
-
|
||||||
|
-ifneq ("$(wildcard /etc/redhat-release)","")
|
||||||
-
|
-
|
||||||
-ARCH ?= $(shell uname -m)
|
-ARCH ?= $(shell uname -m)
|
||||||
-ifeq ($(ARCH),x86_64)
|
-ifeq ($(ARCH),x86_64)
|
||||||
@ -24,16 +27,31 @@ diff -up ./contrib/Makefile.in.remove_rpmbuild ./contrib/Makefile.in
|
|||||||
- endif
|
- endif
|
||||||
-endif
|
-endif
|
||||||
-
|
-
|
||||||
-rpm:
|
-# Create our own tarball and put ino rpmbuild/SOURCES
|
||||||
|
-localsrc-rpm:
|
||||||
- # create nagios tar ball.
|
- # create nagios tar ball.
|
||||||
- @(cd ..;rm -f nagios-@VERSION@)
|
- @(cd ..;rm -f nagios-@VERSION@)
|
||||||
- @(cd ..;ln -s . nagios-@VERSION@)
|
- @(cd ..;ln -s . nagios-@VERSION@)
|
||||||
- @(cd ..;tar zhcf nagios-@VERSION@.tar.gz --exclude nagios-@VERSION@/nagios-@VERSION@.tar.gz --exclude nagios-@VERSION@/nagios-@VERSION@ --exclude RCS --exclude CVS --exclude build-* --exclude *~ --exclude .git* nagios-@VERSION@/)
|
- @(cd ..;tar zhcf nagios-@VERSION@.tar.gz --exclude nagios-@VERSION@/nagios-@VERSION@.tar.gz --exclude nagios-@VERSION@/nagios-@VERSION@ --exclude RCS --exclude CVS --exclude build-* --exclude *~ --exclude .git* nagios-@VERSION@/)
|
||||||
- @(cd ..;rm -f nagios-@VERSION@)
|
- @(cd ..;rm -f nagios-@VERSION@)
|
||||||
- # build the rpm using rpmbuild from ./rmbuild as topdir
|
- # build the rpm using rpmbuild from ./rmbuild as topdir
|
||||||
- @rm -rf rpmbuild && mkdir -p rpmbuild/SOURCES
|
- @rm -rf rpmbuild && mkdir -p ./rpmbuild/{BUILD,RPMS,SOURCES,SPECS,SRPMS}
|
||||||
- @cp ../nagios-@VERSION@.tar.gz rpmbuild/SOURCES/nagios-@VERSION@.tar.gz
|
- @cp ../nagios-@VERSION@.tar.gz rpmbuild/SOURCES/nagios-@VERSION@.tar.gz
|
||||||
- @rpmbuild -ba --define "_topdir ${PWD}/rpmbuild" ../nagios.spec
|
- @cp epel-patches/* ./rpmbuild/SOURCES
|
||||||
- @mv rpmbuild/RPMS/$(RPM_ARCH)/*.rpm .
|
- @rpmbuild -ba --define "_topdir ${PWD}/rpmbuild" epel-nagios.spec
|
||||||
|
- @cp rpmbuild/RPMS/$(RPM_ARCH)/*.rpm .
|
||||||
|
- @cp rpmbuild/SRPMS/*.src.rpm .
|
||||||
- @ls -l *.rpm
|
- @ls -l *.rpm
|
||||||
-
|
-
|
||||||
|
-# tarball from https://github.com/NagiosEnterprises/nagioscore/releases/download/nagios-%{version}/nagios-%{version}.tar.gz
|
||||||
|
-rpm: init-epelrpm build-epelrpm
|
||||||
|
- @mv rpmbuild/RPMS/$(RPM_ARCH)/*.rpm .
|
||||||
|
- @ls -l *.rpm
|
||||||
|
-init-epelrpm:
|
||||||
|
- # build the rpm using rpmbuild from ./rmbuild as topdir
|
||||||
|
- @rm -rf ./rpmbuild && mkdir -p ./rpmbuild/{BUILD,RPMS,SOURCES,SPECS,SRPMS}
|
||||||
|
- @spectool -C ./rpmbuild/SOURCES -g epel-nagios.spec
|
||||||
|
- @cp epel-patches/* ./rpmbuild/SOURCES
|
||||||
|
-build-epelrpm:
|
||||||
|
- @rpmbuild -ba --define "_topdir ${PWD}/rpmbuild" epel-nagios.spec
|
||||||
|
-endif
|
||||||
|
|||||||
13
nagios-0015-Changelog.patch
Normal file
13
nagios-0015-Changelog.patch
Normal file
@ -0,0 +1,13 @@
|
|||||||
|
diff --git a/Changelog b/Changelog
|
||||||
|
index a5fd04c6..51394645 100644
|
||||||
|
--- a/Changelog
|
||||||
|
+++ b/Changelog
|
||||||
|
@@ -9,7 +9,7 @@ FIXES
|
||||||
|
* Fixed duplicate properties appearing in statusjson.cgi (#718) (Sebastian Wolf)
|
||||||
|
* Fixed NERD not building when enabled in ./configure (#723) (Sebastian Wolf)
|
||||||
|
* Fixed build process when using GCC 10 (#721) (Michael Orlitzky)
|
||||||
|
-* Fixed postauth vulnerabilities in histogram.js, map.js, trends.js (CVE-2020-1408) (Thanks UraSec Team) (Sebastian Wolf)
|
||||||
|
+* Fixed postauth vulnerabilities in histogram.js, map.js, trends.js (CVE-2020-13977) (Thanks UraSec Team) (Sebastian Wolf)
|
||||||
|
* When using systemd, configuration will be verified before reloading (#715) (tatref)
|
||||||
|
* Fixed HARD OK states triggering on the maximum check attempt (#757) (Sebastian Wolf)
|
||||||
|
|
||||||
@ -1,39 +0,0 @@
|
|||||||
--- ./xdata/xsddefault.c.xiugai 2021-08-03 16:18:47.678788632 +0800
|
|
||||||
+++ ./xdata/xsddefault.c 2021-08-03 16:19:25.719135981 +0800
|
|
||||||
@@ -38,22 +38,22 @@
|
|
||||||
|
|
||||||
#ifdef NSCGI
|
|
||||||
#include "../include/cgiutils.h"
|
|
||||||
-time_t program_start;
|
|
||||||
-int daemon_mode;
|
|
||||||
-time_t last_log_rotation;
|
|
||||||
-int enable_notifications;
|
|
||||||
-int execute_service_checks;
|
|
||||||
-int accept_passive_service_checks;
|
|
||||||
-int execute_host_checks;
|
|
||||||
-int accept_passive_host_checks;
|
|
||||||
-int enable_event_handlers;
|
|
||||||
-int obsess_over_services;
|
|
||||||
-int obsess_over_hosts;
|
|
||||||
+extern time_t program_start;
|
|
||||||
+extern int daemon_mode;
|
|
||||||
+extern time_t last_log_rotation;
|
|
||||||
+extern int enable_notifications;
|
|
||||||
+extern int execute_service_checks;
|
|
||||||
+extern int accept_passive_service_checks;
|
|
||||||
+extern int execute_host_checks;
|
|
||||||
+extern int accept_passive_host_checks;
|
|
||||||
+extern int enable_event_handlers;
|
|
||||||
+extern int obsess_over_services;
|
|
||||||
+extern int obsess_over_hosts;
|
|
||||||
int check_service_freshness;
|
|
||||||
int check_host_freshness;
|
|
||||||
-int enable_flap_detection;
|
|
||||||
-int process_performance_data;
|
|
||||||
-int nagios_pid;
|
|
||||||
+extern int enable_flap_detection;
|
|
||||||
+extern int process_performance_data;
|
|
||||||
+extern int nagios_pid;
|
|
||||||
int buffer_stats[1][3];
|
|
||||||
int program_stats[MAX_CHECK_STATS_TYPES][3];
|
|
||||||
#endif
|
|
||||||
Binary file not shown.
114
nagios.fc
Normal file
114
nagios.fc
Normal file
@ -0,0 +1,114 @@
|
|||||||
|
/etc/nagios(/.*)? gen_context(system_u:object_r:nagios_etc_t,s0)
|
||||||
|
/etc/icinga(/.*)? gen_context(system_u:object_r:nagios_etc_t,s0)
|
||||||
|
/etc/nagios/nrpe\.cfg -- gen_context(system_u:object_r:nrpe_etc_t,s0)
|
||||||
|
/etc/nrpe\.d(/.*)? gen_context(system_u:object_r:nrpe_etc_t,s0)
|
||||||
|
/etc/pnp4nagios(/.*)? gen_context(system_u:object_r:nagios_etc_t,s0)
|
||||||
|
/etc/rc\.d/init\.d/nagios -- gen_context(system_u:object_r:nagios_initrc_exec_t,s0)
|
||||||
|
/etc/rc\.d/init\.d/nrpe -- gen_context(system_u:object_r:nagios_initrc_exec_t,s0)
|
||||||
|
|
||||||
|
|
||||||
|
/usr/bin/nagios -- gen_context(system_u:object_r:nagios_exec_t,s0)
|
||||||
|
/usr/bin/icinga -- gen_context(system_u:object_r:nagios_exec_t,s0)
|
||||||
|
/usr/bin/nrpe -- gen_context(system_u:object_r:nrpe_exec_t,s0)
|
||||||
|
|
||||||
|
/usr/sbin/nagios -- gen_context(system_u:object_r:nagios_exec_t,s0)
|
||||||
|
/usr/sbin/icinga -- gen_context(system_u:object_r:nagios_exec_t,s0)
|
||||||
|
/usr/sbin/nrpe -- gen_context(system_u:object_r:nrpe_exec_t,s0)
|
||||||
|
|
||||||
|
/usr/lib/cgi-bin/netsaint(/.*)? gen_context(system_u:object_r:nagios_script_exec_t,s0)
|
||||||
|
/usr/lib/nagios/cgi(/.*)? gen_context(system_u:object_r:nagios_script_exec_t,s0)
|
||||||
|
/usr/lib/icinga/cgi(/.*)? gen_context(system_u:object_r:nagios_script_exec_t,s0)
|
||||||
|
|
||||||
|
/var/log/nagios(/.*)? gen_context(system_u:object_r:nagios_log_t,s0)
|
||||||
|
/var/log/icinga(/.*)? gen_context(system_u:object_r:nagios_log_t,s0)
|
||||||
|
/var/log/netsaint(/.*)? gen_context(system_u:object_r:nagios_log_t,s0)
|
||||||
|
/var/log/pnp4nagios(/.*)? gen_context(system_u:object_r:nagios_log_t,s0)
|
||||||
|
|
||||||
|
/var/lib/pnp4nagios(/.*)? gen_context(system_u:object_r:nagios_var_lib_t,s0)
|
||||||
|
|
||||||
|
/var/run/nagios.* gen_context(system_u:object_r:nagios_var_run_t,s0)
|
||||||
|
|
||||||
|
/var/spool/nagios(/.*)? gen_context(system_u:object_r:nagios_spool_t,s0)
|
||||||
|
/var/spool/icinga(/.*)? gen_context(system_u:object_r:nagios_spool_t,s0)
|
||||||
|
|
||||||
|
ifdef(`distro_debian',`
|
||||||
|
/usr/sbin/nagios -- gen_context(system_u:object_r:nagios_exec_t,s0)
|
||||||
|
')
|
||||||
|
/usr/lib/cgi-bin/nagios(/.+)? gen_context(system_u:object_r:nagios_script_exec_t,s0)
|
||||||
|
/usr/lib/nagios/cgi-bin(/.*)? gen_context(system_u:object_r:nagios_script_exec_t,s0)
|
||||||
|
|
||||||
|
# admin plugins
|
||||||
|
/usr/lib/nagios/plugins/check_file_age -- gen_context(system_u:object_r:nagios_admin_plugin_exec_t,s0)
|
||||||
|
|
||||||
|
# check disk plugins
|
||||||
|
/usr/lib/nagios/plugins/check_disk -- gen_context(system_u:object_r:nagios_checkdisk_plugin_exec_t,s0)
|
||||||
|
/usr/lib/nagios/plugins/check_disk_smb -- gen_context(system_u:object_r:nagios_checkdisk_plugin_exec_t,s0)
|
||||||
|
/usr/lib/nagios/plugins/check_ide_smart -- gen_context(system_u:object_r:nagios_checkdisk_plugin_exec_t,s0)
|
||||||
|
/usr/lib/nagios/plugins/check_linux_raid -- gen_context(system_u:object_r:nagios_checkdisk_plugin_exec_t,s0)
|
||||||
|
|
||||||
|
# mail plugins
|
||||||
|
/usr/lib/nagios/plugins/check_mailq -- gen_context(system_u:object_r:nagios_mail_plugin_exec_t,s0)
|
||||||
|
|
||||||
|
/usr/lib/pnp4nagios(/.*)? gen_context(system_u:object_r:nagios_var_lib_t,s0)
|
||||||
|
|
||||||
|
# system plugins
|
||||||
|
/usr/lib(64)?/nagios/plugins/check_breeze -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0)
|
||||||
|
/usr/lib(64)?/nagios/plugins/check_dummy -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0)
|
||||||
|
/usr/lib(64)?/nagios/plugins/check_flexlm -- gen_context(system_u:object_r:nagios_system_plugin_exec_t,s0)
|
||||||
|
/usr/lib(64)?/nagios/plugins/check_ifoperstatus -- gen_context(system_u:object_r:nagios_system_plugin_exec_t,s0)
|
||||||
|
/usr/lib(64)?/nagios/plugins/check_ifstatus -- gen_context(system_u:object_r:nagios_system_plugin_exec_t,s0)
|
||||||
|
/usr/lib(64)?/nagios/plugins/check_load -- gen_context(system_u:object_r:nagios_system_plugin_exec_t,s0)
|
||||||
|
/usr/lib(64)?/nagios/plugins/check_log -- gen_context(system_u:object_r:nagios_system_plugin_exec_t,s0)
|
||||||
|
/usr/lib(64)?/nagios/plugins/check_mrtg -- gen_context(system_u:object_r:nagios_system_plugin_exec_t,s0)
|
||||||
|
/usr/lib(64)?/nagios/plugins/check_mrtgtraf -- gen_context(system_u:object_r:nagios_system_plugin_exec_t,s0)
|
||||||
|
/usr/lib(64)?/nagios/plugins/check_nagios -- gen_context(system_u:object_r:nagios_system_plugin_exec_t,s0)
|
||||||
|
/usr/lib(64)?/nagios/plugins/check_nwstat -- gen_context(system_u:object_r:nagios_system_plugin_exec_t,s0)
|
||||||
|
/usr/lib(64)?/nagios/plugins/check_overcr -- gen_context(system_u:object_r:nagios_system_plugin_exec_t,s0)
|
||||||
|
/usr/lib(64)?/nagios/plugins/check_procs -- gen_context(system_u:object_r:nagios_system_plugin_exec_t,s0)
|
||||||
|
/usr/lib(64)?/nagios/plugins/check_sensors -- gen_context(system_u:object_r:nagios_system_plugin_exec_t,s0)
|
||||||
|
/usr/lib(64)?/nagios/plugins/check_swap -- gen_context(system_u:object_r:nagios_system_plugin_exec_t,s0)
|
||||||
|
/usr/lib(64)?/nagios/plugins/check_users -- gen_context(system_u:object_r:nagios_system_plugin_exec_t,s0)
|
||||||
|
/usr/lib(64)?/nagios/plugins/check_wave -- gen_context(system_u:object_r:nagios_system_plugin_exec_t,s0)
|
||||||
|
|
||||||
|
# services plugins
|
||||||
|
/usr/lib(64)?/nagios/plugins/check_cluster -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0)
|
||||||
|
/usr/lib(64)?/nagios/plugins/check_dhcp -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0)
|
||||||
|
/usr/lib(64)?/nagios/plugins/check_dig -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0)
|
||||||
|
/usr/lib(64)?/nagios/plugins/check_dns -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0)
|
||||||
|
/usr/lib(64)?/nagios/plugins/check_game -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0)
|
||||||
|
/usr/lib(64)?/nagios/plugins/check_fping -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0)
|
||||||
|
/usr/lib(64)?/nagios/plugins/check_hpjd -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0)
|
||||||
|
/usr/lib(64)?/nagios/plugins/check_http -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0)
|
||||||
|
/usr/lib(64)?/nagios/plugins/check_icmp -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0)
|
||||||
|
/usr/lib(64)?/nagios/plugins/check_ircd -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0)
|
||||||
|
/usr/lib(64)?/nagios/plugins/check_ldap -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0)
|
||||||
|
/usr/lib(64)?/nagios/plugins/check_mysql -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0)
|
||||||
|
/usr/lib(64)?/nagios/plugins/check_mysql_query -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0)
|
||||||
|
/usr/lib(64)?/nagios/plugins/check_nrpe -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0)
|
||||||
|
/usr/lib(64)?/nagios/plugins/check_nt -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0)
|
||||||
|
/usr/lib(64)?/nagios/plugins/check_ntp.* -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0)
|
||||||
|
/usr/lib(64)?/nagios/plugins/check_oracle -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0)
|
||||||
|
/usr/lib(64)?/nagios/plugins/check_pgsql -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0)
|
||||||
|
/usr/lib(64)?/nagios/plugins/check_ping -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0)
|
||||||
|
/usr/lib(64)?/nagios/plugins/check_radius -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0)
|
||||||
|
/usr/lib(64)?/nagios/plugins/check_real -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0)
|
||||||
|
/usr/lib(64)?/nagios/plugins/check_rpc -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0)
|
||||||
|
/usr/lib(64)?/nagios/plugins/check_tcp -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0)
|
||||||
|
/usr/lib(64)?/nagios/plugins/check_time -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0)
|
||||||
|
/usr/lib(64)?/nagios/plugins/check_sip -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0)
|
||||||
|
/usr/lib(64)?/nagios/plugins/check_smtp -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0)
|
||||||
|
/usr/lib(64)?/nagios/plugins/check_snmp.* -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0)
|
||||||
|
/usr/lib(64)?/nagios/plugins/check_ssh -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0)
|
||||||
|
/usr/lib(64)?/nagios/plugins/check_ups -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0)
|
||||||
|
|
||||||
|
# openshift plugins
|
||||||
|
/usr/lib64/nagios/plugins/check_node_accept_status -- gen_context(system_u:object_r:nagios_openshift_plugin_exec_t,s0)
|
||||||
|
/usr/lib64/nagios/plugins/check_number_openshift_apps -- gen_context(system_u:object_r:nagios_openshift_plugin_exec_t,s0)
|
||||||
|
|
||||||
|
# label all nagios plugin as unconfined by default
|
||||||
|
/usr/lib/nagios/plugins/.* -- gen_context(system_u:object_r:nagios_unconfined_plugin_exec_t,s0)
|
||||||
|
|
||||||
|
# eventhandlers
|
||||||
|
/usr/lib/nagios/plugins/eventhandlers(/.*) gen_context(system_u:object_r:nagios_eventhandler_plugin_exec_t,s0)
|
||||||
|
/usr/lib/icinga/plugins/eventhandlers(/.*) gen_context(system_u:object_r:nagios_eventhandler_plugin_exec_t,s0)
|
||||||
|
|
||||||
367
nagios.if
Normal file
367
nagios.if
Normal file
@ -0,0 +1,367 @@
|
|||||||
|
## <summary>Net Saint / NAGIOS - network monitoring server</summary>
|
||||||
|
|
||||||
|
########################################
|
||||||
|
## <summary>
|
||||||
|
## Create a set of derived types for various
|
||||||
|
## nagios plugins,
|
||||||
|
## </summary>
|
||||||
|
## <param name="plugins_group_name">
|
||||||
|
## <summary>
|
||||||
|
## The name to be used for deriving type names.
|
||||||
|
## </summary>
|
||||||
|
## </param>
|
||||||
|
#
|
||||||
|
template(`nagios_plugin_template',`
|
||||||
|
gen_require(`
|
||||||
|
attribute nagios_plugin_domain;
|
||||||
|
type nagios_t, nrpe_t;
|
||||||
|
')
|
||||||
|
|
||||||
|
type nagios_$1_plugin_t, nagios_plugin_domain;
|
||||||
|
type nagios_$1_plugin_exec_t;
|
||||||
|
application_domain(nagios_$1_plugin_t, nagios_$1_plugin_exec_t)
|
||||||
|
role system_r types nagios_$1_plugin_t;
|
||||||
|
|
||||||
|
domtrans_pattern(nrpe_t, nagios_$1_plugin_exec_t, nagios_$1_plugin_t)
|
||||||
|
allow nagios_t nagios_$1_plugin_exec_t:file ioctl;
|
||||||
|
|
||||||
|
# needed by command.cfg
|
||||||
|
domtrans_pattern(nagios_t, nagios_$1_plugin_exec_t, nagios_$1_plugin_t)
|
||||||
|
|
||||||
|
kernel_read_system_state(nagios_$1_plugin_t)
|
||||||
|
|
||||||
|
')
|
||||||
|
|
||||||
|
########################################
|
||||||
|
## <summary>
|
||||||
|
## Execute the nagios unconfined plugins with
|
||||||
|
## a domain transition.
|
||||||
|
## </summary>
|
||||||
|
## <param name="domain">
|
||||||
|
## <summary>
|
||||||
|
## Domain allowed access.
|
||||||
|
## </summary>
|
||||||
|
## </param>
|
||||||
|
#
|
||||||
|
interface(`nagios_domtrans_unconfined_plugins',`
|
||||||
|
gen_require(`
|
||||||
|
type nagios_unconfined_plugin_t;
|
||||||
|
type nagios_unconfined_plugin_exec_t;
|
||||||
|
')
|
||||||
|
|
||||||
|
domtrans_pattern($1, nagios_unconfined_plugin_exec_t, nagios_unconfined_plugin_t)
|
||||||
|
')
|
||||||
|
|
||||||
|
########################################
|
||||||
|
## <summary>
|
||||||
|
## Do not audit attempts to read or write nagios
|
||||||
|
## unnamed pipes.
|
||||||
|
## </summary>
|
||||||
|
## <param name="domain">
|
||||||
|
## <summary>
|
||||||
|
## Domain to not audit.
|
||||||
|
## </summary>
|
||||||
|
## </param>
|
||||||
|
#
|
||||||
|
interface(`nagios_dontaudit_rw_pipes',`
|
||||||
|
gen_require(`
|
||||||
|
type nagios_t;
|
||||||
|
')
|
||||||
|
|
||||||
|
dontaudit $1 nagios_t:fifo_file rw_fifo_file_perms;
|
||||||
|
')
|
||||||
|
|
||||||
|
########################################
|
||||||
|
## <summary>
|
||||||
|
## Allow the specified domain to read
|
||||||
|
## nagios configuration files.
|
||||||
|
## </summary>
|
||||||
|
## <param name="domain">
|
||||||
|
## <summary>
|
||||||
|
## Domain allowed access.
|
||||||
|
## </summary>
|
||||||
|
## </param>
|
||||||
|
## <rolecap/>
|
||||||
|
#
|
||||||
|
interface(`nagios_read_config',`
|
||||||
|
gen_require(`
|
||||||
|
type nagios_etc_t;
|
||||||
|
')
|
||||||
|
|
||||||
|
allow $1 nagios_etc_t:dir list_dir_perms;
|
||||||
|
allow $1 nagios_etc_t:file read_file_perms;
|
||||||
|
files_search_etc($1)
|
||||||
|
')
|
||||||
|
######################################
|
||||||
|
## <summary>
|
||||||
|
## Read nagios lib files.
|
||||||
|
## </summary>
|
||||||
|
## <param name="domain">
|
||||||
|
## <summary>
|
||||||
|
## Domain allowed access.
|
||||||
|
## </summary>
|
||||||
|
## </param>
|
||||||
|
#
|
||||||
|
interface(`nagios_read_lib',`
|
||||||
|
gen_require(`
|
||||||
|
type nagios_var_lib_t;
|
||||||
|
')
|
||||||
|
|
||||||
|
files_search_var($1)
|
||||||
|
list_dirs_pattern($1, nagios_var_lib_t, nagios_var_lib_t)
|
||||||
|
read_files_pattern($1, nagios_var_lib_t, nagios_var_lib_t)
|
||||||
|
')
|
||||||
|
|
||||||
|
######################################
|
||||||
|
## <summary>
|
||||||
|
## Read nagios logs.
|
||||||
|
## </summary>
|
||||||
|
## <param name="domain">
|
||||||
|
## <summary>
|
||||||
|
## Domain allowed access.
|
||||||
|
## </summary>
|
||||||
|
## </param>
|
||||||
|
#
|
||||||
|
interface(`nagios_read_log',`
|
||||||
|
gen_require(`
|
||||||
|
type nagios_log_t;
|
||||||
|
')
|
||||||
|
|
||||||
|
logging_search_logs($1)
|
||||||
|
read_files_pattern($1, nagios_log_t, nagios_log_t)
|
||||||
|
')
|
||||||
|
|
||||||
|
########################################
|
||||||
|
## <summary>
|
||||||
|
## Do not audit attempts to read or write nagios logs.
|
||||||
|
## </summary>
|
||||||
|
## <param name="domain">
|
||||||
|
## <summary>
|
||||||
|
## Domain to not audit.
|
||||||
|
## </summary>
|
||||||
|
## </param>
|
||||||
|
#
|
||||||
|
interface(`nagios_dontaudit_rw_log',`
|
||||||
|
gen_require(`
|
||||||
|
type nagios_log_t;
|
||||||
|
')
|
||||||
|
|
||||||
|
dontaudit $1 nagios_log_t:file rw_file_perms;
|
||||||
|
')
|
||||||
|
|
||||||
|
########################################
|
||||||
|
## <summary>
|
||||||
|
## Search nagios spool directories.
|
||||||
|
## </summary>
|
||||||
|
## <param name="domain">
|
||||||
|
## <summary>
|
||||||
|
## Domain allowed access.
|
||||||
|
## </summary>
|
||||||
|
## </param>
|
||||||
|
#
|
||||||
|
interface(`nagios_search_spool',`
|
||||||
|
gen_require(`
|
||||||
|
type nagios_spool_t;
|
||||||
|
')
|
||||||
|
|
||||||
|
allow $1 nagios_spool_t:dir search_dir_perms;
|
||||||
|
files_search_spool($1)
|
||||||
|
')
|
||||||
|
|
||||||
|
########################################
|
||||||
|
## <summary>
|
||||||
|
## Append nagios spool files.
|
||||||
|
## </summary>
|
||||||
|
## <param name="domain">
|
||||||
|
## <summary>
|
||||||
|
## Domain allowed access.
|
||||||
|
## </summary>
|
||||||
|
## </param>
|
||||||
|
#
|
||||||
|
interface(`nagios_append_spool',`
|
||||||
|
gen_require(`
|
||||||
|
type nagios_spool_t;
|
||||||
|
')
|
||||||
|
|
||||||
|
allow $1 nagios_spool_t:file append_file_perms;
|
||||||
|
files_search_spool($1)
|
||||||
|
')
|
||||||
|
|
||||||
|
########################################
|
||||||
|
## <summary>
|
||||||
|
## Allow the specified domain to read
|
||||||
|
## nagios temporary files.
|
||||||
|
## </summary>
|
||||||
|
## <param name="domain">
|
||||||
|
## <summary>
|
||||||
|
## Domain allowed access.
|
||||||
|
## </summary>
|
||||||
|
## </param>
|
||||||
|
#
|
||||||
|
interface(`nagios_read_tmp_files',`
|
||||||
|
gen_require(`
|
||||||
|
type nagios_tmp_t;
|
||||||
|
')
|
||||||
|
|
||||||
|
allow $1 nagios_tmp_t:file read_file_perms;
|
||||||
|
files_search_tmp($1)
|
||||||
|
')
|
||||||
|
|
||||||
|
########################################
|
||||||
|
## <summary>
|
||||||
|
## Allow the specified domain to read
|
||||||
|
## nagios temporary files.
|
||||||
|
## </summary>
|
||||||
|
## <param name="domain">
|
||||||
|
## <summary>
|
||||||
|
## Domain allowed access.
|
||||||
|
## </summary>
|
||||||
|
## </param>
|
||||||
|
#
|
||||||
|
interface(`nagios_rw_inerited_tmp_files',`
|
||||||
|
gen_require(`
|
||||||
|
type nagios_tmp_t;
|
||||||
|
')
|
||||||
|
|
||||||
|
allow $1 nagios_tmp_t:file rw_inherited_file_perms;
|
||||||
|
files_search_tmp($1)
|
||||||
|
')
|
||||||
|
|
||||||
|
########################################
|
||||||
|
## <summary>
|
||||||
|
## Execute the nagios NRPE with
|
||||||
|
## a domain transition.
|
||||||
|
## </summary>
|
||||||
|
## <param name="domain">
|
||||||
|
## <summary>
|
||||||
|
## Domain allowed to transition.
|
||||||
|
## </summary>
|
||||||
|
## </param>
|
||||||
|
#
|
||||||
|
interface(`nagios_domtrans_nrpe',`
|
||||||
|
gen_require(`
|
||||||
|
type nrpe_t, nrpe_exec_t;
|
||||||
|
')
|
||||||
|
|
||||||
|
domtrans_pattern($1, nrpe_exec_t, nrpe_t)
|
||||||
|
')
|
||||||
|
|
||||||
|
######################################
|
||||||
|
## <summary>
|
||||||
|
## Do not audit attempts to write nrpe daemon unnamed pipes.
|
||||||
|
## </summary>
|
||||||
|
## <param name="domain">
|
||||||
|
## <summary>
|
||||||
|
## Domain allowed access.
|
||||||
|
## </summary>
|
||||||
|
## </param>
|
||||||
|
#
|
||||||
|
interface(`nagios_dontaudit_write_pipes_nrpe',`
|
||||||
|
gen_require(`
|
||||||
|
type nrpe_t;
|
||||||
|
')
|
||||||
|
|
||||||
|
dontaudit $1 nrpe_t:fifo_file write;
|
||||||
|
')
|
||||||
|
|
||||||
|
########################################
|
||||||
|
## <summary>
|
||||||
|
## All of the rules required to administrate
|
||||||
|
## an nagios environment
|
||||||
|
## </summary>
|
||||||
|
## <param name="domain">
|
||||||
|
## <summary>
|
||||||
|
## Domain allowed access.
|
||||||
|
## </summary>
|
||||||
|
## </param>
|
||||||
|
## <param name="role">
|
||||||
|
## <summary>
|
||||||
|
## The role to be allowed to manage the nagios domain.
|
||||||
|
## </summary>
|
||||||
|
## </param>
|
||||||
|
## <rolecap/>
|
||||||
|
#
|
||||||
|
interface(`nagios_admin',`
|
||||||
|
gen_require(`
|
||||||
|
type nagios_t, nrpe_t, nagios_initrc_exec_t;
|
||||||
|
type nagios_tmp_t, nagios_log_t, nagios_var_run_t;
|
||||||
|
type nagios_etc_t, nrpe_etc_t, nagios_spool_t;
|
||||||
|
')
|
||||||
|
|
||||||
|
allow $1 nagios_t:process signal_perms;
|
||||||
|
ps_process_pattern($1, nagios_t)
|
||||||
|
tunable_policy(`deny_ptrace',`',`
|
||||||
|
allow $1 nagios_t:process ptrace;
|
||||||
|
')
|
||||||
|
|
||||||
|
init_labeled_script_domtrans($1, nagios_initrc_exec_t)
|
||||||
|
domain_system_change_exemption($1)
|
||||||
|
role_transition $2 nagios_initrc_exec_t system_r;
|
||||||
|
allow $2 system_r;
|
||||||
|
|
||||||
|
files_list_tmp($1)
|
||||||
|
admin_pattern($1, nagios_tmp_t)
|
||||||
|
|
||||||
|
logging_list_logs($1)
|
||||||
|
admin_pattern($1, nagios_log_t)
|
||||||
|
|
||||||
|
files_list_etc($1)
|
||||||
|
admin_pattern($1, nagios_etc_t)
|
||||||
|
|
||||||
|
files_list_spool($1)
|
||||||
|
admin_pattern($1, nagios_spool_t)
|
||||||
|
|
||||||
|
files_list_pids($1)
|
||||||
|
admin_pattern($1, nagios_var_run_t)
|
||||||
|
|
||||||
|
admin_pattern($1, nrpe_etc_t)
|
||||||
|
')
|
||||||
|
|
||||||
|
########################################
|
||||||
|
## <summary>
|
||||||
|
## Send a null signal to nagios_unconfined_plugin.
|
||||||
|
## </summary>
|
||||||
|
## <param name="domain">
|
||||||
|
## <summary>
|
||||||
|
## Domain allowed access.
|
||||||
|
## </summary>
|
||||||
|
## </param>
|
||||||
|
#
|
||||||
|
interface(`nagios_unconfined_signull',`
|
||||||
|
gen_require(`
|
||||||
|
type nagios_unconfined_plugin_t;
|
||||||
|
')
|
||||||
|
|
||||||
|
allow $1 nagios_unconfined_plugin_t:process signull;
|
||||||
|
')
|
||||||
|
|
||||||
|
########################################
|
||||||
|
#
|
||||||
|
# Nagios interface compatibility blocks
|
||||||
|
#
|
||||||
|
# The following definitions ensure compatibility with distribution policy
|
||||||
|
# versions that do not contain given interfaces (epel, or older Fedora
|
||||||
|
# releases).
|
||||||
|
# Each block tests for existence of given interface and defines it if needed.
|
||||||
|
#
|
||||||
|
|
||||||
|
########################################
|
||||||
|
## <summary>
|
||||||
|
## Allow caller to signull sssd.
|
||||||
|
## Backport from RHEL8
|
||||||
|
## </summary>
|
||||||
|
## <param name="domain">
|
||||||
|
## <summary>
|
||||||
|
## Domain allowed access.
|
||||||
|
## </summary>
|
||||||
|
## </param>
|
||||||
|
#
|
||||||
|
ifndef(`sssd_signull',`
|
||||||
|
interface(`sssd_signull',`
|
||||||
|
gen_require(`
|
||||||
|
type sssd_t;
|
||||||
|
')
|
||||||
|
|
||||||
|
allow $1 sssd_t:process signull;
|
||||||
|
')
|
||||||
|
')
|
||||||
17
nagios.spec
17
nagios.spec
@ -1,6 +1,6 @@
|
|||||||
Name: nagios
|
Name: nagios
|
||||||
Version: 4.4.3
|
Version: 4.4.6
|
||||||
Release: 8
|
Release: 1
|
||||||
Summary: Host/service/network monitoring program
|
Summary: Host/service/network monitoring program
|
||||||
License: GPLv2
|
License: GPLv2
|
||||||
URL: https://www.nagios.org/projects/nagios-core/
|
URL: https://www.nagios.org/projects/nagios-core/
|
||||||
@ -31,7 +31,7 @@ Patch0011: nagios-0011-remove-rpmbuild.patch
|
|||||||
Patch0012: nagios-0012-fix-spool.patch
|
Patch0012: nagios-0012-fix-spool.patch
|
||||||
Patch0013: nagios-0013-fix-plugin.patch
|
Patch0013: nagios-0013-fix-plugin.patch
|
||||||
Patch0014: nagios-0014-fix-uidgid.patch
|
Patch0014: nagios-0014-fix-uidgid.patch
|
||||||
Patch0015: nagios-0015-fix-multiple-definition.patch
|
Patch0015: nagios-0015-Changelog.patch
|
||||||
BuildRequires: doxygen gcc gperf libjpeg-devel libpng-devel zlib-devel gd-devel > 1.8
|
BuildRequires: doxygen gcc gperf libjpeg-devel libpng-devel zlib-devel gd-devel > 1.8
|
||||||
BuildRequires: perl-generators perl(CPAN) perl(ExtUtils::MakeMaker) perl(ExtUtils::Embed)
|
BuildRequires: perl-generators perl(CPAN) perl(ExtUtils::MakeMaker) perl(ExtUtils::Embed)
|
||||||
BuildRequires: perl(Test::Harness) perl(Test::More) perl(Test::Simple)
|
BuildRequires: perl(Test::Harness) perl(Test::More) perl(Test::Simple)
|
||||||
@ -64,7 +64,7 @@ Provides common directories, uid and gid among nagios-related packages.
|
|||||||
|
|
||||||
%package devel
|
%package devel
|
||||||
Summary: Provides include files that Nagios-related applications may compile against
|
Summary: Provides include files that Nagios-related applications may compile against
|
||||||
Requires: nagios = 4.4.3-%release
|
Requires: nagios = 4.4.6-%release
|
||||||
|
|
||||||
%description devel
|
%description devel
|
||||||
Nagios is a program that will monitor hosts and services on your
|
Nagios is a program that will monitor hosts and services on your
|
||||||
@ -77,7 +77,7 @@ may compile against.
|
|||||||
|
|
||||||
%package selinux
|
%package selinux
|
||||||
Summary: SELinux context for nagios
|
Summary: SELinux context for nagios
|
||||||
Requires: nagios = 4.4.3-%release
|
Requires: nagios = 4.4.6-%release
|
||||||
Requires(post): policycoreutils
|
Requires(post): policycoreutils
|
||||||
Requires(postun): policycoreutils
|
Requires(postun): policycoreutils
|
||||||
|
|
||||||
@ -87,13 +87,13 @@ SElinux context for nagios.
|
|||||||
|
|
||||||
%package contrib
|
%package contrib
|
||||||
Summary: Eventhandlers contributed to nagios
|
Summary: Eventhandlers contributed to nagios
|
||||||
Requires: nagios = 4.4.3-%release
|
Requires: nagios = 4.4.6-%release
|
||||||
|
|
||||||
%description contrib
|
%description contrib
|
||||||
Various contributed items used by plugins and other tools.
|
Various contributed items used by plugins and other tools.
|
||||||
|
|
||||||
%prep
|
%prep
|
||||||
%autosetup -n nagioscore-nagios-4.4.3 -p1
|
%autosetup -n nagioscore-nagios-4.4.6 -p1
|
||||||
|
|
||||||
install -p -m 0644 %{SOURCE10} %{SOURCE11} %{SOURCE12} html/images/logos/
|
install -p -m 0644 %{SOURCE10} %{SOURCE11} %{SOURCE12} html/images/logos/
|
||||||
|
|
||||||
@ -277,6 +277,9 @@ fi
|
|||||||
%{_libdir}/%{name}/cgi/
|
%{_libdir}/%{name}/cgi/
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
|
* Tue Jan 18 2022 SimpleUpdate Robot <tc@openeuler.org> - 4.4.6-1
|
||||||
|
- Upgrade to version 4.4.6
|
||||||
|
|
||||||
* Mon Aug 2 2021 shdluan <shdluan@163.com> - 4.4.3-8
|
* Mon Aug 2 2021 shdluan <shdluan@163.com> - 4.4.3-8
|
||||||
-fix pack failure when use gcc 10
|
-fix pack failure when use gcc 10
|
||||||
|
|
||||||
|
|||||||
667
nagios.te
Normal file
667
nagios.te
Normal file
@ -0,0 +1,667 @@
|
|||||||
|
policy_module(nagios, 1.13.0)
|
||||||
|
|
||||||
|
########################################
|
||||||
|
#
|
||||||
|
# Declarations
|
||||||
|
#
|
||||||
|
|
||||||
|
## <desc>
|
||||||
|
## <p>
|
||||||
|
## Allow nagios/nrpe to call sudo from NRPE utils scripts.
|
||||||
|
## </p>
|
||||||
|
## </desc>
|
||||||
|
gen_tunable(nagios_run_sudo, false)
|
||||||
|
|
||||||
|
## <desc>
|
||||||
|
## <p>
|
||||||
|
## Allow nagios run in conjunction with PNP4Nagios.
|
||||||
|
## </p>
|
||||||
|
## </desc>
|
||||||
|
gen_tunable(nagios_run_pnp4nagios, false)
|
||||||
|
|
||||||
|
## <desc>
|
||||||
|
## <p>
|
||||||
|
## Determine whether Nagios, NRPE can
|
||||||
|
## access nfs file systems.
|
||||||
|
## </p>
|
||||||
|
## </desc>
|
||||||
|
gen_tunable(nagios_use_nfs, false)
|
||||||
|
|
||||||
|
gen_require(`
|
||||||
|
class passwd rootok;
|
||||||
|
class passwd passwd;
|
||||||
|
')
|
||||||
|
|
||||||
|
attribute nagios_plugin_domain;
|
||||||
|
|
||||||
|
type nagios_t;
|
||||||
|
type nagios_exec_t;
|
||||||
|
init_daemon_domain(nagios_t, nagios_exec_t)
|
||||||
|
|
||||||
|
type nagios_etc_t;
|
||||||
|
files_config_file(nagios_etc_t)
|
||||||
|
|
||||||
|
type nagios_initrc_exec_t;
|
||||||
|
init_script_file(nagios_initrc_exec_t)
|
||||||
|
|
||||||
|
type nagios_log_t;
|
||||||
|
logging_log_file(nagios_log_t)
|
||||||
|
|
||||||
|
type nagios_tmp_t;
|
||||||
|
files_tmp_file(nagios_tmp_t)
|
||||||
|
|
||||||
|
type nagios_var_run_t;
|
||||||
|
files_pid_file(nagios_var_run_t)
|
||||||
|
|
||||||
|
type nagios_spool_t;
|
||||||
|
files_spool_file(nagios_spool_t)
|
||||||
|
|
||||||
|
type nagios_var_lib_t;
|
||||||
|
files_type(nagios_var_lib_t)
|
||||||
|
|
||||||
|
nagios_plugin_template(admin)
|
||||||
|
nagios_plugin_template(checkdisk)
|
||||||
|
nagios_plugin_template(mail)
|
||||||
|
nagios_plugin_template(services)
|
||||||
|
nagios_plugin_template(system)
|
||||||
|
nagios_plugin_template(unconfined)
|
||||||
|
nagios_plugin_template(eventhandler)
|
||||||
|
nagios_plugin_template(openshift)
|
||||||
|
|
||||||
|
type nagios_eventhandler_plugin_tmp_t;
|
||||||
|
files_tmp_file(nagios_eventhandler_plugin_tmp_t)
|
||||||
|
|
||||||
|
type nagios_system_plugin_tmp_t;
|
||||||
|
files_tmp_file(nagios_system_plugin_tmp_t)
|
||||||
|
|
||||||
|
type nagios_openshift_plugin_tmp_t;
|
||||||
|
files_tmp_file(nagios_openshift_plugin_tmp_t)
|
||||||
|
|
||||||
|
type nrpe_t;
|
||||||
|
type nrpe_exec_t;
|
||||||
|
init_daemon_domain(nrpe_t, nrpe_exec_t)
|
||||||
|
|
||||||
|
type nrpe_etc_t;
|
||||||
|
files_config_file(nrpe_etc_t)
|
||||||
|
|
||||||
|
type nrpe_var_run_t;
|
||||||
|
files_pid_file(nrpe_var_run_t)
|
||||||
|
|
||||||
|
######################################
|
||||||
|
#
|
||||||
|
# Common plugin domain local policy
|
||||||
|
#
|
||||||
|
|
||||||
|
allow nagios_plugin_domain self:fifo_file rw_fifo_file_perms;
|
||||||
|
|
||||||
|
allow nrpe_t nagios_plugin_domain:process { sigkill signal };
|
||||||
|
|
||||||
|
allow nagios_t nagios_plugin_domain:process signal_perms;
|
||||||
|
allow nagios_plugin_domain nagios_t:process signal_perms;
|
||||||
|
|
||||||
|
# cjp: leaked file descriptor
|
||||||
|
dontaudit nagios_plugin_domain nrpe_t:tcp_socket { read write };
|
||||||
|
dontaudit nagios_plugin_domain nagios_log_t:file { read write };
|
||||||
|
|
||||||
|
dev_read_urand(nagios_plugin_domain)
|
||||||
|
dev_read_rand(nagios_plugin_domain)
|
||||||
|
dev_read_sysfs(nagios_plugin_domain)
|
||||||
|
|
||||||
|
userdom_use_inherited_user_ptys(nagios_plugin_domain)
|
||||||
|
userdom_use_inherited_user_ttys(nagios_plugin_domain)
|
||||||
|
|
||||||
|
########################################
|
||||||
|
#
|
||||||
|
# Nagios local policy
|
||||||
|
#
|
||||||
|
|
||||||
|
allow nagios_t self:capability { chown dac_read_search setgid setuid };
|
||||||
|
dontaudit nagios_t self:capability sys_tty_config;
|
||||||
|
allow nagios_t self:process { setpgid signal_perms };
|
||||||
|
allow nagios_t self:fifo_file rw_fifo_file_perms;
|
||||||
|
allow nagios_t self:tcp_socket { accept listen };
|
||||||
|
allow nagios_t self:unix_stream_socket { connectto };
|
||||||
|
|
||||||
|
allow nagios_t nagios_plugin_domain:process signal_perms;
|
||||||
|
|
||||||
|
allow nagios_t nagios_eventhandler_plugin_exec_t:dir list_dir_perms;
|
||||||
|
|
||||||
|
allow nagios_t nagios_etc_t:dir list_dir_perms;
|
||||||
|
allow nagios_t nagios_etc_t:file { map read_file_perms };
|
||||||
|
allow nagios_t nagios_etc_t:lnk_file read_lnk_file_perms;
|
||||||
|
|
||||||
|
#allow nagios_t nagios_log_t:dir setattr_dir_perms;
|
||||||
|
#append_files_pattern(nagios_t, nagios_log_t, nagios_log_t)
|
||||||
|
#create_files_pattern(nagios_t, nagios_log_t, nagios_log_t)
|
||||||
|
#setattr_files_pattern(nagios_t, nagios_log_t, nagios_log_t)
|
||||||
|
manage_files_pattern(nagios_t, nagios_log_t, nagios_log_t)
|
||||||
|
manage_dirs_pattern(nagios_t, nagios_log_t, nagios_log_t)
|
||||||
|
logging_log_filetrans(nagios_t, nagios_log_t, { dir file })
|
||||||
|
allow nagios_t nagios_log_t:file map;
|
||||||
|
|
||||||
|
manage_dirs_pattern(nagios_t, nagios_tmp_t, nagios_tmp_t)
|
||||||
|
manage_files_pattern(nagios_t, nagios_tmp_t, nagios_tmp_t)
|
||||||
|
files_tmp_filetrans(nagios_t, nagios_tmp_t, { dir file })
|
||||||
|
|
||||||
|
manage_files_pattern(nagios_t, nagios_var_run_t, nagios_var_run_t)
|
||||||
|
files_pid_filetrans(nagios_t, nagios_var_run_t, file)
|
||||||
|
|
||||||
|
manage_fifo_files_pattern(nagios_t, nagios_spool_t, nagios_spool_t)
|
||||||
|
manage_files_pattern(nagios_t, nagios_spool_t, nagios_spool_t)
|
||||||
|
manage_sock_files_pattern(nagios_t, nagios_spool_t, nagios_spool_t)
|
||||||
|
files_spool_filetrans(nagios_t, nagios_spool_t, { file fifo_file })
|
||||||
|
allow nagios_t nagios_spool_t:file map;
|
||||||
|
|
||||||
|
manage_files_pattern(nagios_t, nagios_var_lib_t, nagios_var_lib_t)
|
||||||
|
manage_fifo_files_pattern(nagios_t, nagios_var_lib_t, nagios_var_lib_t)
|
||||||
|
manage_dirs_pattern(nagios_t, nagios_var_lib_t, nagios_var_lib_t)
|
||||||
|
files_var_lib_filetrans(nagios_t, nagios_var_lib_t, { dir file fifo_file })
|
||||||
|
|
||||||
|
kernel_read_system_state(nagios_t)
|
||||||
|
kernel_read_kernel_sysctls(nagios_t)
|
||||||
|
kernel_read_software_raid_state(nagios_t)
|
||||||
|
|
||||||
|
corecmd_exec_bin(nagios_t)
|
||||||
|
corecmd_exec_shell(nagios_t)
|
||||||
|
|
||||||
|
corenet_all_recvfrom_netlabel(nagios_t)
|
||||||
|
corenet_tcp_sendrecv_generic_if(nagios_t)
|
||||||
|
corenet_tcp_sendrecv_generic_node(nagios_t)
|
||||||
|
|
||||||
|
corenet_sendrecv_all_client_packets(nagios_t)
|
||||||
|
corenet_tcp_connect_all_ports(nagios_t)
|
||||||
|
corenet_tcp_sendrecv_all_ports(nagios_t)
|
||||||
|
|
||||||
|
corenet_dontaudit_tcp_bind_all_reserved_ports(nagios_t)
|
||||||
|
corenet_dontaudit_udp_bind_all_reserved_ports(nagios_t)
|
||||||
|
|
||||||
|
dev_read_sysfs(nagios_t)
|
||||||
|
dev_read_urand(nagios_t)
|
||||||
|
|
||||||
|
domain_use_interactive_fds(nagios_t)
|
||||||
|
domain_read_all_domains_state(nagios_t)
|
||||||
|
|
||||||
|
files_read_etc_runtime_files(nagios_t)
|
||||||
|
files_read_kernel_symbol_table(nagios_t)
|
||||||
|
files_search_spool(nagios_t)
|
||||||
|
|
||||||
|
fs_getattr_all_fs(nagios_t)
|
||||||
|
fs_search_auto_mountpoints(nagios_t)
|
||||||
|
fs_search_cgroup_dirs(nagios_t)
|
||||||
|
|
||||||
|
hostname_exec(nagios_t)
|
||||||
|
|
||||||
|
auth_use_nsswitch(nagios_t)
|
||||||
|
|
||||||
|
logging_send_syslog_msg(nagios_t)
|
||||||
|
libs_exec_ldconfig(nagios_t)
|
||||||
|
|
||||||
|
userdom_dontaudit_use_unpriv_user_fds(nagios_t)
|
||||||
|
userdom_dontaudit_search_user_home_dirs(nagios_t)
|
||||||
|
|
||||||
|
mta_send_mail(nagios_t)
|
||||||
|
mta_signal_system_mail(nagios_t)
|
||||||
|
mta_kill_system_mail(nagios_t)
|
||||||
|
|
||||||
|
systemd_exec_systemctl(nagios_t)
|
||||||
|
|
||||||
|
tunable_policy(`nagios_run_sudo',`
|
||||||
|
allow nagios_t self:capability { chown setgid setuid sys_ptrace sys_resource };
|
||||||
|
allow nagios_t self:process { setrlimit setsched };
|
||||||
|
|
||||||
|
allow nagios_t self:key write;
|
||||||
|
|
||||||
|
allow nagios_t self:passwd { passwd rootok };
|
||||||
|
|
||||||
|
auth_rw_lastlog(nagios_t)
|
||||||
|
auth_rw_faillog(nagios_t)
|
||||||
|
|
||||||
|
auth_domtrans_chkpwd(nagios_t)
|
||||||
|
|
||||||
|
selinux_compute_access_vector(nagios_t)
|
||||||
|
|
||||||
|
systemd_write_inherited_logind_sessions_pipes(nagios_t)
|
||||||
|
systemd_dbus_chat_logind(nagios_t)
|
||||||
|
|
||||||
|
logging_send_audit_msgs(nagios_t)
|
||||||
|
')
|
||||||
|
|
||||||
|
optional_policy(`
|
||||||
|
apache_systemctl(nagios_t)
|
||||||
|
')
|
||||||
|
|
||||||
|
optional_policy(`
|
||||||
|
dbus_system_bus_client(nagios_t)
|
||||||
|
')
|
||||||
|
|
||||||
|
optional_policy(`
|
||||||
|
tunable_policy(`nagios_run_sudo',`
|
||||||
|
sudo_exec(nagios_t)
|
||||||
|
sudo_manage_db(nagios_t)
|
||||||
|
')
|
||||||
|
')
|
||||||
|
|
||||||
|
optional_policy(`
|
||||||
|
tunable_policy(`nagios_run_sudo',`
|
||||||
|
init_read_utmp(nagios_t)
|
||||||
|
')
|
||||||
|
')
|
||||||
|
|
||||||
|
tunable_policy(`nagios_run_pnp4nagios',`
|
||||||
|
allow nagios_t nagios_log_t:file execute;
|
||||||
|
')
|
||||||
|
|
||||||
|
tunable_policy(`nagios_use_nfs',`
|
||||||
|
fs_manage_nfs_files(nagios_t)
|
||||||
|
fs_manage_nfs_dirs(nagios_t)
|
||||||
|
fs_manage_nfs_symlinks(nagios_t)
|
||||||
|
')
|
||||||
|
|
||||||
|
optional_policy(`
|
||||||
|
netutils_kill_ping(nagios_t)
|
||||||
|
')
|
||||||
|
|
||||||
|
optional_policy(`
|
||||||
|
seutil_sigchld_newrole(nagios_t)
|
||||||
|
')
|
||||||
|
|
||||||
|
optional_policy(`
|
||||||
|
udev_read_db(nagios_t)
|
||||||
|
')
|
||||||
|
|
||||||
|
########################################
|
||||||
|
#
|
||||||
|
# CGI local policy
|
||||||
|
#
|
||||||
|
|
||||||
|
optional_policy(`
|
||||||
|
apache_content_template(nagios)
|
||||||
|
apache_content_alias_template(nagios, nagios)
|
||||||
|
typealias nagios_script_t alias nagios_cgi_t;
|
||||||
|
typealias nagios_script_exec_t alias nagios_cgi_exec_t;
|
||||||
|
|
||||||
|
allow nagios_script_t self:process signal_perms;
|
||||||
|
|
||||||
|
read_files_pattern(nagios_script_t, nagios_t, nagios_t)
|
||||||
|
read_lnk_files_pattern(nagios_script_t, nagios_t, nagios_t)
|
||||||
|
|
||||||
|
allow nagios_script_t nagios_etc_t:dir list_dir_perms;
|
||||||
|
allow nagios_script_t nagios_etc_t:file { map read_file_perms };
|
||||||
|
allow nagios_script_t nagios_etc_t:lnk_file read_lnk_file_perms;
|
||||||
|
|
||||||
|
files_search_spool(nagios_script_t)
|
||||||
|
rw_fifo_files_pattern(nagios_script_t, nagios_spool_t, nagios_spool_t)
|
||||||
|
read_files_pattern(nagios_script_t, nagios_spool_t, nagios_spool_t)
|
||||||
|
allow nagios_script_t nagios_spool_t:file map;
|
||||||
|
|
||||||
|
allow nagios_script_t nagios_log_t:dir list_dir_perms;
|
||||||
|
read_files_pattern(nagios_script_t, nagios_etc_t, nagios_log_t)
|
||||||
|
read_lnk_files_pattern(nagios_script_t, nagios_etc_t, nagios_log_t)
|
||||||
|
allow nagios_script_t nagios_log_t:file map;
|
||||||
|
|
||||||
|
kernel_read_system_state(nagios_script_t)
|
||||||
|
|
||||||
|
domain_dontaudit_read_all_domains_state(nagios_script_t)
|
||||||
|
|
||||||
|
files_read_etc_runtime_files(nagios_script_t)
|
||||||
|
files_read_kernel_symbol_table(nagios_script_t)
|
||||||
|
|
||||||
|
dev_list_sysfs(nagios_script_t)
|
||||||
|
|
||||||
|
logging_send_syslog_msg(nagios_script_t)
|
||||||
|
')
|
||||||
|
|
||||||
|
########################################
|
||||||
|
#
|
||||||
|
# Nrpe local policy
|
||||||
|
#
|
||||||
|
|
||||||
|
allow nrpe_t self:capability { kill setgid setuid };
|
||||||
|
dontaudit nrpe_t self:capability { sys_resource sys_tty_config };
|
||||||
|
allow nrpe_t self:process { setpgid setrlimit setsched signal_perms };
|
||||||
|
allow nrpe_t self:fifo_file rw_fifo_file_perms;
|
||||||
|
allow nrpe_t self:tcp_socket { accept listen };
|
||||||
|
|
||||||
|
allow nrpe_t nagios_plugin_domain:process { sigkill signal };
|
||||||
|
|
||||||
|
list_dirs_pattern(nrpe_t, nrpe_etc_t, nrpe_etc_t)
|
||||||
|
read_files_pattern(nrpe_t, nagios_etc_t, nrpe_etc_t)
|
||||||
|
|
||||||
|
manage_files_pattern(nrpe_t, nrpe_var_run_t, nrpe_var_run_t)
|
||||||
|
files_pid_filetrans(nrpe_t, nrpe_var_run_t, file)
|
||||||
|
|
||||||
|
domtrans_pattern(nrpe_t, nagios_checkdisk_plugin_exec_t, nagios_checkdisk_plugin_t)
|
||||||
|
|
||||||
|
kernel_read_system_state(nrpe_t)
|
||||||
|
kernel_read_kernel_sysctls(nrpe_t)
|
||||||
|
kernel_read_software_raid_state(nrpe_t)
|
||||||
|
kernel_read_fs_sysctls(nrpe_t)
|
||||||
|
|
||||||
|
can_exec(nagios_t, nagios_exec_t)
|
||||||
|
|
||||||
|
corecmd_exec_bin(nrpe_t)
|
||||||
|
corecmd_exec_shell(nrpe_t)
|
||||||
|
|
||||||
|
corenet_all_recvfrom_unlabeled(nrpe_t)
|
||||||
|
corenet_all_recvfrom_netlabel(nrpe_t)
|
||||||
|
corenet_tcp_sendrecv_generic_if(nrpe_t)
|
||||||
|
corenet_tcp_sendrecv_generic_node(nrpe_t)
|
||||||
|
corenet_tcp_bind_generic_node(nrpe_t)
|
||||||
|
|
||||||
|
corenet_sendrecv_inetd_child_server_packets(nrpe_t)
|
||||||
|
corenet_tcp_bind_inetd_child_port(nrpe_t)
|
||||||
|
corenet_tcp_sendrecv_inetd_child_port(nrpe_t)
|
||||||
|
|
||||||
|
dev_read_sysfs(nrpe_t)
|
||||||
|
dev_read_urand(nrpe_t)
|
||||||
|
dev_rw_lvm_control(nrpe_t)
|
||||||
|
|
||||||
|
domain_use_interactive_fds(nrpe_t)
|
||||||
|
domain_read_all_domains_state(nrpe_t)
|
||||||
|
|
||||||
|
files_list_var(nrpe_t)
|
||||||
|
files_read_etc_runtime_files(nrpe_t)
|
||||||
|
|
||||||
|
fs_getattr_all_fs(nrpe_t)
|
||||||
|
fs_search_auto_mountpoints(nrpe_t)
|
||||||
|
|
||||||
|
auth_use_nsswitch(nrpe_t)
|
||||||
|
|
||||||
|
logging_send_syslog_msg(nrpe_t)
|
||||||
|
|
||||||
|
userdom_dontaudit_use_unpriv_user_fds(nrpe_t)
|
||||||
|
|
||||||
|
tunable_policy(`nagios_run_sudo',`
|
||||||
|
allow nrpe_t self:capability { setgid setuid sys_ptrace sys_resource };
|
||||||
|
allow nrpe_t self:process { setrlimit setsched };
|
||||||
|
|
||||||
|
allow nrpe_t self:key write;
|
||||||
|
|
||||||
|
allow nrpe_t self:passwd { passwd rootok };
|
||||||
|
|
||||||
|
auth_rw_lastlog(nrpe_t)
|
||||||
|
auth_rw_faillog(nrpe_t)
|
||||||
|
|
||||||
|
auth_domtrans_chkpwd(nrpe_t)
|
||||||
|
|
||||||
|
init_read_utmp(nrpe_t)
|
||||||
|
|
||||||
|
selinux_compute_access_vector(nrpe_t)
|
||||||
|
|
||||||
|
systemd_write_inherited_logind_sessions_pipes(nrpe_t)
|
||||||
|
systemd_dbus_chat_logind(nrpe_t)
|
||||||
|
|
||||||
|
logging_send_audit_msgs(nrpe_t)
|
||||||
|
')
|
||||||
|
|
||||||
|
optional_policy(`
|
||||||
|
tunable_policy(`nagios_run_sudo',`
|
||||||
|
sudo_exec(nrpe_t)
|
||||||
|
sudo_manage_db(nrpe_t)
|
||||||
|
')
|
||||||
|
')
|
||||||
|
|
||||||
|
optional_policy(`
|
||||||
|
tunable_policy(`nagios_run_sudo',`
|
||||||
|
sssd_read_config(nrpe_t)
|
||||||
|
sssd_manage_lib_files(nrpe_t)
|
||||||
|
sssd_read_pid_files(nrpe_t)
|
||||||
|
sssd_signull(nrpe_t)
|
||||||
|
')
|
||||||
|
')
|
||||||
|
|
||||||
|
tunable_policy(`nagios_use_nfs',`
|
||||||
|
fs_manage_nfs_files(nrpe_t)
|
||||||
|
fs_manage_nfs_dirs(nrpe_t)
|
||||||
|
fs_manage_nfs_symlinks(nrpe_t)
|
||||||
|
')
|
||||||
|
|
||||||
|
optional_policy(`
|
||||||
|
dbus_system_bus_client(nrpe_t)
|
||||||
|
')
|
||||||
|
|
||||||
|
optional_policy(`
|
||||||
|
inetd_tcp_service_domain(nrpe_t, nrpe_exec_t)
|
||||||
|
')
|
||||||
|
|
||||||
|
optional_policy(`
|
||||||
|
lvm_read_metadata(nrpe_t)
|
||||||
|
')
|
||||||
|
|
||||||
|
optional_policy(`
|
||||||
|
mta_send_mail(nrpe_t)
|
||||||
|
')
|
||||||
|
|
||||||
|
optional_policy(`
|
||||||
|
seutil_sigchld_newrole(nrpe_t)
|
||||||
|
')
|
||||||
|
|
||||||
|
optional_policy(`
|
||||||
|
tcpd_wrapped_domain(nrpe_t, nrpe_exec_t)
|
||||||
|
')
|
||||||
|
|
||||||
|
optional_policy(`
|
||||||
|
udev_read_db(nrpe_t)
|
||||||
|
')
|
||||||
|
|
||||||
|
#####################################
|
||||||
|
#
|
||||||
|
# Admin local policy
|
||||||
|
#
|
||||||
|
|
||||||
|
corecmd_read_bin_files(nagios_admin_plugin_t)
|
||||||
|
corecmd_read_bin_symlinks(nagios_admin_plugin_t)
|
||||||
|
|
||||||
|
dev_getattr_all_chr_files(nagios_admin_plugin_t)
|
||||||
|
dev_getattr_all_blk_files(nagios_admin_plugin_t)
|
||||||
|
|
||||||
|
files_getattr_all_dirs(nagios_admin_plugin_t)
|
||||||
|
files_getattr_all_files(nagios_admin_plugin_t)
|
||||||
|
files_getattr_all_symlinks(nagios_admin_plugin_t)
|
||||||
|
files_getattr_all_pipes(nagios_admin_plugin_t)
|
||||||
|
files_getattr_all_sockets(nagios_admin_plugin_t)
|
||||||
|
files_getattr_all_file_type_fs(nagios_admin_plugin_t)
|
||||||
|
|
||||||
|
######################################
|
||||||
|
#
|
||||||
|
# Mail local policy
|
||||||
|
#
|
||||||
|
|
||||||
|
allow nagios_mail_plugin_t self:capability { dac_read_search setgid setuid };
|
||||||
|
allow nagios_mail_plugin_t self:netlink_route_socket r_netlink_socket_perms;
|
||||||
|
allow nagios_mail_plugin_t self:tcp_socket create_stream_socket_perms;
|
||||||
|
allow nagios_mail_plugin_t self:udp_socket create_socket_perms;
|
||||||
|
|
||||||
|
kernel_read_kernel_sysctls(nagios_mail_plugin_t)
|
||||||
|
|
||||||
|
corecmd_read_bin_files(nagios_mail_plugin_t)
|
||||||
|
corecmd_read_bin_symlinks(nagios_mail_plugin_t)
|
||||||
|
|
||||||
|
logging_send_syslog_msg(nagios_mail_plugin_t)
|
||||||
|
|
||||||
|
sysnet_dns_name_resolve(nagios_mail_plugin_t)
|
||||||
|
|
||||||
|
optional_policy(`
|
||||||
|
mta_send_mail(nagios_mail_plugin_t)
|
||||||
|
')
|
||||||
|
|
||||||
|
optional_policy(`
|
||||||
|
nscd_dontaudit_search_pid(nagios_mail_plugin_t)
|
||||||
|
')
|
||||||
|
|
||||||
|
optional_policy(`
|
||||||
|
postfix_stream_connect_master(nagios_mail_plugin_t)
|
||||||
|
postfix_exec_postqueue(nagios_mail_plugin_t)
|
||||||
|
')
|
||||||
|
|
||||||
|
######################################
|
||||||
|
#
|
||||||
|
# Disk local policy
|
||||||
|
#
|
||||||
|
|
||||||
|
allow nagios_checkdisk_plugin_t self:capability { sys_admin sys_rawio };
|
||||||
|
|
||||||
|
kernel_read_software_raid_state(nagios_checkdisk_plugin_t)
|
||||||
|
|
||||||
|
corecmd_exec_bin(nagios_checkdisk_plugin_t)
|
||||||
|
|
||||||
|
files_getattr_all_dirs(nagios_checkdisk_plugin_t)
|
||||||
|
files_getattr_all_mountpoints(nagios_checkdisk_plugin_t)
|
||||||
|
files_read_etc_runtime_files(nagios_checkdisk_plugin_t)
|
||||||
|
|
||||||
|
fs_read_configfs_files(nagios_checkdisk_plugin_t)
|
||||||
|
fs_read_configfs_dirs(nagios_checkdisk_plugin_t)
|
||||||
|
fs_getattr_all_fs(nagios_checkdisk_plugin_t)
|
||||||
|
|
||||||
|
storage_raw_read_fixed_disk(nagios_checkdisk_plugin_t)
|
||||||
|
|
||||||
|
#######################################
|
||||||
|
#
|
||||||
|
# Services local policy
|
||||||
|
#
|
||||||
|
|
||||||
|
allow nagios_services_plugin_t self:capability { net_bind_service net_raw setuid };
|
||||||
|
allow nagios_services_plugin_t self:process { sigkill signal };
|
||||||
|
allow nagios_services_plugin_t self:tcp_socket create_stream_socket_perms;
|
||||||
|
allow nagios_services_plugin_t self:udp_socket create_socket_perms;
|
||||||
|
allow nagios_services_plugin_t self:unix_dgram_socket create_socket_perms;
|
||||||
|
allow nagios_services_plugin_t self:rawip_socket create_socket_perms;
|
||||||
|
|
||||||
|
corecmd_exec_bin(nagios_services_plugin_t)
|
||||||
|
|
||||||
|
corenet_all_recvfrom_unlabeled(nagios_services_plugin_t)
|
||||||
|
corenet_all_recvfrom_netlabel(nagios_services_plugin_t)
|
||||||
|
corenet_tcp_sendrecv_generic_if(nagios_services_plugin_t)
|
||||||
|
corenet_udp_sendrecv_generic_if(nagios_services_plugin_t)
|
||||||
|
corenet_tcp_sendrecv_generic_node(nagios_services_plugin_t)
|
||||||
|
corenet_udp_sendrecv_generic_node(nagios_services_plugin_t)
|
||||||
|
corenet_udp_bind_generic_node(nagios_services_plugin_t)
|
||||||
|
|
||||||
|
corenet_sendrecv_all_client_packets(nagios_services_plugin_t)
|
||||||
|
corenet_tcp_connect_all_ports(nagios_services_plugin_t)
|
||||||
|
corenet_tcp_sendrecv_all_ports(nagios_services_plugin_t)
|
||||||
|
|
||||||
|
corenet_sendrecv_dhcpc_server_packets(nagios_services_plugin_t)
|
||||||
|
corenet_udp_bind_dhcpc_port(nagios_services_plugin_t)
|
||||||
|
corenet_udp_sendrecv_dhcpc_port(nagios_services_plugin_t)
|
||||||
|
|
||||||
|
auth_use_nsswitch(nagios_services_plugin_t)
|
||||||
|
|
||||||
|
domain_read_all_domains_state(nagios_services_plugin_t)
|
||||||
|
logging_send_syslog_msg(nagios_services_plugin_t)
|
||||||
|
|
||||||
|
optional_policy(`
|
||||||
|
netutils_domtrans_ping(nagios_services_plugin_t)
|
||||||
|
netutils_signal_ping(nagios_services_plugin_t)
|
||||||
|
netutils_kill_ping(nagios_services_plugin_t)
|
||||||
|
')
|
||||||
|
|
||||||
|
optional_policy(`
|
||||||
|
mysql_stream_connect(nagios_services_plugin_t)
|
||||||
|
mysql_read_config(nagios_services_plugin_t)
|
||||||
|
')
|
||||||
|
|
||||||
|
optional_policy(`
|
||||||
|
postgresql_stream_connect(nagios_services_plugin_t)
|
||||||
|
')
|
||||||
|
|
||||||
|
optional_policy(`
|
||||||
|
snmp_read_snmp_var_lib_files(nagios_services_plugin_t)
|
||||||
|
')
|
||||||
|
|
||||||
|
######################################
|
||||||
|
#
|
||||||
|
# System local policy
|
||||||
|
#
|
||||||
|
|
||||||
|
allow nagios_system_plugin_t self:capability { dac_read_search };
|
||||||
|
dontaudit nagios_system_plugin_t self:capability { setgid setuid };
|
||||||
|
|
||||||
|
allow nagios_system_plugin_t nrpe_exec_t:file read_file_perms;
|
||||||
|
allow nagios_system_plugin_t nagios_exec_t:file read_file_perms;
|
||||||
|
|
||||||
|
read_files_pattern(nagios_system_plugin_t, nagios_log_t, nagios_log_t)
|
||||||
|
read_files_pattern(nagios_system_plugin_t, nagios_spool_t, nagios_spool_t)
|
||||||
|
manage_files_pattern(nagios_system_plugin_t, nagios_system_plugin_tmp_t, nagios_system_plugin_tmp_t)
|
||||||
|
manage_dirs_pattern(nagios_system_plugin_t, nagios_system_plugin_tmp_t, nagios_system_plugin_tmp_t)
|
||||||
|
files_tmp_filetrans(nagios_system_plugin_t, nagios_system_plugin_tmp_t, { dir file })
|
||||||
|
|
||||||
|
kernel_read_system_state(nagios_system_plugin_t)
|
||||||
|
kernel_read_kernel_sysctls(nagios_system_plugin_t)
|
||||||
|
|
||||||
|
corecmd_exec_bin(nagios_system_plugin_t)
|
||||||
|
corecmd_exec_shell(nagios_system_plugin_t)
|
||||||
|
corecmd_getattr_all_executables(nagios_system_plugin_t)
|
||||||
|
|
||||||
|
dev_read_sysfs(nagios_system_plugin_t)
|
||||||
|
|
||||||
|
domain_read_all_domains_state(nagios_system_plugin_t)
|
||||||
|
|
||||||
|
fs_getattr_all_fs(nagios_system_plugin_t)
|
||||||
|
|
||||||
|
auth_read_passwd(nagios_system_plugin_t)
|
||||||
|
|
||||||
|
optional_policy(`
|
||||||
|
init_read_utmp(nagios_system_plugin_t)
|
||||||
|
')
|
||||||
|
|
||||||
|
optional_policy(`
|
||||||
|
mrtg_read_lib_files(nagios_system_plugin_t)
|
||||||
|
')
|
||||||
|
|
||||||
|
#######################################
|
||||||
|
#
|
||||||
|
# Event local policy
|
||||||
|
#
|
||||||
|
|
||||||
|
manage_files_pattern(nagios_eventhandler_plugin_t, nagios_eventhandler_plugin_tmp_t, nagios_eventhandler_plugin_tmp_t)
|
||||||
|
manage_dirs_pattern(nagios_eventhandler_plugin_t, nagios_eventhandler_plugin_tmp_t, nagios_eventhandler_plugin_tmp_t)
|
||||||
|
files_tmp_filetrans(nagios_eventhandler_plugin_t, nagios_eventhandler_plugin_tmp_t, { dir file })
|
||||||
|
|
||||||
|
corecmd_exec_bin(nagios_eventhandler_plugin_t)
|
||||||
|
corecmd_exec_shell(nagios_eventhandler_plugin_t)
|
||||||
|
|
||||||
|
init_domtrans_script(nagios_eventhandler_plugin_t)
|
||||||
|
|
||||||
|
systemd_exec_systemctl(nagios_eventhandler_plugin_t)
|
||||||
|
|
||||||
|
allow nagios_t nagios_eventhandler_plugin_exec_t:dir list_dir_perms;
|
||||||
|
|
||||||
|
optional_policy(`
|
||||||
|
unconfined_domain(nagios_eventhandler_plugin_t)
|
||||||
|
')
|
||||||
|
|
||||||
|
########################################
|
||||||
|
#
|
||||||
|
# nagios openshift plugin policy
|
||||||
|
#
|
||||||
|
|
||||||
|
allow nagios_openshift_plugin_t self:capability sys_ptrace;
|
||||||
|
|
||||||
|
manage_dirs_pattern(nagios_openshift_plugin_t, nagios_openshift_plugin_tmp_t, nagios_openshift_plugin_tmp_t)
|
||||||
|
manage_files_pattern(nagios_openshift_plugin_t, nagios_openshift_plugin_tmp_t, nagios_openshift_plugin_tmp_t)
|
||||||
|
files_tmp_filetrans(nagios_openshift_plugin_t, nagios_openshift_plugin_tmp_t, { file dir })
|
||||||
|
|
||||||
|
corecmd_exec_bin(nagios_openshift_plugin_t)
|
||||||
|
corecmd_exec_shell(nagios_openshift_plugin_t)
|
||||||
|
|
||||||
|
domain_read_all_domains_state(nagios_openshift_plugin_t)
|
||||||
|
|
||||||
|
fs_getattr_all_fs(nagios_openshift_plugin_t)
|
||||||
|
|
||||||
|
optional_policy(`
|
||||||
|
apache_read_config(nagios_openshift_plugin_t)
|
||||||
|
')
|
||||||
|
|
||||||
|
######################################
|
||||||
|
#
|
||||||
|
# nagios plugin domain policy
|
||||||
|
#
|
||||||
|
|
||||||
|
optional_policy(`
|
||||||
|
unconfined_domain(nagios_unconfined_plugin_t)
|
||||||
|
')
|
||||||
|
|
||||||
|
optional_policy(`
|
||||||
|
systemd_dbus_chat_logind(nagios_unconfined_plugin_t)
|
||||||
|
')
|
||||||
@ -1 +1 @@
|
|||||||
d /var/run/nagios 0755 nagios nagios -
|
D /run/nagios 0755 nagios nagios -
|
||||||
|
|||||||
Loading…
x
Reference in New Issue
Block a user