diff --git a/nagios-0003-Install-config-files-too.patch b/nagios-0003-Install-config-files-too.patch index 4bf4aa23597491d90542f2a22c11106bad21904f..3194a0268bc3288193e1c1c5785bdb5a88502652 100644 --- a/nagios-0003-Install-config-files-too.patch +++ b/nagios-0003-Install-config-files-too.patch @@ -1,7 +1,8 @@ -diff -up ./Makefile.in.install_config ./Makefile.in ---- ./Makefile.in.install_config 2017-04-19 19:11:47.783707415 -0400 -+++ ./Makefile.in 2017-04-19 19:11:47.785707384 -0400 -@@ -377,7 +377,7 @@ dox: +diff --git a/Makefile.in b/Makefile.in +index b992ab1e..ef2a797f 100644 +--- a/Makefile.in ++++ b/Makefile.in +@@ -439,7 +439,7 @@ dox: doxygen doxy.conf diff --git a/nagios-0009-fix-localstatedir-for-linux.patch b/nagios-0009-fix-localstatedir-for-linux.patch index 3c18043bce0eda066d012d3e267d30add8709a1c..070285f03b3adba52828d6879d733264f568c124 100644 --- a/nagios-0009-fix-localstatedir-for-linux.patch +++ b/nagios-0009-fix-localstatedir-for-linux.patch @@ -264,9 +264,9 @@ diff -up ./startup/default-service.in.fix_localstatedir ./startup/default-servic ExecStop=@BIN_KILL@ -s TERM ${MAINPID} -ExecStopPost=@BIN_RM@ -f @localstatedir@/rw/nagios.cmd +ExecStopPost=@BIN_RM@ -f @localstatedir@/spool/nagios/cmd/nagios.cmd + ExecReload=@bindir@/nagios -v @sysconfdir@/nagios.cfg ExecReload=@BIN_KILL@ -s HUP ${MAINPID} - [Install] diff -up ./t-tap/Makefile.in.fix_localstatedir ./t-tap/Makefile.in --- ./t-tap/Makefile.in.fix_localstatedir 2019-01-16 14:24:14.944312569 -0600 +++ ./t-tap/Makefile.in 2019-01-16 14:24:42.359858604 -0600 diff --git a/nagios-0010-remove-information-leak.patch b/nagios-0010-remove-information-leak.patch index 46c62e11aeff8b905b6611ab8830db85f6357c4c..b417e5b9dae835383826966f23d70d4bed484001 100644 --- a/nagios-0010-remove-information-leak.patch +++ b/nagios-0010-remove-information-leak.patch @@ -1,6 +1,6 @@ -diff -up ./cgi/extinfo.c.rm_youtube ./cgi/extinfo.c ---- ./cgi/extinfo.c.rm_youtube 2018-11-28 14:23:47.609805066 -0600 -+++ ./cgi/extinfo.c 2018-11-28 14:28:35.513997180 -0600 +diff -up ./cgi/extinfo.c.remove_3rdparty_links ./cgi/extinfo.c +--- ./cgi/extinfo.c.remove_3rdparty_links 2019-08-20 15:29:34.000000000 +0000 ++++ ./cgi/extinfo.c 2019-08-29 18:17:32.321544245 +0000 @@ -557,27 +557,6 @@ void document_header(int use_stylesheet) printf("\n", url_stylesheets_path, NAGFUNCS_CSS); } @@ -29,10 +29,10 @@ diff -up ./cgi/extinfo.c.rm_youtube ./cgi/extinfo.c printf("\n"); printf("\n"); -diff -up ./cgi/status.c.rm_youtube ./cgi/status.c ---- ./cgi/status.c.rm_youtube 2018-11-28 14:28:56.072653859 -0600 -+++ ./cgi/status.c 2018-11-28 14:32:05.038498204 -0600 -@@ -537,31 +537,8 @@ void document_header(int use_stylesheet) +diff -up ./cgi/status.c.remove_3rdparty_links ./cgi/status.c +--- ./cgi/status.c.remove_3rdparty_links 2019-08-20 15:29:34.000000000 +0000 ++++ ./cgi/status.c 2019-08-29 18:17:32.322544264 +0000 +@@ -555,31 +555,8 @@ void document_header(int use_stylesheet) /* JS function to append content to elements on page */ printf(" @@ -152,7 +152,7 @@ diff -up ./html/map.php.rm_youtube ./html/map.php - var vboxText = "" + - "Click here to watch the entire Nagios Core 4 Tour!"; - $(document).ready(function() { -- var user = ""; +- var user = ""; - - vBoxId += ";" + user; - vbox = new vidbox({pos:'lr',vidurl:'https://www.youtube.com/embed/leaRdb3BElI', diff --git a/nagios-0011-remove-rpmbuild.patch b/nagios-0011-remove-rpmbuild.patch index 77c6ce6cde44ce5e4edb0603b6cb8e813dceb9b5..401cad04d718a5ff78b442076b0b4ea088f3670c 100644 --- a/nagios-0011-remove-rpmbuild.patch +++ b/nagios-0011-remove-rpmbuild.patch @@ -1,13 +1,16 @@ -diff -up ./contrib/Makefile.in.remove_rpmbuild ./contrib/Makefile.in ---- ./contrib/Makefile.in.remove_rpmbuild 2019-01-16 15:00:18.627548108 -0600 -+++ ./contrib/Makefile.in 2019-01-16 15:00:38.756215308 -0600 -@@ -84,35 +84,3 @@ $(CGI_O): $(CGI_C) +diff --git a/contrib/Makefile.in b/contrib/Makefile.in +index 72e4d4a9..62415152 100644 +--- a/contrib/Makefile.in ++++ b/contrib/Makefile.in +@@ -84,52 +84,3 @@ $(CGI_O): $(CGI_C) %.cgi : %.c $(CC) $(CFLAGS) $(LDFLAGS) $< $(CGI_O) -o $@ - -############################################################################## --# rpm making automation for CentOS/RHEL. +-# making similiar EPEL rpm for Fedora/RHEL/CentOS +- +-ifneq ("$(wildcard /etc/redhat-release)","") - -ARCH ?= $(shell uname -m) -ifeq ($(ARCH),x86_64) @@ -24,16 +27,31 @@ diff -up ./contrib/Makefile.in.remove_rpmbuild ./contrib/Makefile.in - endif -endif - --rpm: +-# Create our own tarball and put ino rpmbuild/SOURCES +-localsrc-rpm: - # create nagios tar ball. - @(cd ..;rm -f nagios-@VERSION@) - @(cd ..;ln -s . nagios-@VERSION@) - @(cd ..;tar zhcf nagios-@VERSION@.tar.gz --exclude nagios-@VERSION@/nagios-@VERSION@.tar.gz --exclude nagios-@VERSION@/nagios-@VERSION@ --exclude RCS --exclude CVS --exclude build-* --exclude *~ --exclude .git* nagios-@VERSION@/) - @(cd ..;rm -f nagios-@VERSION@) - # build the rpm using rpmbuild from ./rmbuild as topdir -- @rm -rf rpmbuild && mkdir -p rpmbuild/SOURCES +- @rm -rf rpmbuild && mkdir -p ./rpmbuild/{BUILD,RPMS,SOURCES,SPECS,SRPMS} - @cp ../nagios-@VERSION@.tar.gz rpmbuild/SOURCES/nagios-@VERSION@.tar.gz -- @rpmbuild -ba --define "_topdir ${PWD}/rpmbuild" ../nagios.spec -- @mv rpmbuild/RPMS/$(RPM_ARCH)/*.rpm . +- @cp epel-patches/* ./rpmbuild/SOURCES +- @rpmbuild -ba --define "_topdir ${PWD}/rpmbuild" epel-nagios.spec +- @cp rpmbuild/RPMS/$(RPM_ARCH)/*.rpm . +- @cp rpmbuild/SRPMS/*.src.rpm . - @ls -l *.rpm - +-# tarball from https://github.com/NagiosEnterprises/nagioscore/releases/download/nagios-%{version}/nagios-%{version}.tar.gz +-rpm: init-epelrpm build-epelrpm +- @mv rpmbuild/RPMS/$(RPM_ARCH)/*.rpm . +- @ls -l *.rpm +-init-epelrpm: +- # build the rpm using rpmbuild from ./rmbuild as topdir +- @rm -rf ./rpmbuild && mkdir -p ./rpmbuild/{BUILD,RPMS,SOURCES,SPECS,SRPMS} +- @spectool -C ./rpmbuild/SOURCES -g epel-nagios.spec +- @cp epel-patches/* ./rpmbuild/SOURCES +-build-epelrpm: +- @rpmbuild -ba --define "_topdir ${PWD}/rpmbuild" epel-nagios.spec +-endif diff --git a/nagios-0015-Changelog.patch b/nagios-0015-Changelog.patch new file mode 100644 index 0000000000000000000000000000000000000000..5ef34903c79e01effd4cc295c5a98a43032dfe4a --- /dev/null +++ b/nagios-0015-Changelog.patch @@ -0,0 +1,13 @@ +diff --git a/Changelog b/Changelog +index a5fd04c6..51394645 100644 +--- a/Changelog ++++ b/Changelog +@@ -9,7 +9,7 @@ FIXES + * Fixed duplicate properties appearing in statusjson.cgi (#718) (Sebastian Wolf) + * Fixed NERD not building when enabled in ./configure (#723) (Sebastian Wolf) + * Fixed build process when using GCC 10 (#721) (Michael Orlitzky) +-* Fixed postauth vulnerabilities in histogram.js, map.js, trends.js (CVE-2020-1408) (Thanks UraSec Team) (Sebastian Wolf) ++* Fixed postauth vulnerabilities in histogram.js, map.js, trends.js (CVE-2020-13977) (Thanks UraSec Team) (Sebastian Wolf) + * When using systemd, configuration will be verified before reloading (#715) (tatref) + * Fixed HARD OK states triggering on the maximum check attempt (#757) (Sebastian Wolf) + diff --git a/nagios-0015-fix-multiple-definition.patch b/nagios-0015-fix-multiple-definition.patch deleted file mode 100644 index 0b8ca062e85935b04acf706a7f0e75ad3127c7c9..0000000000000000000000000000000000000000 --- a/nagios-0015-fix-multiple-definition.patch +++ /dev/null @@ -1,39 +0,0 @@ ---- ./xdata/xsddefault.c.xiugai 2021-08-03 16:18:47.678788632 +0800 -+++ ./xdata/xsddefault.c 2021-08-03 16:19:25.719135981 +0800 -@@ -38,22 +38,22 @@ - - #ifdef NSCGI - #include "../include/cgiutils.h" --time_t program_start; --int daemon_mode; --time_t last_log_rotation; --int enable_notifications; --int execute_service_checks; --int accept_passive_service_checks; --int execute_host_checks; --int accept_passive_host_checks; --int enable_event_handlers; --int obsess_over_services; --int obsess_over_hosts; -+extern time_t program_start; -+extern int daemon_mode; -+extern time_t last_log_rotation; -+extern int enable_notifications; -+extern int execute_service_checks; -+extern int accept_passive_service_checks; -+extern int execute_host_checks; -+extern int accept_passive_host_checks; -+extern int enable_event_handlers; -+extern int obsess_over_services; -+extern int obsess_over_hosts; - int check_service_freshness; - int check_host_freshness; --int enable_flap_detection; --int process_performance_data; --int nagios_pid; -+extern int enable_flap_detection; -+extern int process_performance_data; -+extern int nagios_pid; - int buffer_stats[1][3]; - int program_stats[MAX_CHECK_STATS_TYPES][3]; - #endif diff --git a/nagios-4.4.3.tar.gz b/nagios-4.4.6.tar.gz similarity index 69% rename from nagios-4.4.3.tar.gz rename to nagios-4.4.6.tar.gz index d7621686ac0bbc9de0b6052be2d27682598db44e..57cbc618199b81c2decd0acb6f5f651d8a7876a3 100644 Binary files a/nagios-4.4.3.tar.gz and b/nagios-4.4.6.tar.gz differ diff --git a/nagios.fc b/nagios.fc new file mode 100644 index 0000000000000000000000000000000000000000..d66d7b737c0116c0ecd0b8d901d281b4dc540689 --- /dev/null +++ b/nagios.fc @@ -0,0 +1,114 @@ +/etc/nagios(/.*)? gen_context(system_u:object_r:nagios_etc_t,s0) +/etc/icinga(/.*)? gen_context(system_u:object_r:nagios_etc_t,s0) +/etc/nagios/nrpe\.cfg -- gen_context(system_u:object_r:nrpe_etc_t,s0) +/etc/nrpe\.d(/.*)? gen_context(system_u:object_r:nrpe_etc_t,s0) +/etc/pnp4nagios(/.*)? gen_context(system_u:object_r:nagios_etc_t,s0) +/etc/rc\.d/init\.d/nagios -- gen_context(system_u:object_r:nagios_initrc_exec_t,s0) +/etc/rc\.d/init\.d/nrpe -- gen_context(system_u:object_r:nagios_initrc_exec_t,s0) + + +/usr/bin/nagios -- gen_context(system_u:object_r:nagios_exec_t,s0) +/usr/bin/icinga -- gen_context(system_u:object_r:nagios_exec_t,s0) +/usr/bin/nrpe -- gen_context(system_u:object_r:nrpe_exec_t,s0) + +/usr/sbin/nagios -- gen_context(system_u:object_r:nagios_exec_t,s0) +/usr/sbin/icinga -- gen_context(system_u:object_r:nagios_exec_t,s0) +/usr/sbin/nrpe -- gen_context(system_u:object_r:nrpe_exec_t,s0) + +/usr/lib/cgi-bin/netsaint(/.*)? gen_context(system_u:object_r:nagios_script_exec_t,s0) +/usr/lib/nagios/cgi(/.*)? gen_context(system_u:object_r:nagios_script_exec_t,s0) +/usr/lib/icinga/cgi(/.*)? gen_context(system_u:object_r:nagios_script_exec_t,s0) + +/var/log/nagios(/.*)? gen_context(system_u:object_r:nagios_log_t,s0) +/var/log/icinga(/.*)? gen_context(system_u:object_r:nagios_log_t,s0) +/var/log/netsaint(/.*)? gen_context(system_u:object_r:nagios_log_t,s0) +/var/log/pnp4nagios(/.*)? gen_context(system_u:object_r:nagios_log_t,s0) + +/var/lib/pnp4nagios(/.*)? gen_context(system_u:object_r:nagios_var_lib_t,s0) + +/var/run/nagios.* gen_context(system_u:object_r:nagios_var_run_t,s0) + +/var/spool/nagios(/.*)? gen_context(system_u:object_r:nagios_spool_t,s0) +/var/spool/icinga(/.*)? gen_context(system_u:object_r:nagios_spool_t,s0) + +ifdef(`distro_debian',` +/usr/sbin/nagios -- gen_context(system_u:object_r:nagios_exec_t,s0) +') +/usr/lib/cgi-bin/nagios(/.+)? gen_context(system_u:object_r:nagios_script_exec_t,s0) +/usr/lib/nagios/cgi-bin(/.*)? gen_context(system_u:object_r:nagios_script_exec_t,s0) + +# admin plugins +/usr/lib/nagios/plugins/check_file_age -- gen_context(system_u:object_r:nagios_admin_plugin_exec_t,s0) + +# check disk plugins +/usr/lib/nagios/plugins/check_disk -- gen_context(system_u:object_r:nagios_checkdisk_plugin_exec_t,s0) +/usr/lib/nagios/plugins/check_disk_smb -- gen_context(system_u:object_r:nagios_checkdisk_plugin_exec_t,s0) +/usr/lib/nagios/plugins/check_ide_smart -- gen_context(system_u:object_r:nagios_checkdisk_plugin_exec_t,s0) +/usr/lib/nagios/plugins/check_linux_raid -- gen_context(system_u:object_r:nagios_checkdisk_plugin_exec_t,s0) + +# mail plugins +/usr/lib/nagios/plugins/check_mailq -- gen_context(system_u:object_r:nagios_mail_plugin_exec_t,s0) + +/usr/lib/pnp4nagios(/.*)? gen_context(system_u:object_r:nagios_var_lib_t,s0) + +# system plugins +/usr/lib(64)?/nagios/plugins/check_breeze -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_dummy -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_flexlm -- gen_context(system_u:object_r:nagios_system_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_ifoperstatus -- gen_context(system_u:object_r:nagios_system_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_ifstatus -- gen_context(system_u:object_r:nagios_system_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_load -- gen_context(system_u:object_r:nagios_system_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_log -- gen_context(system_u:object_r:nagios_system_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_mrtg -- gen_context(system_u:object_r:nagios_system_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_mrtgtraf -- gen_context(system_u:object_r:nagios_system_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_nagios -- gen_context(system_u:object_r:nagios_system_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_nwstat -- gen_context(system_u:object_r:nagios_system_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_overcr -- gen_context(system_u:object_r:nagios_system_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_procs -- gen_context(system_u:object_r:nagios_system_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_sensors -- gen_context(system_u:object_r:nagios_system_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_swap -- gen_context(system_u:object_r:nagios_system_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_users -- gen_context(system_u:object_r:nagios_system_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_wave -- gen_context(system_u:object_r:nagios_system_plugin_exec_t,s0) + +# services plugins +/usr/lib(64)?/nagios/plugins/check_cluster -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_dhcp -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_dig -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_dns -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_game -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_fping -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_hpjd -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_http -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_icmp -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_ircd -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_ldap -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_mysql -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_mysql_query -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_nrpe -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_nt -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_ntp.* -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_oracle -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_pgsql -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_ping -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_radius -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_real -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_rpc -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_tcp -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_time -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_sip -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_smtp -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_snmp.* -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_ssh -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) +/usr/lib(64)?/nagios/plugins/check_ups -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0) + +# openshift plugins +/usr/lib64/nagios/plugins/check_node_accept_status -- gen_context(system_u:object_r:nagios_openshift_plugin_exec_t,s0) +/usr/lib64/nagios/plugins/check_number_openshift_apps -- gen_context(system_u:object_r:nagios_openshift_plugin_exec_t,s0) + +# label all nagios plugin as unconfined by default +/usr/lib/nagios/plugins/.* -- gen_context(system_u:object_r:nagios_unconfined_plugin_exec_t,s0) + +# eventhandlers +/usr/lib/nagios/plugins/eventhandlers(/.*) gen_context(system_u:object_r:nagios_eventhandler_plugin_exec_t,s0) +/usr/lib/icinga/plugins/eventhandlers(/.*) gen_context(system_u:object_r:nagios_eventhandler_plugin_exec_t,s0) + diff --git a/nagios.if b/nagios.if new file mode 100644 index 0000000000000000000000000000000000000000..13a034d1412bef59920bec221de002d3a418b1f5 --- /dev/null +++ b/nagios.if @@ -0,0 +1,367 @@ +## Net Saint / NAGIOS - network monitoring server + +######################################## +## +## Create a set of derived types for various +## nagios plugins, +## +## +## +## The name to be used for deriving type names. +## +## +# +template(`nagios_plugin_template',` + gen_require(` + attribute nagios_plugin_domain; + type nagios_t, nrpe_t; + ') + + type nagios_$1_plugin_t, nagios_plugin_domain; + type nagios_$1_plugin_exec_t; + application_domain(nagios_$1_plugin_t, nagios_$1_plugin_exec_t) + role system_r types nagios_$1_plugin_t; + + domtrans_pattern(nrpe_t, nagios_$1_plugin_exec_t, nagios_$1_plugin_t) + allow nagios_t nagios_$1_plugin_exec_t:file ioctl; + + # needed by command.cfg + domtrans_pattern(nagios_t, nagios_$1_plugin_exec_t, nagios_$1_plugin_t) + + kernel_read_system_state(nagios_$1_plugin_t) + +') + +######################################## +## +## Execute the nagios unconfined plugins with +## a domain transition. +## +## +## +## Domain allowed access. +## +## +# +interface(`nagios_domtrans_unconfined_plugins',` + gen_require(` + type nagios_unconfined_plugin_t; + type nagios_unconfined_plugin_exec_t; + ') + + domtrans_pattern($1, nagios_unconfined_plugin_exec_t, nagios_unconfined_plugin_t) +') + +######################################## +## +## Do not audit attempts to read or write nagios +## unnamed pipes. +## +## +## +## Domain to not audit. +## +## +# +interface(`nagios_dontaudit_rw_pipes',` + gen_require(` + type nagios_t; + ') + + dontaudit $1 nagios_t:fifo_file rw_fifo_file_perms; +') + +######################################## +## +## Allow the specified domain to read +## nagios configuration files. +## +## +## +## Domain allowed access. +## +## +## +# +interface(`nagios_read_config',` + gen_require(` + type nagios_etc_t; + ') + + allow $1 nagios_etc_t:dir list_dir_perms; + allow $1 nagios_etc_t:file read_file_perms; + files_search_etc($1) +') +###################################### +## +## Read nagios lib files. +## +## +## +## Domain allowed access. +## +## +# +interface(`nagios_read_lib',` + gen_require(` + type nagios_var_lib_t; + ') + + files_search_var($1) + list_dirs_pattern($1, nagios_var_lib_t, nagios_var_lib_t) + read_files_pattern($1, nagios_var_lib_t, nagios_var_lib_t) +') + +###################################### +## +## Read nagios logs. +## +## +## +## Domain allowed access. +## +## +# +interface(`nagios_read_log',` + gen_require(` + type nagios_log_t; + ') + + logging_search_logs($1) + read_files_pattern($1, nagios_log_t, nagios_log_t) +') + +######################################## +## +## Do not audit attempts to read or write nagios logs. +## +## +## +## Domain to not audit. +## +## +# +interface(`nagios_dontaudit_rw_log',` + gen_require(` + type nagios_log_t; + ') + + dontaudit $1 nagios_log_t:file rw_file_perms; +') + +######################################## +## +## Search nagios spool directories. +## +## +## +## Domain allowed access. +## +## +# +interface(`nagios_search_spool',` + gen_require(` + type nagios_spool_t; + ') + + allow $1 nagios_spool_t:dir search_dir_perms; + files_search_spool($1) +') + +######################################## +## +## Append nagios spool files. +## +## +## +## Domain allowed access. +## +## +# +interface(`nagios_append_spool',` + gen_require(` + type nagios_spool_t; + ') + + allow $1 nagios_spool_t:file append_file_perms; + files_search_spool($1) +') + +######################################## +## +## Allow the specified domain to read +## nagios temporary files. +## +## +## +## Domain allowed access. +## +## +# +interface(`nagios_read_tmp_files',` + gen_require(` + type nagios_tmp_t; + ') + + allow $1 nagios_tmp_t:file read_file_perms; + files_search_tmp($1) +') + +######################################## +## +## Allow the specified domain to read +## nagios temporary files. +## +## +## +## Domain allowed access. +## +## +# +interface(`nagios_rw_inerited_tmp_files',` + gen_require(` + type nagios_tmp_t; + ') + + allow $1 nagios_tmp_t:file rw_inherited_file_perms; + files_search_tmp($1) +') + +######################################## +## +## Execute the nagios NRPE with +## a domain transition. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`nagios_domtrans_nrpe',` + gen_require(` + type nrpe_t, nrpe_exec_t; + ') + + domtrans_pattern($1, nrpe_exec_t, nrpe_t) +') + +###################################### +## +## Do not audit attempts to write nrpe daemon unnamed pipes. +## +## +## +## Domain allowed access. +## +## +# +interface(`nagios_dontaudit_write_pipes_nrpe',` + gen_require(` + type nrpe_t; + ') + + dontaudit $1 nrpe_t:fifo_file write; +') + +######################################## +## +## All of the rules required to administrate +## an nagios environment +## +## +## +## Domain allowed access. +## +## +## +## +## The role to be allowed to manage the nagios domain. +## +## +## +# +interface(`nagios_admin',` + gen_require(` + type nagios_t, nrpe_t, nagios_initrc_exec_t; + type nagios_tmp_t, nagios_log_t, nagios_var_run_t; + type nagios_etc_t, nrpe_etc_t, nagios_spool_t; + ') + + allow $1 nagios_t:process signal_perms; + ps_process_pattern($1, nagios_t) + tunable_policy(`deny_ptrace',`',` + allow $1 nagios_t:process ptrace; + ') + + init_labeled_script_domtrans($1, nagios_initrc_exec_t) + domain_system_change_exemption($1) + role_transition $2 nagios_initrc_exec_t system_r; + allow $2 system_r; + + files_list_tmp($1) + admin_pattern($1, nagios_tmp_t) + + logging_list_logs($1) + admin_pattern($1, nagios_log_t) + + files_list_etc($1) + admin_pattern($1, nagios_etc_t) + + files_list_spool($1) + admin_pattern($1, nagios_spool_t) + + files_list_pids($1) + admin_pattern($1, nagios_var_run_t) + + admin_pattern($1, nrpe_etc_t) +') + +######################################## +## +## Send a null signal to nagios_unconfined_plugin. +## +## +## +## Domain allowed access. +## +## +# +interface(`nagios_unconfined_signull',` + gen_require(` + type nagios_unconfined_plugin_t; + ') + + allow $1 nagios_unconfined_plugin_t:process signull; +') + +######################################## +# +# Nagios interface compatibility blocks +# +# The following definitions ensure compatibility with distribution policy +# versions that do not contain given interfaces (epel, or older Fedora +# releases). +# Each block tests for existence of given interface and defines it if needed. +# + +######################################## +## +## Allow caller to signull sssd. +## Backport from RHEL8 +## +## +## +## Domain allowed access. +## +## +# +ifndef(`sssd_signull',` + interface(`sssd_signull',` + gen_require(` + type sssd_t; + ') + + allow $1 sssd_t:process signull; + ') +') diff --git a/nagios.spec b/nagios.spec index 0bac2f57808a837b9091b37f07f75c8d0520d8d3..f2c4b1440d2e2062c1620bae7431e469a7870774 100644 --- a/nagios.spec +++ b/nagios.spec @@ -1,6 +1,6 @@ Name: nagios -Version: 4.4.3 -Release: 8 +Version: 4.4.6 +Release: 1 Summary: Host/service/network monitoring program License: GPLv2 URL: https://www.nagios.org/projects/nagios-core/ @@ -31,7 +31,7 @@ Patch0011: nagios-0011-remove-rpmbuild.patch Patch0012: nagios-0012-fix-spool.patch Patch0013: nagios-0013-fix-plugin.patch Patch0014: nagios-0014-fix-uidgid.patch -Patch0015: nagios-0015-fix-multiple-definition.patch +Patch0015: nagios-0015-Changelog.patch BuildRequires: doxygen gcc gperf libjpeg-devel libpng-devel zlib-devel gd-devel > 1.8 BuildRequires: perl-generators perl(CPAN) perl(ExtUtils::MakeMaker) perl(ExtUtils::Embed) BuildRequires: perl(Test::Harness) perl(Test::More) perl(Test::Simple) @@ -64,7 +64,7 @@ Provides common directories, uid and gid among nagios-related packages. %package devel Summary: Provides include files that Nagios-related applications may compile against -Requires: nagios = 4.4.3-%release +Requires: nagios = 4.4.6-%release %description devel Nagios is a program that will monitor hosts and services on your @@ -77,7 +77,7 @@ may compile against. %package selinux Summary: SELinux context for nagios -Requires: nagios = 4.4.3-%release +Requires: nagios = 4.4.6-%release Requires(post): policycoreutils Requires(postun): policycoreutils @@ -87,13 +87,13 @@ SElinux context for nagios. %package contrib Summary: Eventhandlers contributed to nagios -Requires: nagios = 4.4.3-%release +Requires: nagios = 4.4.6-%release %description contrib Various contributed items used by plugins and other tools. %prep -%autosetup -n nagioscore-nagios-4.4.3 -p1 +%autosetup -n nagioscore-nagios-4.4.6 -p1 install -p -m 0644 %{SOURCE10} %{SOURCE11} %{SOURCE12} html/images/logos/ @@ -277,6 +277,9 @@ fi %{_libdir}/%{name}/cgi/ %changelog +* Tue Jan 18 2022 SimpleUpdate Robot - 4.4.6-1 +- Upgrade to version 4.4.6 + * Mon Aug 2 2021 shdluan - 4.4.3-8 -fix pack failure when use gcc 10 diff --git a/nagios.te b/nagios.te new file mode 100644 index 0000000000000000000000000000000000000000..b86a8ddb9d41cd3d11c4115a0dc2972495750118 --- /dev/null +++ b/nagios.te @@ -0,0 +1,667 @@ +policy_module(nagios, 1.13.0) + +######################################## +# +# Declarations +# + +## +##

+## Allow nagios/nrpe to call sudo from NRPE utils scripts. +##

+## +gen_tunable(nagios_run_sudo, false) + +## +##

+## Allow nagios run in conjunction with PNP4Nagios. +##

+## +gen_tunable(nagios_run_pnp4nagios, false) + +## +##

+## Determine whether Nagios, NRPE can +## access nfs file systems. +##

+## +gen_tunable(nagios_use_nfs, false) + +gen_require(` + class passwd rootok; + class passwd passwd; +') + +attribute nagios_plugin_domain; + +type nagios_t; +type nagios_exec_t; +init_daemon_domain(nagios_t, nagios_exec_t) + +type nagios_etc_t; +files_config_file(nagios_etc_t) + +type nagios_initrc_exec_t; +init_script_file(nagios_initrc_exec_t) + +type nagios_log_t; +logging_log_file(nagios_log_t) + +type nagios_tmp_t; +files_tmp_file(nagios_tmp_t) + +type nagios_var_run_t; +files_pid_file(nagios_var_run_t) + +type nagios_spool_t; +files_spool_file(nagios_spool_t) + +type nagios_var_lib_t; +files_type(nagios_var_lib_t) + +nagios_plugin_template(admin) +nagios_plugin_template(checkdisk) +nagios_plugin_template(mail) +nagios_plugin_template(services) +nagios_plugin_template(system) +nagios_plugin_template(unconfined) +nagios_plugin_template(eventhandler) +nagios_plugin_template(openshift) + +type nagios_eventhandler_plugin_tmp_t; +files_tmp_file(nagios_eventhandler_plugin_tmp_t) + +type nagios_system_plugin_tmp_t; +files_tmp_file(nagios_system_plugin_tmp_t) + +type nagios_openshift_plugin_tmp_t; +files_tmp_file(nagios_openshift_plugin_tmp_t) + +type nrpe_t; +type nrpe_exec_t; +init_daemon_domain(nrpe_t, nrpe_exec_t) + +type nrpe_etc_t; +files_config_file(nrpe_etc_t) + +type nrpe_var_run_t; +files_pid_file(nrpe_var_run_t) + +###################################### +# +# Common plugin domain local policy +# + +allow nagios_plugin_domain self:fifo_file rw_fifo_file_perms; + +allow nrpe_t nagios_plugin_domain:process { sigkill signal }; + +allow nagios_t nagios_plugin_domain:process signal_perms; +allow nagios_plugin_domain nagios_t:process signal_perms; + +# cjp: leaked file descriptor +dontaudit nagios_plugin_domain nrpe_t:tcp_socket { read write }; +dontaudit nagios_plugin_domain nagios_log_t:file { read write }; + +dev_read_urand(nagios_plugin_domain) +dev_read_rand(nagios_plugin_domain) +dev_read_sysfs(nagios_plugin_domain) + +userdom_use_inherited_user_ptys(nagios_plugin_domain) +userdom_use_inherited_user_ttys(nagios_plugin_domain) + +######################################## +# +# Nagios local policy +# + +allow nagios_t self:capability { chown dac_read_search setgid setuid }; +dontaudit nagios_t self:capability sys_tty_config; +allow nagios_t self:process { setpgid signal_perms }; +allow nagios_t self:fifo_file rw_fifo_file_perms; +allow nagios_t self:tcp_socket { accept listen }; +allow nagios_t self:unix_stream_socket { connectto }; + +allow nagios_t nagios_plugin_domain:process signal_perms; + +allow nagios_t nagios_eventhandler_plugin_exec_t:dir list_dir_perms; + +allow nagios_t nagios_etc_t:dir list_dir_perms; +allow nagios_t nagios_etc_t:file { map read_file_perms }; +allow nagios_t nagios_etc_t:lnk_file read_lnk_file_perms; + +#allow nagios_t nagios_log_t:dir setattr_dir_perms; +#append_files_pattern(nagios_t, nagios_log_t, nagios_log_t) +#create_files_pattern(nagios_t, nagios_log_t, nagios_log_t) +#setattr_files_pattern(nagios_t, nagios_log_t, nagios_log_t) +manage_files_pattern(nagios_t, nagios_log_t, nagios_log_t) +manage_dirs_pattern(nagios_t, nagios_log_t, nagios_log_t) +logging_log_filetrans(nagios_t, nagios_log_t, { dir file }) +allow nagios_t nagios_log_t:file map; + +manage_dirs_pattern(nagios_t, nagios_tmp_t, nagios_tmp_t) +manage_files_pattern(nagios_t, nagios_tmp_t, nagios_tmp_t) +files_tmp_filetrans(nagios_t, nagios_tmp_t, { dir file }) + +manage_files_pattern(nagios_t, nagios_var_run_t, nagios_var_run_t) +files_pid_filetrans(nagios_t, nagios_var_run_t, file) + +manage_fifo_files_pattern(nagios_t, nagios_spool_t, nagios_spool_t) +manage_files_pattern(nagios_t, nagios_spool_t, nagios_spool_t) +manage_sock_files_pattern(nagios_t, nagios_spool_t, nagios_spool_t) +files_spool_filetrans(nagios_t, nagios_spool_t, { file fifo_file }) +allow nagios_t nagios_spool_t:file map; + +manage_files_pattern(nagios_t, nagios_var_lib_t, nagios_var_lib_t) +manage_fifo_files_pattern(nagios_t, nagios_var_lib_t, nagios_var_lib_t) +manage_dirs_pattern(nagios_t, nagios_var_lib_t, nagios_var_lib_t) +files_var_lib_filetrans(nagios_t, nagios_var_lib_t, { dir file fifo_file }) + +kernel_read_system_state(nagios_t) +kernel_read_kernel_sysctls(nagios_t) +kernel_read_software_raid_state(nagios_t) + +corecmd_exec_bin(nagios_t) +corecmd_exec_shell(nagios_t) + +corenet_all_recvfrom_netlabel(nagios_t) +corenet_tcp_sendrecv_generic_if(nagios_t) +corenet_tcp_sendrecv_generic_node(nagios_t) + +corenet_sendrecv_all_client_packets(nagios_t) +corenet_tcp_connect_all_ports(nagios_t) +corenet_tcp_sendrecv_all_ports(nagios_t) + +corenet_dontaudit_tcp_bind_all_reserved_ports(nagios_t) +corenet_dontaudit_udp_bind_all_reserved_ports(nagios_t) + +dev_read_sysfs(nagios_t) +dev_read_urand(nagios_t) + +domain_use_interactive_fds(nagios_t) +domain_read_all_domains_state(nagios_t) + +files_read_etc_runtime_files(nagios_t) +files_read_kernel_symbol_table(nagios_t) +files_search_spool(nagios_t) + +fs_getattr_all_fs(nagios_t) +fs_search_auto_mountpoints(nagios_t) +fs_search_cgroup_dirs(nagios_t) + +hostname_exec(nagios_t) + +auth_use_nsswitch(nagios_t) + +logging_send_syslog_msg(nagios_t) +libs_exec_ldconfig(nagios_t) + +userdom_dontaudit_use_unpriv_user_fds(nagios_t) +userdom_dontaudit_search_user_home_dirs(nagios_t) + +mta_send_mail(nagios_t) +mta_signal_system_mail(nagios_t) +mta_kill_system_mail(nagios_t) + +systemd_exec_systemctl(nagios_t) + +tunable_policy(`nagios_run_sudo',` + allow nagios_t self:capability { chown setgid setuid sys_ptrace sys_resource }; + allow nagios_t self:process { setrlimit setsched }; + + allow nagios_t self:key write; + + allow nagios_t self:passwd { passwd rootok }; + + auth_rw_lastlog(nagios_t) + auth_rw_faillog(nagios_t) + + auth_domtrans_chkpwd(nagios_t) + + selinux_compute_access_vector(nagios_t) + + systemd_write_inherited_logind_sessions_pipes(nagios_t) + systemd_dbus_chat_logind(nagios_t) + + logging_send_audit_msgs(nagios_t) +') + +optional_policy(` + apache_systemctl(nagios_t) +') + +optional_policy(` + dbus_system_bus_client(nagios_t) +') + +optional_policy(` + tunable_policy(`nagios_run_sudo',` + sudo_exec(nagios_t) + sudo_manage_db(nagios_t) + ') +') + +optional_policy(` + tunable_policy(`nagios_run_sudo',` + init_read_utmp(nagios_t) + ') +') + +tunable_policy(`nagios_run_pnp4nagios',` + allow nagios_t nagios_log_t:file execute; +') + +tunable_policy(`nagios_use_nfs',` + fs_manage_nfs_files(nagios_t) + fs_manage_nfs_dirs(nagios_t) + fs_manage_nfs_symlinks(nagios_t) +') + +optional_policy(` + netutils_kill_ping(nagios_t) +') + +optional_policy(` + seutil_sigchld_newrole(nagios_t) +') + +optional_policy(` + udev_read_db(nagios_t) +') + +######################################## +# +# CGI local policy +# + +optional_policy(` + apache_content_template(nagios) + apache_content_alias_template(nagios, nagios) + typealias nagios_script_t alias nagios_cgi_t; + typealias nagios_script_exec_t alias nagios_cgi_exec_t; + + allow nagios_script_t self:process signal_perms; + + read_files_pattern(nagios_script_t, nagios_t, nagios_t) + read_lnk_files_pattern(nagios_script_t, nagios_t, nagios_t) + + allow nagios_script_t nagios_etc_t:dir list_dir_perms; + allow nagios_script_t nagios_etc_t:file { map read_file_perms }; + allow nagios_script_t nagios_etc_t:lnk_file read_lnk_file_perms; + + files_search_spool(nagios_script_t) + rw_fifo_files_pattern(nagios_script_t, nagios_spool_t, nagios_spool_t) + read_files_pattern(nagios_script_t, nagios_spool_t, nagios_spool_t) + allow nagios_script_t nagios_spool_t:file map; + + allow nagios_script_t nagios_log_t:dir list_dir_perms; + read_files_pattern(nagios_script_t, nagios_etc_t, nagios_log_t) + read_lnk_files_pattern(nagios_script_t, nagios_etc_t, nagios_log_t) + allow nagios_script_t nagios_log_t:file map; + + kernel_read_system_state(nagios_script_t) + + domain_dontaudit_read_all_domains_state(nagios_script_t) + + files_read_etc_runtime_files(nagios_script_t) + files_read_kernel_symbol_table(nagios_script_t) + + dev_list_sysfs(nagios_script_t) + + logging_send_syslog_msg(nagios_script_t) +') + +######################################## +# +# Nrpe local policy +# + +allow nrpe_t self:capability { kill setgid setuid }; +dontaudit nrpe_t self:capability { sys_resource sys_tty_config }; +allow nrpe_t self:process { setpgid setrlimit setsched signal_perms }; +allow nrpe_t self:fifo_file rw_fifo_file_perms; +allow nrpe_t self:tcp_socket { accept listen }; + +allow nrpe_t nagios_plugin_domain:process { sigkill signal }; + +list_dirs_pattern(nrpe_t, nrpe_etc_t, nrpe_etc_t) +read_files_pattern(nrpe_t, nagios_etc_t, nrpe_etc_t) + +manage_files_pattern(nrpe_t, nrpe_var_run_t, nrpe_var_run_t) +files_pid_filetrans(nrpe_t, nrpe_var_run_t, file) + +domtrans_pattern(nrpe_t, nagios_checkdisk_plugin_exec_t, nagios_checkdisk_plugin_t) + +kernel_read_system_state(nrpe_t) +kernel_read_kernel_sysctls(nrpe_t) +kernel_read_software_raid_state(nrpe_t) +kernel_read_fs_sysctls(nrpe_t) + +can_exec(nagios_t, nagios_exec_t) + +corecmd_exec_bin(nrpe_t) +corecmd_exec_shell(nrpe_t) + +corenet_all_recvfrom_unlabeled(nrpe_t) +corenet_all_recvfrom_netlabel(nrpe_t) +corenet_tcp_sendrecv_generic_if(nrpe_t) +corenet_tcp_sendrecv_generic_node(nrpe_t) +corenet_tcp_bind_generic_node(nrpe_t) + +corenet_sendrecv_inetd_child_server_packets(nrpe_t) +corenet_tcp_bind_inetd_child_port(nrpe_t) +corenet_tcp_sendrecv_inetd_child_port(nrpe_t) + +dev_read_sysfs(nrpe_t) +dev_read_urand(nrpe_t) +dev_rw_lvm_control(nrpe_t) + +domain_use_interactive_fds(nrpe_t) +domain_read_all_domains_state(nrpe_t) + +files_list_var(nrpe_t) +files_read_etc_runtime_files(nrpe_t) + +fs_getattr_all_fs(nrpe_t) +fs_search_auto_mountpoints(nrpe_t) + +auth_use_nsswitch(nrpe_t) + +logging_send_syslog_msg(nrpe_t) + +userdom_dontaudit_use_unpriv_user_fds(nrpe_t) + +tunable_policy(`nagios_run_sudo',` + allow nrpe_t self:capability { setgid setuid sys_ptrace sys_resource }; + allow nrpe_t self:process { setrlimit setsched }; + + allow nrpe_t self:key write; + + allow nrpe_t self:passwd { passwd rootok }; + + auth_rw_lastlog(nrpe_t) + auth_rw_faillog(nrpe_t) + + auth_domtrans_chkpwd(nrpe_t) + + init_read_utmp(nrpe_t) + + selinux_compute_access_vector(nrpe_t) + + systemd_write_inherited_logind_sessions_pipes(nrpe_t) + systemd_dbus_chat_logind(nrpe_t) + + logging_send_audit_msgs(nrpe_t) +') + +optional_policy(` + tunable_policy(`nagios_run_sudo',` + sudo_exec(nrpe_t) + sudo_manage_db(nrpe_t) + ') +') + +optional_policy(` + tunable_policy(`nagios_run_sudo',` + sssd_read_config(nrpe_t) + sssd_manage_lib_files(nrpe_t) + sssd_read_pid_files(nrpe_t) + sssd_signull(nrpe_t) + ') +') + +tunable_policy(`nagios_use_nfs',` + fs_manage_nfs_files(nrpe_t) + fs_manage_nfs_dirs(nrpe_t) + fs_manage_nfs_symlinks(nrpe_t) +') + +optional_policy(` + dbus_system_bus_client(nrpe_t) +') + +optional_policy(` + inetd_tcp_service_domain(nrpe_t, nrpe_exec_t) +') + +optional_policy(` + lvm_read_metadata(nrpe_t) +') + +optional_policy(` + mta_send_mail(nrpe_t) +') + +optional_policy(` + seutil_sigchld_newrole(nrpe_t) +') + +optional_policy(` + tcpd_wrapped_domain(nrpe_t, nrpe_exec_t) +') + +optional_policy(` + udev_read_db(nrpe_t) +') + +##################################### +# +# Admin local policy +# + +corecmd_read_bin_files(nagios_admin_plugin_t) +corecmd_read_bin_symlinks(nagios_admin_plugin_t) + +dev_getattr_all_chr_files(nagios_admin_plugin_t) +dev_getattr_all_blk_files(nagios_admin_plugin_t) + +files_getattr_all_dirs(nagios_admin_plugin_t) +files_getattr_all_files(nagios_admin_plugin_t) +files_getattr_all_symlinks(nagios_admin_plugin_t) +files_getattr_all_pipes(nagios_admin_plugin_t) +files_getattr_all_sockets(nagios_admin_plugin_t) +files_getattr_all_file_type_fs(nagios_admin_plugin_t) + +###################################### +# +# Mail local policy +# + +allow nagios_mail_plugin_t self:capability { dac_read_search setgid setuid }; +allow nagios_mail_plugin_t self:netlink_route_socket r_netlink_socket_perms; +allow nagios_mail_plugin_t self:tcp_socket create_stream_socket_perms; +allow nagios_mail_plugin_t self:udp_socket create_socket_perms; + +kernel_read_kernel_sysctls(nagios_mail_plugin_t) + +corecmd_read_bin_files(nagios_mail_plugin_t) +corecmd_read_bin_symlinks(nagios_mail_plugin_t) + +logging_send_syslog_msg(nagios_mail_plugin_t) + +sysnet_dns_name_resolve(nagios_mail_plugin_t) + +optional_policy(` + mta_send_mail(nagios_mail_plugin_t) +') + +optional_policy(` + nscd_dontaudit_search_pid(nagios_mail_plugin_t) +') + +optional_policy(` + postfix_stream_connect_master(nagios_mail_plugin_t) + postfix_exec_postqueue(nagios_mail_plugin_t) +') + +###################################### +# +# Disk local policy +# + +allow nagios_checkdisk_plugin_t self:capability { sys_admin sys_rawio }; + +kernel_read_software_raid_state(nagios_checkdisk_plugin_t) + +corecmd_exec_bin(nagios_checkdisk_plugin_t) + +files_getattr_all_dirs(nagios_checkdisk_plugin_t) +files_getattr_all_mountpoints(nagios_checkdisk_plugin_t) +files_read_etc_runtime_files(nagios_checkdisk_plugin_t) + +fs_read_configfs_files(nagios_checkdisk_plugin_t) +fs_read_configfs_dirs(nagios_checkdisk_plugin_t) +fs_getattr_all_fs(nagios_checkdisk_plugin_t) + +storage_raw_read_fixed_disk(nagios_checkdisk_plugin_t) + +####################################### +# +# Services local policy +# + +allow nagios_services_plugin_t self:capability { net_bind_service net_raw setuid }; +allow nagios_services_plugin_t self:process { sigkill signal }; +allow nagios_services_plugin_t self:tcp_socket create_stream_socket_perms; +allow nagios_services_plugin_t self:udp_socket create_socket_perms; +allow nagios_services_plugin_t self:unix_dgram_socket create_socket_perms; +allow nagios_services_plugin_t self:rawip_socket create_socket_perms; + +corecmd_exec_bin(nagios_services_plugin_t) + +corenet_all_recvfrom_unlabeled(nagios_services_plugin_t) +corenet_all_recvfrom_netlabel(nagios_services_plugin_t) +corenet_tcp_sendrecv_generic_if(nagios_services_plugin_t) +corenet_udp_sendrecv_generic_if(nagios_services_plugin_t) +corenet_tcp_sendrecv_generic_node(nagios_services_plugin_t) +corenet_udp_sendrecv_generic_node(nagios_services_plugin_t) +corenet_udp_bind_generic_node(nagios_services_plugin_t) + +corenet_sendrecv_all_client_packets(nagios_services_plugin_t) +corenet_tcp_connect_all_ports(nagios_services_plugin_t) +corenet_tcp_sendrecv_all_ports(nagios_services_plugin_t) + +corenet_sendrecv_dhcpc_server_packets(nagios_services_plugin_t) +corenet_udp_bind_dhcpc_port(nagios_services_plugin_t) +corenet_udp_sendrecv_dhcpc_port(nagios_services_plugin_t) + +auth_use_nsswitch(nagios_services_plugin_t) + +domain_read_all_domains_state(nagios_services_plugin_t) +logging_send_syslog_msg(nagios_services_plugin_t) + +optional_policy(` + netutils_domtrans_ping(nagios_services_plugin_t) + netutils_signal_ping(nagios_services_plugin_t) + netutils_kill_ping(nagios_services_plugin_t) +') + +optional_policy(` + mysql_stream_connect(nagios_services_plugin_t) + mysql_read_config(nagios_services_plugin_t) +') + +optional_policy(` + postgresql_stream_connect(nagios_services_plugin_t) +') + +optional_policy(` + snmp_read_snmp_var_lib_files(nagios_services_plugin_t) +') + +###################################### +# +# System local policy +# + +allow nagios_system_plugin_t self:capability { dac_read_search }; +dontaudit nagios_system_plugin_t self:capability { setgid setuid }; + +allow nagios_system_plugin_t nrpe_exec_t:file read_file_perms; +allow nagios_system_plugin_t nagios_exec_t:file read_file_perms; + +read_files_pattern(nagios_system_plugin_t, nagios_log_t, nagios_log_t) +read_files_pattern(nagios_system_plugin_t, nagios_spool_t, nagios_spool_t) +manage_files_pattern(nagios_system_plugin_t, nagios_system_plugin_tmp_t, nagios_system_plugin_tmp_t) +manage_dirs_pattern(nagios_system_plugin_t, nagios_system_plugin_tmp_t, nagios_system_plugin_tmp_t) +files_tmp_filetrans(nagios_system_plugin_t, nagios_system_plugin_tmp_t, { dir file }) + +kernel_read_system_state(nagios_system_plugin_t) +kernel_read_kernel_sysctls(nagios_system_plugin_t) + +corecmd_exec_bin(nagios_system_plugin_t) +corecmd_exec_shell(nagios_system_plugin_t) +corecmd_getattr_all_executables(nagios_system_plugin_t) + +dev_read_sysfs(nagios_system_plugin_t) + +domain_read_all_domains_state(nagios_system_plugin_t) + +fs_getattr_all_fs(nagios_system_plugin_t) + +auth_read_passwd(nagios_system_plugin_t) + +optional_policy(` + init_read_utmp(nagios_system_plugin_t) +') + +optional_policy(` + mrtg_read_lib_files(nagios_system_plugin_t) +') + +####################################### +# +# Event local policy +# + +manage_files_pattern(nagios_eventhandler_plugin_t, nagios_eventhandler_plugin_tmp_t, nagios_eventhandler_plugin_tmp_t) +manage_dirs_pattern(nagios_eventhandler_plugin_t, nagios_eventhandler_plugin_tmp_t, nagios_eventhandler_plugin_tmp_t) +files_tmp_filetrans(nagios_eventhandler_plugin_t, nagios_eventhandler_plugin_tmp_t, { dir file }) + +corecmd_exec_bin(nagios_eventhandler_plugin_t) +corecmd_exec_shell(nagios_eventhandler_plugin_t) + +init_domtrans_script(nagios_eventhandler_plugin_t) + +systemd_exec_systemctl(nagios_eventhandler_plugin_t) + +allow nagios_t nagios_eventhandler_plugin_exec_t:dir list_dir_perms; + +optional_policy(` + unconfined_domain(nagios_eventhandler_plugin_t) +') + +######################################## +# +# nagios openshift plugin policy +# + +allow nagios_openshift_plugin_t self:capability sys_ptrace; + +manage_dirs_pattern(nagios_openshift_plugin_t, nagios_openshift_plugin_tmp_t, nagios_openshift_plugin_tmp_t) +manage_files_pattern(nagios_openshift_plugin_t, nagios_openshift_plugin_tmp_t, nagios_openshift_plugin_tmp_t) +files_tmp_filetrans(nagios_openshift_plugin_t, nagios_openshift_plugin_tmp_t, { file dir }) + +corecmd_exec_bin(nagios_openshift_plugin_t) +corecmd_exec_shell(nagios_openshift_plugin_t) + +domain_read_all_domains_state(nagios_openshift_plugin_t) + +fs_getattr_all_fs(nagios_openshift_plugin_t) + +optional_policy(` + apache_read_config(nagios_openshift_plugin_t) +') + +###################################### +# +# nagios plugin domain policy +# + +optional_policy(` + unconfined_domain(nagios_unconfined_plugin_t) +') + +optional_policy(` + systemd_dbus_chat_logind(nagios_unconfined_plugin_t) +') diff --git a/nagios.tmpfiles.conf b/nagios.tmpfiles.conf index 0153653b7e622c541a3c3eae6c954f7a4886fd63..4bb5bc36b97fdf04e9d6fc439c603aab87371ec8 100644 --- a/nagios.tmpfiles.conf +++ b/nagios.tmpfiles.conf @@ -1 +1 @@ -d /var/run/nagios 0755 nagios nagios - +D /run/nagios 0755 nagios nagios -