Compare commits
16 commits
| Author | SHA1 | Date | |
|---|---|---|---|
|
fc5cab84e5 | ||
|
|
f1ff25e370 | ||
|
|
b695526c95 | ||
|
|
940da33123 | ||
|
|
db1df3989a | ||
|
|
8e92554e11 | ||
|
|
5890060d6e | ||
|
|
7e41e4407d | ||
|
|
2013328809 | ||
|
|
3966e705a2 | ||
|
713bf878b2 | ||
|
4cc2d72c78 | ||
|
89afbc836d | ||
|
|
d48cb6280e | ||
|
|
b5389f09f8 | ||
|
dc2b527094 |
9 changed files with 151 additions and 1375 deletions
2
.gitignore
vendored
2
.gitignore
vendored
|
|
@ -20,6 +20,4 @@ nagios-3.2.1.tar.gz
|
|||
/nagioscore-nagios-4.4.7.tar.gz
|
||||
/nagioscore-nagios-4.4.8.tar.gz
|
||||
/nagioscore-nagios-4.4.9.tar.gz
|
||||
/nagioscore-nagios-4.4.10.tar.gz
|
||||
/nagioscore-nagios-4.4.14.tar.gz
|
||||
/nagioscore-nagios-4.5.9.tar.gz
|
||||
|
|
|
|||
|
|
@ -32,7 +32,7 @@ diff -up ./cgi/extinfo.c.remove_3rdparty_links ./cgi/extinfo.c
|
|||
diff -up ./cgi/status.c.remove_3rdparty_links ./cgi/status.c
|
||||
--- ./cgi/status.c.remove_3rdparty_links 2019-08-20 15:29:34.000000000 +0000
|
||||
+++ ./cgi/status.c 2019-08-29 18:17:32.322544264 +0000
|
||||
@@ -556,31 +556,8 @@ void document_header(int use_stylesheet)
|
||||
@@ -555,31 +555,8 @@ void document_header(int use_stylesheet)
|
||||
/* JS function to append content to elements on page */
|
||||
printf("<script type='text/javascript'>\n");
|
||||
if (enable_page_tour == TRUE) {
|
||||
|
|
@ -86,11 +86,10 @@ diff -up ./cgi/tac.c.remove_3rdparty_links ./cgi/tac.c
|
|||
|
||||
|
||||
|
||||
diff --git a/html/main.php b/html/main.php
|
||||
index 15713f8d..91cb1266 100644
|
||||
--- a/html/main.php
|
||||
+++ b/html/main.php
|
||||
@@ -23,21 +23,7 @@ if ($theme != 'dark' && $theme != 'light') {
|
||||
diff -up ./html/main.php.remove_3rdparty_links ./html/main.php
|
||||
--- ./html/main.php.remove_3rdparty_links 2019-08-20 15:29:34.000000000 +0000
|
||||
+++ ./html/main.php 2019-08-29 18:20:16.216716704 +0000
|
||||
@@ -19,20 +19,7 @@ $this_year = '2019';
|
||||
|
||||
<script type='text/javascript'>
|
||||
var cookie;
|
||||
|
|
@ -101,14 +100,67 @@ index 15713f8d..91cb1266 100644
|
|||
- "Click here to watch the entire Nagios Core 4 Tour!</a>";
|
||||
- <?php } ?>
|
||||
$(document).ready(function() {
|
||||
- var user = "<?php echo htmlspecialchars($_SERVER['REMOTE_USER'] ?? ''); ?>";
|
||||
- var user = "<?php echo htmlspecialchars($_SERVER['REMOTE_USER']); ?>";
|
||||
-
|
||||
- <?php if ($cfg["enable_page_tour"]) { ?>
|
||||
- vBoxId += ";" + user;
|
||||
- vbox = new vidbox({pos:'lr',vidurl:'https://www.youtube.com/embed/2hVBAet-XpY',
|
||||
- text:vboxText,vidid:vBoxId});
|
||||
- <?php } ?>
|
||||
-
|
||||
getCoreStatus();
|
||||
});
|
||||
loadRemoteFeed( // Our top banner splash.
|
||||
'#splashbox0-contents', 'corebanner', 1,
|
||||
'', processBannerItem, ''
|
||||
@@ -59,7 +46,6 @@ $this_year = '2019';
|
||||
crossDomain: true,
|
||||
success: function(d, status, jqXHR) {
|
||||
// We should have Internet access, set the playlist HTML.
|
||||
- initializePlaylist();
|
||||
|
||||
var text = ''; // Start with empty text by default.
|
||||
|
||||
@@ -94,19 +80,6 @@ $this_year = '2019';
|
||||
: '';
|
||||
}
|
||||
|
||||
-
|
||||
- // Set our playlist HTML when we know we have Internet access.
|
||||
- var playlistInitialized = false;
|
||||
- function initializePlaylist() {
|
||||
- if (!playlistInitialized) {
|
||||
- playlistInitialized = true;
|
||||
- $('#splashbox3')
|
||||
- .addClass('splashbox3-full')
|
||||
- .removeClass('splashbox3-empty')
|
||||
- .html('<iframe width="100%" height="100%" src="//www.youtube.com/embed/videoseries?list=PLN-ryIrpC_mCUW1DFwZpxpAk00i60lSkE&iv_load_policy=3&rel=0" frameborder="0" allowfullscreen></iframe>');
|
||||
- }
|
||||
- }
|
||||
-
|
||||
// Get the daemon status JSON.
|
||||
function getCoreStatus() {
|
||||
setCoreStatusHTML('passiveonly', 'Checking process status...');
|
||||
diff -up ./html/map.php.remove_3rdparty_links ./html/map.php
|
||||
--- ./html/map.php.remove_3rdparty_links 2019-08-29 18:17:32.324544303 +0000
|
||||
+++ ./html/map.php 2019-08-29 18:20:48.488341376 +0000
|
||||
@@ -71,22 +71,6 @@
|
||||
<script type="text/javascript" src="js/jquery-1.12.4.min.js"></script>
|
||||
<script type="text/javascript" src="js/nag_funcs.js"></script>
|
||||
|
||||
- <?php if ($cfg["enable_page_tour"]) { ?>
|
||||
- <script type='text/javascript'>
|
||||
- var vbox;
|
||||
- var vBoxId = "map";
|
||||
- var vboxText = "<a href=https://www.nagios.com/tours target=_blank>" +
|
||||
- "Click here to watch the entire Nagios Core 4 Tour!</a>";
|
||||
- $(document).ready(function() {
|
||||
- var user = "<?php echo htmlspecialchars($_SERVER['REMOTE_USER']); ?>";
|
||||
-
|
||||
- vBoxId += ";" + user;
|
||||
- vbox = new vidbox({pos:'lr',vidurl:'https://www.youtube.com/embed/leaRdb3BElI',
|
||||
- text:vboxText,vidid:vBoxId});
|
||||
- });
|
||||
- </script>
|
||||
- <?php } ?>
|
||||
-
|
||||
</head>
|
||||
<body ng-controller="mapCtrl" <?php echo $img; ?>>
|
||||
<div id="image-cache" style="display: none;"></div>
|
||||
|
|
|
|||
|
|
@ -1,13 +0,0 @@
|
|||
diff --git a/Changelog b/Changelog
|
||||
index a5fd04c6..51394645 100644
|
||||
--- a/Changelog
|
||||
+++ b/Changelog
|
||||
@@ -9,7 +9,7 @@ FIXES
|
||||
* Fixed duplicate properties appearing in statusjson.cgi (#718) (Sebastian Wolf)
|
||||
* Fixed NERD not building when enabled in ./configure (#723) (Sebastian Wolf)
|
||||
* Fixed build process when using GCC 10 (#721) (Michael Orlitzky)
|
||||
-* Fixed postauth vulnerabilities in histogram.js, map.js, trends.js (CVE-2020-1408) (Thanks UraSec Team) (Sebastian Wolf)
|
||||
+* Fixed postauth vulnerabilities in histogram.js, map.js, trends.js (CVE-2020-13977) (Thanks UraSec Team) (Sebastian Wolf)
|
||||
* When using systemd, configuration will be verified before reloading (#715) (tatref)
|
||||
* Fixed HARD OK states triggering on the maximum check attempt (#757) (Sebastian Wolf)
|
||||
|
||||
114
nagios.fc
114
nagios.fc
|
|
@ -1,114 +0,0 @@
|
|||
/etc/nagios(/.*)? gen_context(system_u:object_r:nagios_etc_t,s0)
|
||||
/etc/icinga(/.*)? gen_context(system_u:object_r:nagios_etc_t,s0)
|
||||
/etc/nagios/nrpe\.cfg -- gen_context(system_u:object_r:nrpe_etc_t,s0)
|
||||
/etc/nrpe\.d(/.*)? gen_context(system_u:object_r:nrpe_etc_t,s0)
|
||||
/etc/pnp4nagios(/.*)? gen_context(system_u:object_r:nagios_etc_t,s0)
|
||||
/etc/rc\.d/init\.d/nagios -- gen_context(system_u:object_r:nagios_initrc_exec_t,s0)
|
||||
/etc/rc\.d/init\.d/nrpe -- gen_context(system_u:object_r:nagios_initrc_exec_t,s0)
|
||||
|
||||
|
||||
/usr/bin/nagios -- gen_context(system_u:object_r:nagios_exec_t,s0)
|
||||
/usr/bin/icinga -- gen_context(system_u:object_r:nagios_exec_t,s0)
|
||||
/usr/bin/nrpe -- gen_context(system_u:object_r:nrpe_exec_t,s0)
|
||||
|
||||
/usr/sbin/nagios -- gen_context(system_u:object_r:nagios_exec_t,s0)
|
||||
/usr/sbin/icinga -- gen_context(system_u:object_r:nagios_exec_t,s0)
|
||||
/usr/sbin/nrpe -- gen_context(system_u:object_r:nrpe_exec_t,s0)
|
||||
|
||||
/usr/lib/cgi-bin/netsaint(/.*)? gen_context(system_u:object_r:nagios_script_exec_t,s0)
|
||||
/usr/lib/nagios/cgi(/.*)? gen_context(system_u:object_r:nagios_script_exec_t,s0)
|
||||
/usr/lib/icinga/cgi(/.*)? gen_context(system_u:object_r:nagios_script_exec_t,s0)
|
||||
|
||||
/var/log/nagios(/.*)? gen_context(system_u:object_r:nagios_log_t,s0)
|
||||
/var/log/icinga(/.*)? gen_context(system_u:object_r:nagios_log_t,s0)
|
||||
/var/log/netsaint(/.*)? gen_context(system_u:object_r:nagios_log_t,s0)
|
||||
/var/log/pnp4nagios(/.*)? gen_context(system_u:object_r:nagios_log_t,s0)
|
||||
|
||||
/var/lib/pnp4nagios(/.*)? gen_context(system_u:object_r:nagios_var_lib_t,s0)
|
||||
|
||||
/var/run/nagios.* gen_context(system_u:object_r:nagios_var_run_t,s0)
|
||||
|
||||
/var/spool/nagios(/.*)? gen_context(system_u:object_r:nagios_spool_t,s0)
|
||||
/var/spool/icinga(/.*)? gen_context(system_u:object_r:nagios_spool_t,s0)
|
||||
|
||||
ifdef(`distro_debian',`
|
||||
/usr/sbin/nagios -- gen_context(system_u:object_r:nagios_exec_t,s0)
|
||||
')
|
||||
/usr/lib/cgi-bin/nagios(/.+)? gen_context(system_u:object_r:nagios_script_exec_t,s0)
|
||||
/usr/lib/nagios/cgi-bin(/.*)? gen_context(system_u:object_r:nagios_script_exec_t,s0)
|
||||
|
||||
# admin plugins
|
||||
/usr/lib/nagios/plugins/check_file_age -- gen_context(system_u:object_r:nagios_admin_plugin_exec_t,s0)
|
||||
|
||||
# check disk plugins
|
||||
/usr/lib/nagios/plugins/check_disk -- gen_context(system_u:object_r:nagios_checkdisk_plugin_exec_t,s0)
|
||||
/usr/lib/nagios/plugins/check_disk_smb -- gen_context(system_u:object_r:nagios_checkdisk_plugin_exec_t,s0)
|
||||
/usr/lib/nagios/plugins/check_ide_smart -- gen_context(system_u:object_r:nagios_checkdisk_plugin_exec_t,s0)
|
||||
/usr/lib/nagios/plugins/check_linux_raid -- gen_context(system_u:object_r:nagios_checkdisk_plugin_exec_t,s0)
|
||||
|
||||
# mail plugins
|
||||
/usr/lib/nagios/plugins/check_mailq -- gen_context(system_u:object_r:nagios_mail_plugin_exec_t,s0)
|
||||
|
||||
/usr/lib/pnp4nagios(/.*)? gen_context(system_u:object_r:nagios_var_lib_t,s0)
|
||||
|
||||
# system plugins
|
||||
/usr/lib(64)?/nagios/plugins/check_breeze -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0)
|
||||
/usr/lib(64)?/nagios/plugins/check_dummy -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0)
|
||||
/usr/lib(64)?/nagios/plugins/check_flexlm -- gen_context(system_u:object_r:nagios_system_plugin_exec_t,s0)
|
||||
/usr/lib(64)?/nagios/plugins/check_ifoperstatus -- gen_context(system_u:object_r:nagios_system_plugin_exec_t,s0)
|
||||
/usr/lib(64)?/nagios/plugins/check_ifstatus -- gen_context(system_u:object_r:nagios_system_plugin_exec_t,s0)
|
||||
/usr/lib(64)?/nagios/plugins/check_load -- gen_context(system_u:object_r:nagios_system_plugin_exec_t,s0)
|
||||
/usr/lib(64)?/nagios/plugins/check_log -- gen_context(system_u:object_r:nagios_system_plugin_exec_t,s0)
|
||||
/usr/lib(64)?/nagios/plugins/check_mrtg -- gen_context(system_u:object_r:nagios_system_plugin_exec_t,s0)
|
||||
/usr/lib(64)?/nagios/plugins/check_mrtgtraf -- gen_context(system_u:object_r:nagios_system_plugin_exec_t,s0)
|
||||
/usr/lib(64)?/nagios/plugins/check_nagios -- gen_context(system_u:object_r:nagios_system_plugin_exec_t,s0)
|
||||
/usr/lib(64)?/nagios/plugins/check_nwstat -- gen_context(system_u:object_r:nagios_system_plugin_exec_t,s0)
|
||||
/usr/lib(64)?/nagios/plugins/check_overcr -- gen_context(system_u:object_r:nagios_system_plugin_exec_t,s0)
|
||||
/usr/lib(64)?/nagios/plugins/check_procs -- gen_context(system_u:object_r:nagios_system_plugin_exec_t,s0)
|
||||
/usr/lib(64)?/nagios/plugins/check_sensors -- gen_context(system_u:object_r:nagios_system_plugin_exec_t,s0)
|
||||
/usr/lib(64)?/nagios/plugins/check_swap -- gen_context(system_u:object_r:nagios_system_plugin_exec_t,s0)
|
||||
/usr/lib(64)?/nagios/plugins/check_users -- gen_context(system_u:object_r:nagios_system_plugin_exec_t,s0)
|
||||
/usr/lib(64)?/nagios/plugins/check_wave -- gen_context(system_u:object_r:nagios_system_plugin_exec_t,s0)
|
||||
|
||||
# services plugins
|
||||
/usr/lib(64)?/nagios/plugins/check_cluster -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0)
|
||||
/usr/lib(64)?/nagios/plugins/check_dhcp -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0)
|
||||
/usr/lib(64)?/nagios/plugins/check_dig -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0)
|
||||
/usr/lib(64)?/nagios/plugins/check_dns -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0)
|
||||
/usr/lib(64)?/nagios/plugins/check_game -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0)
|
||||
/usr/lib(64)?/nagios/plugins/check_fping -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0)
|
||||
/usr/lib(64)?/nagios/plugins/check_hpjd -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0)
|
||||
/usr/lib(64)?/nagios/plugins/check_http -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0)
|
||||
/usr/lib(64)?/nagios/plugins/check_icmp -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0)
|
||||
/usr/lib(64)?/nagios/plugins/check_ircd -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0)
|
||||
/usr/lib(64)?/nagios/plugins/check_ldap -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0)
|
||||
/usr/lib(64)?/nagios/plugins/check_mysql -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0)
|
||||
/usr/lib(64)?/nagios/plugins/check_mysql_query -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0)
|
||||
/usr/lib(64)?/nagios/plugins/check_nrpe -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0)
|
||||
/usr/lib(64)?/nagios/plugins/check_nt -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0)
|
||||
/usr/lib(64)?/nagios/plugins/check_ntp.* -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0)
|
||||
/usr/lib(64)?/nagios/plugins/check_oracle -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0)
|
||||
/usr/lib(64)?/nagios/plugins/check_pgsql -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0)
|
||||
/usr/lib(64)?/nagios/plugins/check_ping -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0)
|
||||
/usr/lib(64)?/nagios/plugins/check_radius -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0)
|
||||
/usr/lib(64)?/nagios/plugins/check_real -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0)
|
||||
/usr/lib(64)?/nagios/plugins/check_rpc -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0)
|
||||
/usr/lib(64)?/nagios/plugins/check_tcp -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0)
|
||||
/usr/lib(64)?/nagios/plugins/check_time -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0)
|
||||
/usr/lib(64)?/nagios/plugins/check_sip -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0)
|
||||
/usr/lib(64)?/nagios/plugins/check_smtp -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0)
|
||||
/usr/lib(64)?/nagios/plugins/check_snmp.* -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0)
|
||||
/usr/lib(64)?/nagios/plugins/check_ssh -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0)
|
||||
/usr/lib(64)?/nagios/plugins/check_ups -- gen_context(system_u:object_r:nagios_services_plugin_exec_t,s0)
|
||||
|
||||
# openshift plugins
|
||||
/usr/lib64/nagios/plugins/check_node_accept_status -- gen_context(system_u:object_r:nagios_openshift_plugin_exec_t,s0)
|
||||
/usr/lib64/nagios/plugins/check_number_openshift_apps -- gen_context(system_u:object_r:nagios_openshift_plugin_exec_t,s0)
|
||||
|
||||
# label all nagios plugin as unconfined by default
|
||||
/usr/lib/nagios/plugins/.* -- gen_context(system_u:object_r:nagios_unconfined_plugin_exec_t,s0)
|
||||
|
||||
# eventhandlers
|
||||
/usr/lib/nagios/plugins/eventhandlers(/.*) gen_context(system_u:object_r:nagios_eventhandler_plugin_exec_t,s0)
|
||||
/usr/lib/icinga/plugins/eventhandlers(/.*) gen_context(system_u:object_r:nagios_eventhandler_plugin_exec_t,s0)
|
||||
|
||||
367
nagios.if
367
nagios.if
|
|
@ -1,367 +0,0 @@
|
|||
## <summary>Net Saint / NAGIOS - network monitoring server</summary>
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Create a set of derived types for various
|
||||
## nagios plugins,
|
||||
## </summary>
|
||||
## <param name="plugins_group_name">
|
||||
## <summary>
|
||||
## The name to be used for deriving type names.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
template(`nagios_plugin_template',`
|
||||
gen_require(`
|
||||
attribute nagios_plugin_domain;
|
||||
type nagios_t, nrpe_t;
|
||||
')
|
||||
|
||||
type nagios_$1_plugin_t, nagios_plugin_domain;
|
||||
type nagios_$1_plugin_exec_t;
|
||||
application_domain(nagios_$1_plugin_t, nagios_$1_plugin_exec_t)
|
||||
role system_r types nagios_$1_plugin_t;
|
||||
|
||||
domtrans_pattern(nrpe_t, nagios_$1_plugin_exec_t, nagios_$1_plugin_t)
|
||||
allow nagios_t nagios_$1_plugin_exec_t:file ioctl;
|
||||
|
||||
# needed by command.cfg
|
||||
domtrans_pattern(nagios_t, nagios_$1_plugin_exec_t, nagios_$1_plugin_t)
|
||||
|
||||
kernel_read_system_state(nagios_$1_plugin_t)
|
||||
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Execute the nagios unconfined plugins with
|
||||
## a domain transition.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`nagios_domtrans_unconfined_plugins',`
|
||||
gen_require(`
|
||||
type nagios_unconfined_plugin_t;
|
||||
type nagios_unconfined_plugin_exec_t;
|
||||
')
|
||||
|
||||
domtrans_pattern($1, nagios_unconfined_plugin_exec_t, nagios_unconfined_plugin_t)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Do not audit attempts to read or write nagios
|
||||
## unnamed pipes.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain to not audit.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`nagios_dontaudit_rw_pipes',`
|
||||
gen_require(`
|
||||
type nagios_t;
|
||||
')
|
||||
|
||||
dontaudit $1 nagios_t:fifo_file rw_fifo_file_perms;
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Allow the specified domain to read
|
||||
## nagios configuration files.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
## <rolecap/>
|
||||
#
|
||||
interface(`nagios_read_config',`
|
||||
gen_require(`
|
||||
type nagios_etc_t;
|
||||
')
|
||||
|
||||
allow $1 nagios_etc_t:dir list_dir_perms;
|
||||
allow $1 nagios_etc_t:file read_file_perms;
|
||||
files_search_etc($1)
|
||||
')
|
||||
######################################
|
||||
## <summary>
|
||||
## Read nagios lib files.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`nagios_read_lib',`
|
||||
gen_require(`
|
||||
type nagios_var_lib_t;
|
||||
')
|
||||
|
||||
files_search_var($1)
|
||||
list_dirs_pattern($1, nagios_var_lib_t, nagios_var_lib_t)
|
||||
read_files_pattern($1, nagios_var_lib_t, nagios_var_lib_t)
|
||||
')
|
||||
|
||||
######################################
|
||||
## <summary>
|
||||
## Read nagios logs.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`nagios_read_log',`
|
||||
gen_require(`
|
||||
type nagios_log_t;
|
||||
')
|
||||
|
||||
logging_search_logs($1)
|
||||
read_files_pattern($1, nagios_log_t, nagios_log_t)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Do not audit attempts to read or write nagios logs.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain to not audit.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`nagios_dontaudit_rw_log',`
|
||||
gen_require(`
|
||||
type nagios_log_t;
|
||||
')
|
||||
|
||||
dontaudit $1 nagios_log_t:file rw_file_perms;
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Search nagios spool directories.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`nagios_search_spool',`
|
||||
gen_require(`
|
||||
type nagios_spool_t;
|
||||
')
|
||||
|
||||
allow $1 nagios_spool_t:dir search_dir_perms;
|
||||
files_search_spool($1)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Append nagios spool files.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`nagios_append_spool',`
|
||||
gen_require(`
|
||||
type nagios_spool_t;
|
||||
')
|
||||
|
||||
allow $1 nagios_spool_t:file append_file_perms;
|
||||
files_search_spool($1)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Allow the specified domain to read
|
||||
## nagios temporary files.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`nagios_read_tmp_files',`
|
||||
gen_require(`
|
||||
type nagios_tmp_t;
|
||||
')
|
||||
|
||||
allow $1 nagios_tmp_t:file read_file_perms;
|
||||
files_search_tmp($1)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Allow the specified domain to read
|
||||
## nagios temporary files.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`nagios_rw_inerited_tmp_files',`
|
||||
gen_require(`
|
||||
type nagios_tmp_t;
|
||||
')
|
||||
|
||||
allow $1 nagios_tmp_t:file rw_inherited_file_perms;
|
||||
files_search_tmp($1)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Execute the nagios NRPE with
|
||||
## a domain transition.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed to transition.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`nagios_domtrans_nrpe',`
|
||||
gen_require(`
|
||||
type nrpe_t, nrpe_exec_t;
|
||||
')
|
||||
|
||||
domtrans_pattern($1, nrpe_exec_t, nrpe_t)
|
||||
')
|
||||
|
||||
######################################
|
||||
## <summary>
|
||||
## Do not audit attempts to write nrpe daemon unnamed pipes.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`nagios_dontaudit_write_pipes_nrpe',`
|
||||
gen_require(`
|
||||
type nrpe_t;
|
||||
')
|
||||
|
||||
dontaudit $1 nrpe_t:fifo_file write;
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## All of the rules required to administrate
|
||||
## an nagios environment
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
## <param name="role">
|
||||
## <summary>
|
||||
## The role to be allowed to manage the nagios domain.
|
||||
## </summary>
|
||||
## </param>
|
||||
## <rolecap/>
|
||||
#
|
||||
interface(`nagios_admin',`
|
||||
gen_require(`
|
||||
type nagios_t, nrpe_t, nagios_initrc_exec_t;
|
||||
type nagios_tmp_t, nagios_log_t, nagios_var_run_t;
|
||||
type nagios_etc_t, nrpe_etc_t, nagios_spool_t;
|
||||
')
|
||||
|
||||
allow $1 nagios_t:process signal_perms;
|
||||
ps_process_pattern($1, nagios_t)
|
||||
tunable_policy(`deny_ptrace',`',`
|
||||
allow $1 nagios_t:process ptrace;
|
||||
')
|
||||
|
||||
init_labeled_script_domtrans($1, nagios_initrc_exec_t)
|
||||
domain_system_change_exemption($1)
|
||||
role_transition $2 nagios_initrc_exec_t system_r;
|
||||
allow $2 system_r;
|
||||
|
||||
files_list_tmp($1)
|
||||
admin_pattern($1, nagios_tmp_t)
|
||||
|
||||
logging_list_logs($1)
|
||||
admin_pattern($1, nagios_log_t)
|
||||
|
||||
files_list_etc($1)
|
||||
admin_pattern($1, nagios_etc_t)
|
||||
|
||||
files_list_spool($1)
|
||||
admin_pattern($1, nagios_spool_t)
|
||||
|
||||
files_list_pids($1)
|
||||
admin_pattern($1, nagios_var_run_t)
|
||||
|
||||
admin_pattern($1, nrpe_etc_t)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Send a null signal to nagios_unconfined_plugin.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`nagios_unconfined_signull',`
|
||||
gen_require(`
|
||||
type nagios_unconfined_plugin_t;
|
||||
')
|
||||
|
||||
allow $1 nagios_unconfined_plugin_t:process signull;
|
||||
')
|
||||
|
||||
########################################
|
||||
#
|
||||
# Nagios interface compatibility blocks
|
||||
#
|
||||
# The following definitions ensure compatibility with distribution policy
|
||||
# versions that do not contain given interfaces (epel, or older Fedora
|
||||
# releases).
|
||||
# Each block tests for existence of given interface and defines it if needed.
|
||||
#
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Allow caller to signull sssd.
|
||||
## Backport from RHEL8
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
ifndef(`sssd_signull',`
|
||||
interface(`sssd_signull',`
|
||||
gen_require(`
|
||||
type sssd_t;
|
||||
')
|
||||
|
||||
allow $1 sssd_t:process signull;
|
||||
')
|
||||
')
|
||||
248
nagios.spec
248
nagios.spec
|
|
@ -1,17 +1,14 @@
|
|||
# Set %%bcond_without bootstrap to build without depending on plugins for localhost monitoring
|
||||
%bcond_with bootstrap
|
||||
|
||||
%global with_selinux 1
|
||||
%global selinuxtype targeted
|
||||
%global _hardened_build 1
|
||||
# Set bootstrap = 1 to build without depending on plugins for localhost monitoring
|
||||
%global bootstrap 0
|
||||
|
||||
Name: nagios
|
||||
Version: 4.5.9
|
||||
Release: 2%{?dist}
|
||||
Version: 4.4.14
|
||||
Release: 3%{?dist}
|
||||
|
||||
Summary: Host/service/network monitoring program
|
||||
|
||||
# Automatically converted from old format: GPLv2 - review is highly recommended.
|
||||
License: GPL-2.0-only
|
||||
License: GPLv2
|
||||
URL: https://www.nagios.org/projects/nagios-core/
|
||||
Source0: https://github.com/NagiosEnterprises/nagioscore/archive/nagios-%{version}.tar.gz#/nagioscore-nagios-%{version}.tar.gz
|
||||
Source1: nagios.logrotate
|
||||
|
|
@ -26,9 +23,9 @@ Source10: printer.png
|
|||
Source11: router.png
|
||||
Source12: switch.png
|
||||
Source13: nagios.README.SELinux.rst
|
||||
Source14: nagios.te
|
||||
Source15: nagios.fc
|
||||
Source16: nagios.if
|
||||
Source14: nagios_epel7.te
|
||||
Source15: nagios_epel.fc
|
||||
Source16: nagios_epel6.te
|
||||
|
||||
Patch1: nagios-0001-default-init.patch
|
||||
# Sent upstream
|
||||
|
|
@ -73,15 +70,21 @@ BuildRequires: libtool
|
|||
# For selinux tools
|
||||
BuildRequires: checkpolicy, selinux-policy-devel
|
||||
|
||||
%if 0%{?rhel} > 6 || 0%{?fedora} > 20
|
||||
# For necessary macros
|
||||
BuildRequires: systemd
|
||||
%endif
|
||||
|
||||
Requires: httpd
|
||||
Requires: php
|
||||
Requires: %{_bindir}/mail
|
||||
Requires: perl(:MODULE_COMPAT_%(eval "`%{__perl} -V:version`"; echo $version))
|
||||
Requires: mailx
|
||||
Requires: nagios-common
|
||||
Requires: user(nagios)
|
||||
Requires: group(nagios)
|
||||
|
||||
# This plugins are required for localhost monitoring
|
||||
%if %{without bootstrap}
|
||||
%if ! 0%{?bootstrap}
|
||||
Requires: nagios-plugins-ping
|
||||
Requires: nagios-plugins-load
|
||||
Requires: nagios-plugins-users
|
||||
|
|
@ -92,12 +95,6 @@ Requires: nagios-plugins-swap
|
|||
Requires: nagios-plugins-procs
|
||||
%endif
|
||||
|
||||
%if 0%{?with_selinux}
|
||||
# This ensures that the *-selinux package and all it’s dependencies are not pulled
|
||||
# into containers and other systems that do not use SELinux
|
||||
Requires: (%{name}-selinux if selinux-policy-%{selinuxtype})
|
||||
%endif
|
||||
|
||||
Requires(pre): group(nagios)
|
||||
Requires(pre): user(nagios)
|
||||
%if 0%{?rhel} > 6 || 0%{?fedora} > 20
|
||||
|
|
@ -126,6 +123,7 @@ files for Nagios. Development files are built as a separate package.
|
|||
|
||||
%package common
|
||||
Summary: Provides common directories, uid and gid among nagios-related packages
|
||||
Requires(pre): shadow-utils
|
||||
Requires(post): shadow-utils
|
||||
Provides: user(nagios)
|
||||
Provides: group(nagios)
|
||||
|
|
@ -151,18 +149,16 @@ that you specify.
|
|||
This package provides include files that Nagios-related applications
|
||||
may compile against.
|
||||
|
||||
%if 0%{?with_selinux}
|
||||
# SELinux subpackage
|
||||
%if 0%{?rhel} > 5
|
||||
%package selinux
|
||||
Summary: SELinux context for %{name}
|
||||
BuildArch: noarch
|
||||
Requires: selinux-policy-%{selinuxtype}
|
||||
Requires(post): selinux-policy-%{selinuxtype}
|
||||
BuildRequires: checkpolicy, selinux-policy-devel
|
||||
%{?selinux_requires}
|
||||
Requires: %name = %version-%release
|
||||
Requires(post): policycoreutils
|
||||
Requires(postun): policycoreutils
|
||||
|
||||
|
||||
%description selinux
|
||||
SElinux security policy for %{name}.
|
||||
SElinux context for %{name}.
|
||||
%endif
|
||||
|
||||
%package contrib
|
||||
|
|
@ -172,23 +168,11 @@ Requires: %name = %version-%release
|
|||
%description contrib
|
||||
Various contributed items used by plugins and other tools.
|
||||
|
||||
%if 0%{?with_selinux}
|
||||
# SELinux contexts are saved so that only affected files can be
|
||||
# relabeled after the policy module installation
|
||||
%pre selinux
|
||||
%selinux_relabel_pre -s %{selinuxtype}
|
||||
%endif
|
||||
|
||||
%prep
|
||||
%autosetup -p1 -n nagioscore-nagios-%{version}
|
||||
|
||||
install -p -m 0644 %{SOURCE10} %{SOURCE11} %{SOURCE12} html/images/logos/
|
||||
|
||||
# Create a sysusers.d config file
|
||||
cat >nagios.sysusers.conf <<EOF
|
||||
u nagios - - %{_localstatedir}/spool/%{name} -
|
||||
EOF
|
||||
|
||||
|
||||
%build
|
||||
%configure \
|
||||
|
|
@ -223,7 +207,6 @@ EOF
|
|||
--with-template-objects \
|
||||
--with-template-extinfo \
|
||||
--enable-event-broker \
|
||||
--disable-static \
|
||||
STRIP=/bin/true
|
||||
|
||||
%make_build all
|
||||
|
|
@ -241,16 +224,18 @@ cp -f %{SOURCE5} UpgradeToVersion4.ReadMe
|
|||
cp -f %{SOURCE6} UpgradeToVersion4.sh
|
||||
echo >> html/stylesheets/common.css
|
||||
|
||||
%if 0%{?with_selinux}
|
||||
%if 0%{?rhel} > 5
|
||||
## SELinux configs
|
||||
mkdir selinux
|
||||
# Shipping the whole nagios policy (originally from selinux-policy-contrib)
|
||||
# this policy module will override the production module
|
||||
cp -p %{SOURCE14} selinux/
|
||||
cp -p %{SOURCE15} selinux/
|
||||
cp -p %{SOURCE16} selinux/
|
||||
|
||||
%make_build -f %{_datadir}/selinux/devel/Makefile %{name}.pp
|
||||
bzip2 -9 %{name}.pp
|
||||
install -pm 644 %{SOURCE13} README.SELinux.rst
|
||||
%if 0%{?rhel} == 6
|
||||
cp -p %{SOURCE16} selinux/%{name}_epel.te
|
||||
%else
|
||||
cp -p %{SOURCE14} selinux/%{name}_epel.te
|
||||
%endif
|
||||
cp -p %{SOURCE15} selinux/%{name}_epel.fc
|
||||
touch selinux/%{name}_epel.if
|
||||
%make_build -f %{_datadir}/selinux/devel/Makefile
|
||||
%endif
|
||||
|
||||
|
||||
|
|
@ -259,9 +244,7 @@ bzip2 -9 %{name}.pp
|
|||
|
||||
# relocated to sbin (Fedora-specific)
|
||||
install -d -m 0755 %{buildroot}%{_bindir}
|
||||
%if 0%{?fedora} < 42 && 0%{?rhel} < 11
|
||||
mv %{buildroot}%{_sbindir}/nagiostats %{buildroot}%{_bindir}/nagiostats
|
||||
%endif
|
||||
|
||||
install -d -m 0755 %{buildroot}%{_sysconfdir}/%{name}/private
|
||||
mv %{buildroot}%{_sysconfdir}/%{name}/resource.cfg %{buildroot}%{_sysconfdir}/%{name}/private/resource.cfg
|
||||
|
|
@ -309,11 +292,9 @@ chmod 755 %{buildroot}%{_sbindir}/nagios %{buildroot}%{_bindir}/nagiostats
|
|||
install -d -m 0755 %{buildroot}%{_datadir}/nagios/html/docs
|
||||
%{__cp} -r Documentation/html/* %{buildroot}%{_datadir}/nagios/html/docs
|
||||
|
||||
%if 0%{?with_selinux}
|
||||
install -pm 0644 %{SOURCE13} README.SELinux.rst
|
||||
install -D -m 0644 %{name}.pp.bz2 %{buildroot}%{_datadir}/selinux/packages/%{selinuxtype}/%{name}.pp.bz2
|
||||
install -D -p -m 0644 selinux/%{name}.if %{buildroot}%{_datadir}/selinux/devel/include/distributed/%{name}.if
|
||||
|
||||
%if 0%{?rhel} >5
|
||||
# Selinux configs
|
||||
install -p -m 644 -D %{name}_epel.pp $RPM_BUILD_ROOT%{_datadir}/selinux/packages/%{name}/%{name}_epel.pp
|
||||
%endif
|
||||
|
||||
### CONTRIB ITEMS TAKEN FROM UPSTREAM NAGIOS SPEC
|
||||
|
|
@ -334,8 +315,10 @@ install -p -m 644 contrib/eventhandlers/redundancy-scenario1/handle-master-proc-
|
|||
# Fix permissions #2275532
|
||||
chmod -R g-w %{buildroot}%{_datadir}/%{name} %{buildroot}%{_libdir}/%{name} %{buildroot}%{_sysconfdir} %{buildroot}%{_sbindir}
|
||||
|
||||
install -m0644 -D nagios.sysusers.conf %{buildroot}%{_sysusersdir}/nagios.conf
|
||||
|
||||
%pre common
|
||||
getent group nagios >/dev/null || groupadd -r nagios
|
||||
getent passwd nagios >/dev/null || useradd -r -g nagios -d %{_localstatedir}/spool/%{name} -s /sbin/nologin nagios
|
||||
exit 0
|
||||
|
||||
|
||||
%post
|
||||
|
|
@ -395,22 +378,49 @@ fi
|
|||
/bin/systemctl try-restart %{name}.service >/dev/null 2>&1 || :
|
||||
%endif
|
||||
|
||||
%if 0%{?with_selinux}
|
||||
%if 0%{?rhel} >5
|
||||
%post selinux
|
||||
%selinux_modules_install -s %{selinuxtype} %{_datadir}/selinux/packages/%{selinuxtype}/%{name}.pp.bz2
|
||||
%selinux_relabel_post -s %{selinuxtype}
|
||||
|
||||
%if 0%{?el5}%{?el6}
|
||||
if [ "$1" -le "1" ]; then # First install
|
||||
semodule -i %{_datadir}/selinux/packages/%{name}/%{name}_epel.pp 2>/dev/null || :
|
||||
fixfiles -R %{name} restore || :
|
||||
/sbin/service %{name} condrestart > /dev/null 2>&1 || :
|
||||
fi
|
||||
%else
|
||||
if [ "$1" -le "1" ]; then # First install
|
||||
semodule -i %{_datadir}/selinux/packages/%{name}/%{name}_epel.pp 2>/dev/null || :
|
||||
fixfiles -R %{name} restore || :
|
||||
%systemd_postun_with_restart %{name}.service
|
||||
fi
|
||||
%endif
|
||||
%endif
|
||||
|
||||
%postun selinux
|
||||
if [ $1 -eq 0 ]; then
|
||||
%selinux_modules_uninstall -s %{selinuxtype} %{name}
|
||||
%selinux_relabel_post -s %{selinuxtype}
|
||||
%if 0%{?rhel} >5
|
||||
%preun selinux
|
||||
%if 0%{?el6}
|
||||
if [ "$1" -lt "1" ]; then # Final removal
|
||||
semodule -r %{name}_epel 2>/dev/null || :
|
||||
fixfiles -R %{name} restore || :
|
||||
/sbin/service %{name} condrestart > /dev/null 2>&1 || :
|
||||
fi
|
||||
%else
|
||||
if [ "$1" -lt "1" ]; then # Final removal
|
||||
semodule -r %{name}_epel 2>/dev/null || :
|
||||
fixfiles -R %{name} restore || :
|
||||
%systemd_postun_with_restart %{name}.service
|
||||
fi
|
||||
%endif
|
||||
%endif
|
||||
|
||||
%if 0%{?rhel} >5
|
||||
%postun selinux
|
||||
if [ "$1" -ge "1" ]; then # Upgrade
|
||||
# Replaces the module if it is already loaded
|
||||
semodule -i %{_datadir}/selinux/packages/%{name}/%{name}_epel.pp 2>/dev/null || :
|
||||
# no need to restart the daemon
|
||||
fi
|
||||
%endif
|
||||
|
||||
|
||||
|
||||
%files
|
||||
|
|
@ -423,11 +433,9 @@ fi
|
|||
%license LICENSE
|
||||
%{_datadir}/%{name}/html/[^cd]*
|
||||
%{_datadir}/%{name}/html/contexthelp/
|
||||
%{_datadir}/%{name}/html/d3/
|
||||
|
||||
%if 0%{?fedora} < 42 && 0%{?rhel} < 11
|
||||
%{_sbindir}/*
|
||||
%endif
|
||||
|
||||
%{_bindir}/*
|
||||
%{_libdir}/%{name}/cgi-bin/*cgi
|
||||
%if 0%{?rhel} > 6 || 0%{?fedora} > 20
|
||||
|
|
@ -458,101 +466,39 @@ fi
|
|||
%attr(0755,root,root) %dir %{_libdir}/%{name}/plugins
|
||||
%attr(0755,root,root) %dir %{_libdir}/%{name}/plugins/eventhandlers/
|
||||
%attr(0755,nagios,nagios) %dir %{_localstatedir}/spool/%{name}
|
||||
%{_sysusersdir}/nagios.conf
|
||||
|
||||
|
||||
%files devel
|
||||
%{_includedir}/%{name}
|
||||
%attr(0644,root,root) %{_libdir}/%{name}/libnagios.a
|
||||
|
||||
%if 0%{?with_selinux}
|
||||
%if 0%{?rhel} > 5
|
||||
%files selinux
|
||||
%doc README.SELinux.rst
|
||||
%{_datadir}/selinux/packages/%{selinuxtype}/%{name}.pp.*
|
||||
%{_datadir}/selinux/devel/include/distributed/%{name}.if
|
||||
%ghost %verify(not md5 size mode mtime) %{_sharedstatedir}/selinux/%{selinuxtype}/active/modules/200/%{name}
|
||||
%{_datadir}/selinux/packages/%{name}/nagios_epel.pp
|
||||
%endif
|
||||
|
||||
|
||||
%files contrib
|
||||
%doc contrib/README.contrib
|
||||
%attr(0750,root,root) %{_libdir}/%{name}/plugins/eventhandlers/*
|
||||
%{_libdir}/%{name}/cgi/
|
||||
|
||||
%changelog
|
||||
* Thu Jul 24 2025 Fedora Release Engineering <releng@fedoraproject.org> - 4.5.9-2
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
|
||||
|
||||
* Tue May 13 2025 Guido Aulisi <guido.aulisi@inps.it> - 4.5.9-1
|
||||
- Update to 4.5.9
|
||||
|
||||
* Tue Feb 11 2025 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 4.4.14-8
|
||||
- Add sysusers.d config file to allow rpm to create users/groups automatically
|
||||
|
||||
* Fri Jan 17 2025 Fedora Release Engineering <releng@fedoraproject.org> - 4.4.14-7
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
|
||||
|
||||
* Mon Jul 29 2024 Miroslav Suchý <msuchy@redhat.com> - 4.4.14-6
|
||||
- convert license to SPDX
|
||||
|
||||
* Thu Jul 18 2024 Fedora Release Engineering <releng@fedoraproject.org> - 4.4.14-5
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
|
||||
|
||||
* Sat Apr 27 2024 Guido Aulisi <guido.aulisi@gmail.com> - 4.4.14-4
|
||||
* Thu Jan 16 2025 Guido Aulisi <guido.aulisi@gmail.com> - 4.4.14-3
|
||||
- Fix permissions (#2275532)
|
||||
|
||||
* Thu Jan 25 2024 Fedora Release Engineering <releng@fedoraproject.org> - 4.4.14-3
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
|
||||
* Thu Jan 16 2025 Guido Aulisi <guido.aulisi@gmail.com> - 4.4.14-2
|
||||
- Bump to update
|
||||
|
||||
* Sun Jan 21 2024 Fedora Release Engineering <releng@fedoraproject.org> - 4.4.14-2
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
|
||||
|
||||
* Wed Aug 16 2023 Guido Aulisi <guido.aulisi@gmail.com> - 4.4.14-1
|
||||
* Fri Jan 05 2024 Guido Aulisi <guido.aulisi@gmail.com> - 4.4.14-1
|
||||
- Update to 4.4.14
|
||||
|
||||
* Thu Jul 20 2023 Fedora Release Engineering <releng@fedoraproject.org> - 4.4.10-2
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
|
||||
|
||||
* Mon Feb 13 2023 Guido Aulisi <guido.aulisi@gmail.com> - 4.4.10-1
|
||||
- Update to 4.4.10
|
||||
- Fix nagiostats permissions #2169033
|
||||
|
||||
* Thu Jan 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 4.4.9-3
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
|
||||
|
||||
* Sat Dec 10 2022 Florian Weimer <fweimer@redhat.com> - 4.4.9-2
|
||||
- Port configure script to C99
|
||||
|
||||
* Thu Nov 17 2022 Guido Aulisi <guido.aulisi@gmail.com> - 4.4.9-1
|
||||
* Sun Dec 25 2022 Guido Aulisi <guido.aulisi@gmail.com> - 4.4.9-1
|
||||
- Update to 4.4.9
|
||||
|
||||
* Sun Oct 23 2022 Guido Aulisi <guido.aulisi@gmail.com> - 4.4.8-1
|
||||
- Update to 4.4.8
|
||||
|
||||
* Sun Sep 25 2022 Guido Aulisi <guido.aulisi@gmail.com> - 4.4.7-1
|
||||
- Update to 4.4.7
|
||||
|
||||
* Fri Jul 22 2022 Fedora Release Engineering <releng@fedoraproject.org> - 4.4.6-10
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
|
||||
|
||||
* Wed Jun 01 2022 Jitka Plesnikova <jplesnik@redhat.com> - 4.4.6-9
|
||||
- Perl 5.36 rebuild
|
||||
|
||||
* Thu Jan 20 2022 Fedora Release Engineering <releng@fedoraproject.org> - 4.4.6-8
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
|
||||
|
||||
* Tue Jan 04 2022 Guido Aulisi <guido.aulisi@gmail.com> - 4.4.6-7
|
||||
- Require a generic mail program (#2036844)
|
||||
|
||||
* Thu Jul 22 2021 Fedora Release Engineering <releng@fedoraproject.org> - 4.4.6-6
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
|
||||
|
||||
* Fri May 21 2021 Jitka Plesnikova <jplesnik@redhat.com> - 4.4.6-5
|
||||
- Perl 5.34 rebuild
|
||||
|
||||
* Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 4.4.6-4
|
||||
- Rebuilt for updated systemd-rpm-macros
|
||||
See https://pagure.io/fesco/issue/2583.
|
||||
* Wed Mar 03 2021 Guido Aulisi <guido.aulisi@gmail.com> - 4.4.6-4
|
||||
- Add missing require for nagios-plugins-ping
|
||||
- Fix run path
|
||||
|
||||
* Sat Feb 27 2021 Guido Aulisi <guido.aulisi@gmail.com> - 4.4.6-3
|
||||
- Require plugins needed for localhost monitoring (#1932297)
|
||||
|
|
@ -565,24 +511,6 @@ fi
|
|||
- Fix for CVE-2020-13977 #BZ1849087
|
||||
- Some spec cleanup
|
||||
|
||||
* Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 4.4.5-10
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
|
||||
|
||||
* Tue Jul 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 4.4.5-9
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
|
||||
|
||||
* Tue Jun 23 2020 Jitka Plesnikova <jplesnik@redhat.com> - 4.4.5-8
|
||||
- Perl 5.32 rebuild
|
||||
|
||||
* Mon Mar 2 2020 Martin Jackson <mhjacks@swbell.net> - 4.4.5-7
|
||||
- Update nrpe_etc_t policy in previous PR
|
||||
|
||||
* Thu Feb 27 2020 Martin Jackson <mhjacks@swbell.net> - 4.4.5-5
|
||||
- Update selinux subpackage to fix BZ#1749156 - thanks for the patch vmojzis
|
||||
|
||||
* Wed Feb 26 2020 Vit Mojzis <vmojzis@redhat.com> - 4.4.5-4
|
||||
- Update nagios-selinux based on the DSP guidelines
|
||||
|
||||
* Tue Feb 18 2020 Stephen Smoogen <smooge@fedoraproject.org> - 4.4.5-3
|
||||
- Add change to allow for problems found in mass rebuild and gcc10.
|
||||
- Fix BZ#1793909
|
||||
|
|
|
|||
667
nagios.te
667
nagios.te
|
|
@ -1,667 +0,0 @@
|
|||
policy_module(nagios, 1.13.0)
|
||||
|
||||
########################################
|
||||
#
|
||||
# Declarations
|
||||
#
|
||||
|
||||
## <desc>
|
||||
## <p>
|
||||
## Allow nagios/nrpe to call sudo from NRPE utils scripts.
|
||||
## </p>
|
||||
## </desc>
|
||||
gen_tunable(nagios_run_sudo, false)
|
||||
|
||||
## <desc>
|
||||
## <p>
|
||||
## Allow nagios run in conjunction with PNP4Nagios.
|
||||
## </p>
|
||||
## </desc>
|
||||
gen_tunable(nagios_run_pnp4nagios, false)
|
||||
|
||||
## <desc>
|
||||
## <p>
|
||||
## Determine whether Nagios, NRPE can
|
||||
## access nfs file systems.
|
||||
## </p>
|
||||
## </desc>
|
||||
gen_tunable(nagios_use_nfs, false)
|
||||
|
||||
gen_require(`
|
||||
class passwd rootok;
|
||||
class passwd passwd;
|
||||
')
|
||||
|
||||
attribute nagios_plugin_domain;
|
||||
|
||||
type nagios_t;
|
||||
type nagios_exec_t;
|
||||
init_daemon_domain(nagios_t, nagios_exec_t)
|
||||
|
||||
type nagios_etc_t;
|
||||
files_config_file(nagios_etc_t)
|
||||
|
||||
type nagios_initrc_exec_t;
|
||||
init_script_file(nagios_initrc_exec_t)
|
||||
|
||||
type nagios_log_t;
|
||||
logging_log_file(nagios_log_t)
|
||||
|
||||
type nagios_tmp_t;
|
||||
files_tmp_file(nagios_tmp_t)
|
||||
|
||||
type nagios_var_run_t;
|
||||
files_pid_file(nagios_var_run_t)
|
||||
|
||||
type nagios_spool_t;
|
||||
files_spool_file(nagios_spool_t)
|
||||
|
||||
type nagios_var_lib_t;
|
||||
files_type(nagios_var_lib_t)
|
||||
|
||||
nagios_plugin_template(admin)
|
||||
nagios_plugin_template(checkdisk)
|
||||
nagios_plugin_template(mail)
|
||||
nagios_plugin_template(services)
|
||||
nagios_plugin_template(system)
|
||||
nagios_plugin_template(unconfined)
|
||||
nagios_plugin_template(eventhandler)
|
||||
nagios_plugin_template(openshift)
|
||||
|
||||
type nagios_eventhandler_plugin_tmp_t;
|
||||
files_tmp_file(nagios_eventhandler_plugin_tmp_t)
|
||||
|
||||
type nagios_system_plugin_tmp_t;
|
||||
files_tmp_file(nagios_system_plugin_tmp_t)
|
||||
|
||||
type nagios_openshift_plugin_tmp_t;
|
||||
files_tmp_file(nagios_openshift_plugin_tmp_t)
|
||||
|
||||
type nrpe_t;
|
||||
type nrpe_exec_t;
|
||||
init_daemon_domain(nrpe_t, nrpe_exec_t)
|
||||
|
||||
type nrpe_etc_t;
|
||||
files_config_file(nrpe_etc_t)
|
||||
|
||||
type nrpe_var_run_t;
|
||||
files_pid_file(nrpe_var_run_t)
|
||||
|
||||
######################################
|
||||
#
|
||||
# Common plugin domain local policy
|
||||
#
|
||||
|
||||
allow nagios_plugin_domain self:fifo_file rw_fifo_file_perms;
|
||||
|
||||
allow nrpe_t nagios_plugin_domain:process { sigkill signal };
|
||||
|
||||
allow nagios_t nagios_plugin_domain:process signal_perms;
|
||||
allow nagios_plugin_domain nagios_t:process signal_perms;
|
||||
|
||||
# cjp: leaked file descriptor
|
||||
dontaudit nagios_plugin_domain nrpe_t:tcp_socket { read write };
|
||||
dontaudit nagios_plugin_domain nagios_log_t:file { read write };
|
||||
|
||||
dev_read_urand(nagios_plugin_domain)
|
||||
dev_read_rand(nagios_plugin_domain)
|
||||
dev_read_sysfs(nagios_plugin_domain)
|
||||
|
||||
userdom_use_inherited_user_ptys(nagios_plugin_domain)
|
||||
userdom_use_inherited_user_ttys(nagios_plugin_domain)
|
||||
|
||||
########################################
|
||||
#
|
||||
# Nagios local policy
|
||||
#
|
||||
|
||||
allow nagios_t self:capability { chown dac_read_search setgid setuid };
|
||||
dontaudit nagios_t self:capability sys_tty_config;
|
||||
allow nagios_t self:process { setpgid signal_perms };
|
||||
allow nagios_t self:fifo_file rw_fifo_file_perms;
|
||||
allow nagios_t self:tcp_socket { accept listen };
|
||||
allow nagios_t self:unix_stream_socket { connectto };
|
||||
|
||||
allow nagios_t nagios_plugin_domain:process signal_perms;
|
||||
|
||||
allow nagios_t nagios_eventhandler_plugin_exec_t:dir list_dir_perms;
|
||||
|
||||
allow nagios_t nagios_etc_t:dir list_dir_perms;
|
||||
allow nagios_t nagios_etc_t:file { map read_file_perms };
|
||||
allow nagios_t nagios_etc_t:lnk_file read_lnk_file_perms;
|
||||
|
||||
#allow nagios_t nagios_log_t:dir setattr_dir_perms;
|
||||
#append_files_pattern(nagios_t, nagios_log_t, nagios_log_t)
|
||||
#create_files_pattern(nagios_t, nagios_log_t, nagios_log_t)
|
||||
#setattr_files_pattern(nagios_t, nagios_log_t, nagios_log_t)
|
||||
manage_files_pattern(nagios_t, nagios_log_t, nagios_log_t)
|
||||
manage_dirs_pattern(nagios_t, nagios_log_t, nagios_log_t)
|
||||
logging_log_filetrans(nagios_t, nagios_log_t, { dir file })
|
||||
allow nagios_t nagios_log_t:file map;
|
||||
|
||||
manage_dirs_pattern(nagios_t, nagios_tmp_t, nagios_tmp_t)
|
||||
manage_files_pattern(nagios_t, nagios_tmp_t, nagios_tmp_t)
|
||||
files_tmp_filetrans(nagios_t, nagios_tmp_t, { dir file })
|
||||
|
||||
manage_files_pattern(nagios_t, nagios_var_run_t, nagios_var_run_t)
|
||||
files_pid_filetrans(nagios_t, nagios_var_run_t, file)
|
||||
|
||||
manage_fifo_files_pattern(nagios_t, nagios_spool_t, nagios_spool_t)
|
||||
manage_files_pattern(nagios_t, nagios_spool_t, nagios_spool_t)
|
||||
manage_sock_files_pattern(nagios_t, nagios_spool_t, nagios_spool_t)
|
||||
files_spool_filetrans(nagios_t, nagios_spool_t, { file fifo_file })
|
||||
allow nagios_t nagios_spool_t:file map;
|
||||
|
||||
manage_files_pattern(nagios_t, nagios_var_lib_t, nagios_var_lib_t)
|
||||
manage_fifo_files_pattern(nagios_t, nagios_var_lib_t, nagios_var_lib_t)
|
||||
manage_dirs_pattern(nagios_t, nagios_var_lib_t, nagios_var_lib_t)
|
||||
files_var_lib_filetrans(nagios_t, nagios_var_lib_t, { dir file fifo_file })
|
||||
|
||||
kernel_read_system_state(nagios_t)
|
||||
kernel_read_kernel_sysctls(nagios_t)
|
||||
kernel_read_software_raid_state(nagios_t)
|
||||
|
||||
corecmd_exec_bin(nagios_t)
|
||||
corecmd_exec_shell(nagios_t)
|
||||
|
||||
corenet_all_recvfrom_netlabel(nagios_t)
|
||||
corenet_tcp_sendrecv_generic_if(nagios_t)
|
||||
corenet_tcp_sendrecv_generic_node(nagios_t)
|
||||
|
||||
corenet_sendrecv_all_client_packets(nagios_t)
|
||||
corenet_tcp_connect_all_ports(nagios_t)
|
||||
corenet_tcp_sendrecv_all_ports(nagios_t)
|
||||
|
||||
corenet_dontaudit_tcp_bind_all_reserved_ports(nagios_t)
|
||||
corenet_dontaudit_udp_bind_all_reserved_ports(nagios_t)
|
||||
|
||||
dev_read_sysfs(nagios_t)
|
||||
dev_read_urand(nagios_t)
|
||||
|
||||
domain_use_interactive_fds(nagios_t)
|
||||
domain_read_all_domains_state(nagios_t)
|
||||
|
||||
files_read_etc_runtime_files(nagios_t)
|
||||
files_read_kernel_symbol_table(nagios_t)
|
||||
files_search_spool(nagios_t)
|
||||
|
||||
fs_getattr_all_fs(nagios_t)
|
||||
fs_search_auto_mountpoints(nagios_t)
|
||||
fs_search_cgroup_dirs(nagios_t)
|
||||
|
||||
hostname_exec(nagios_t)
|
||||
|
||||
auth_use_nsswitch(nagios_t)
|
||||
|
||||
logging_send_syslog_msg(nagios_t)
|
||||
libs_exec_ldconfig(nagios_t)
|
||||
|
||||
userdom_dontaudit_use_unpriv_user_fds(nagios_t)
|
||||
userdom_dontaudit_search_user_home_dirs(nagios_t)
|
||||
|
||||
mta_send_mail(nagios_t)
|
||||
mta_signal_system_mail(nagios_t)
|
||||
mta_kill_system_mail(nagios_t)
|
||||
|
||||
systemd_exec_systemctl(nagios_t)
|
||||
|
||||
tunable_policy(`nagios_run_sudo',`
|
||||
allow nagios_t self:capability { chown setgid setuid sys_ptrace sys_resource };
|
||||
allow nagios_t self:process { setrlimit setsched };
|
||||
|
||||
allow nagios_t self:key write;
|
||||
|
||||
allow nagios_t self:passwd { passwd rootok };
|
||||
|
||||
auth_rw_lastlog(nagios_t)
|
||||
auth_rw_faillog(nagios_t)
|
||||
|
||||
auth_domtrans_chkpwd(nagios_t)
|
||||
|
||||
selinux_compute_access_vector(nagios_t)
|
||||
|
||||
systemd_write_inherited_logind_sessions_pipes(nagios_t)
|
||||
systemd_dbus_chat_logind(nagios_t)
|
||||
|
||||
logging_send_audit_msgs(nagios_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
apache_systemctl(nagios_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
dbus_system_bus_client(nagios_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
tunable_policy(`nagios_run_sudo',`
|
||||
sudo_exec(nagios_t)
|
||||
sudo_manage_db(nagios_t)
|
||||
')
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
tunable_policy(`nagios_run_sudo',`
|
||||
init_read_utmp(nagios_t)
|
||||
')
|
||||
')
|
||||
|
||||
tunable_policy(`nagios_run_pnp4nagios',`
|
||||
allow nagios_t nagios_log_t:file execute;
|
||||
')
|
||||
|
||||
tunable_policy(`nagios_use_nfs',`
|
||||
fs_manage_nfs_files(nagios_t)
|
||||
fs_manage_nfs_dirs(nagios_t)
|
||||
fs_manage_nfs_symlinks(nagios_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
netutils_kill_ping(nagios_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
seutil_sigchld_newrole(nagios_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
udev_read_db(nagios_t)
|
||||
')
|
||||
|
||||
########################################
|
||||
#
|
||||
# CGI local policy
|
||||
#
|
||||
|
||||
optional_policy(`
|
||||
apache_content_template(nagios)
|
||||
apache_content_alias_template(nagios, nagios)
|
||||
typealias nagios_script_t alias nagios_cgi_t;
|
||||
typealias nagios_script_exec_t alias nagios_cgi_exec_t;
|
||||
|
||||
allow nagios_script_t self:process signal_perms;
|
||||
|
||||
read_files_pattern(nagios_script_t, nagios_t, nagios_t)
|
||||
read_lnk_files_pattern(nagios_script_t, nagios_t, nagios_t)
|
||||
|
||||
allow nagios_script_t nagios_etc_t:dir list_dir_perms;
|
||||
allow nagios_script_t nagios_etc_t:file { map read_file_perms };
|
||||
allow nagios_script_t nagios_etc_t:lnk_file read_lnk_file_perms;
|
||||
|
||||
files_search_spool(nagios_script_t)
|
||||
rw_fifo_files_pattern(nagios_script_t, nagios_spool_t, nagios_spool_t)
|
||||
read_files_pattern(nagios_script_t, nagios_spool_t, nagios_spool_t)
|
||||
allow nagios_script_t nagios_spool_t:file map;
|
||||
|
||||
allow nagios_script_t nagios_log_t:dir list_dir_perms;
|
||||
read_files_pattern(nagios_script_t, nagios_etc_t, nagios_log_t)
|
||||
read_lnk_files_pattern(nagios_script_t, nagios_etc_t, nagios_log_t)
|
||||
allow nagios_script_t nagios_log_t:file map;
|
||||
|
||||
kernel_read_system_state(nagios_script_t)
|
||||
|
||||
domain_dontaudit_read_all_domains_state(nagios_script_t)
|
||||
|
||||
files_read_etc_runtime_files(nagios_script_t)
|
||||
files_read_kernel_symbol_table(nagios_script_t)
|
||||
|
||||
dev_list_sysfs(nagios_script_t)
|
||||
|
||||
logging_send_syslog_msg(nagios_script_t)
|
||||
')
|
||||
|
||||
########################################
|
||||
#
|
||||
# Nrpe local policy
|
||||
#
|
||||
|
||||
allow nrpe_t self:capability { kill setgid setuid };
|
||||
dontaudit nrpe_t self:capability { sys_resource sys_tty_config };
|
||||
allow nrpe_t self:process { setpgid setrlimit setsched signal_perms };
|
||||
allow nrpe_t self:fifo_file rw_fifo_file_perms;
|
||||
allow nrpe_t self:tcp_socket { accept listen };
|
||||
|
||||
allow nrpe_t nagios_plugin_domain:process { sigkill signal };
|
||||
|
||||
list_dirs_pattern(nrpe_t, nrpe_etc_t, nrpe_etc_t)
|
||||
read_files_pattern(nrpe_t, nagios_etc_t, nrpe_etc_t)
|
||||
|
||||
manage_files_pattern(nrpe_t, nrpe_var_run_t, nrpe_var_run_t)
|
||||
files_pid_filetrans(nrpe_t, nrpe_var_run_t, file)
|
||||
|
||||
domtrans_pattern(nrpe_t, nagios_checkdisk_plugin_exec_t, nagios_checkdisk_plugin_t)
|
||||
|
||||
kernel_read_system_state(nrpe_t)
|
||||
kernel_read_kernel_sysctls(nrpe_t)
|
||||
kernel_read_software_raid_state(nrpe_t)
|
||||
kernel_read_fs_sysctls(nrpe_t)
|
||||
|
||||
can_exec(nagios_t, nagios_exec_t)
|
||||
|
||||
corecmd_exec_bin(nrpe_t)
|
||||
corecmd_exec_shell(nrpe_t)
|
||||
|
||||
corenet_all_recvfrom_unlabeled(nrpe_t)
|
||||
corenet_all_recvfrom_netlabel(nrpe_t)
|
||||
corenet_tcp_sendrecv_generic_if(nrpe_t)
|
||||
corenet_tcp_sendrecv_generic_node(nrpe_t)
|
||||
corenet_tcp_bind_generic_node(nrpe_t)
|
||||
|
||||
corenet_sendrecv_inetd_child_server_packets(nrpe_t)
|
||||
corenet_tcp_bind_inetd_child_port(nrpe_t)
|
||||
corenet_tcp_sendrecv_inetd_child_port(nrpe_t)
|
||||
|
||||
dev_read_sysfs(nrpe_t)
|
||||
dev_read_urand(nrpe_t)
|
||||
dev_rw_lvm_control(nrpe_t)
|
||||
|
||||
domain_use_interactive_fds(nrpe_t)
|
||||
domain_read_all_domains_state(nrpe_t)
|
||||
|
||||
files_list_var(nrpe_t)
|
||||
files_read_etc_runtime_files(nrpe_t)
|
||||
|
||||
fs_getattr_all_fs(nrpe_t)
|
||||
fs_search_auto_mountpoints(nrpe_t)
|
||||
|
||||
auth_use_nsswitch(nrpe_t)
|
||||
|
||||
logging_send_syslog_msg(nrpe_t)
|
||||
|
||||
userdom_dontaudit_use_unpriv_user_fds(nrpe_t)
|
||||
|
||||
tunable_policy(`nagios_run_sudo',`
|
||||
allow nrpe_t self:capability { setgid setuid sys_ptrace sys_resource };
|
||||
allow nrpe_t self:process { setrlimit setsched };
|
||||
|
||||
allow nrpe_t self:key write;
|
||||
|
||||
allow nrpe_t self:passwd { passwd rootok };
|
||||
|
||||
auth_rw_lastlog(nrpe_t)
|
||||
auth_rw_faillog(nrpe_t)
|
||||
|
||||
auth_domtrans_chkpwd(nrpe_t)
|
||||
|
||||
init_read_utmp(nrpe_t)
|
||||
|
||||
selinux_compute_access_vector(nrpe_t)
|
||||
|
||||
systemd_write_inherited_logind_sessions_pipes(nrpe_t)
|
||||
systemd_dbus_chat_logind(nrpe_t)
|
||||
|
||||
logging_send_audit_msgs(nrpe_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
tunable_policy(`nagios_run_sudo',`
|
||||
sudo_exec(nrpe_t)
|
||||
sudo_manage_db(nrpe_t)
|
||||
')
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
tunable_policy(`nagios_run_sudo',`
|
||||
sssd_read_config(nrpe_t)
|
||||
sssd_manage_lib_files(nrpe_t)
|
||||
sssd_read_pid_files(nrpe_t)
|
||||
sssd_signull(nrpe_t)
|
||||
')
|
||||
')
|
||||
|
||||
tunable_policy(`nagios_use_nfs',`
|
||||
fs_manage_nfs_files(nrpe_t)
|
||||
fs_manage_nfs_dirs(nrpe_t)
|
||||
fs_manage_nfs_symlinks(nrpe_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
dbus_system_bus_client(nrpe_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
inetd_tcp_service_domain(nrpe_t, nrpe_exec_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
lvm_read_metadata(nrpe_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
mta_send_mail(nrpe_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
seutil_sigchld_newrole(nrpe_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
tcpd_wrapped_domain(nrpe_t, nrpe_exec_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
udev_read_db(nrpe_t)
|
||||
')
|
||||
|
||||
#####################################
|
||||
#
|
||||
# Admin local policy
|
||||
#
|
||||
|
||||
corecmd_read_bin_files(nagios_admin_plugin_t)
|
||||
corecmd_read_bin_symlinks(nagios_admin_plugin_t)
|
||||
|
||||
dev_getattr_all_chr_files(nagios_admin_plugin_t)
|
||||
dev_getattr_all_blk_files(nagios_admin_plugin_t)
|
||||
|
||||
files_getattr_all_dirs(nagios_admin_plugin_t)
|
||||
files_getattr_all_files(nagios_admin_plugin_t)
|
||||
files_getattr_all_symlinks(nagios_admin_plugin_t)
|
||||
files_getattr_all_pipes(nagios_admin_plugin_t)
|
||||
files_getattr_all_sockets(nagios_admin_plugin_t)
|
||||
files_getattr_all_file_type_fs(nagios_admin_plugin_t)
|
||||
|
||||
######################################
|
||||
#
|
||||
# Mail local policy
|
||||
#
|
||||
|
||||
allow nagios_mail_plugin_t self:capability { dac_read_search setgid setuid };
|
||||
allow nagios_mail_plugin_t self:netlink_route_socket r_netlink_socket_perms;
|
||||
allow nagios_mail_plugin_t self:tcp_socket create_stream_socket_perms;
|
||||
allow nagios_mail_plugin_t self:udp_socket create_socket_perms;
|
||||
|
||||
kernel_read_kernel_sysctls(nagios_mail_plugin_t)
|
||||
|
||||
corecmd_read_bin_files(nagios_mail_plugin_t)
|
||||
corecmd_read_bin_symlinks(nagios_mail_plugin_t)
|
||||
|
||||
logging_send_syslog_msg(nagios_mail_plugin_t)
|
||||
|
||||
sysnet_dns_name_resolve(nagios_mail_plugin_t)
|
||||
|
||||
optional_policy(`
|
||||
mta_send_mail(nagios_mail_plugin_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
nscd_dontaudit_search_pid(nagios_mail_plugin_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
postfix_stream_connect_master(nagios_mail_plugin_t)
|
||||
postfix_exec_postqueue(nagios_mail_plugin_t)
|
||||
')
|
||||
|
||||
######################################
|
||||
#
|
||||
# Disk local policy
|
||||
#
|
||||
|
||||
allow nagios_checkdisk_plugin_t self:capability { sys_admin sys_rawio };
|
||||
|
||||
kernel_read_software_raid_state(nagios_checkdisk_plugin_t)
|
||||
|
||||
corecmd_exec_bin(nagios_checkdisk_plugin_t)
|
||||
|
||||
files_getattr_all_dirs(nagios_checkdisk_plugin_t)
|
||||
files_getattr_all_mountpoints(nagios_checkdisk_plugin_t)
|
||||
files_read_etc_runtime_files(nagios_checkdisk_plugin_t)
|
||||
|
||||
fs_read_configfs_files(nagios_checkdisk_plugin_t)
|
||||
fs_read_configfs_dirs(nagios_checkdisk_plugin_t)
|
||||
fs_getattr_all_fs(nagios_checkdisk_plugin_t)
|
||||
|
||||
storage_raw_read_fixed_disk(nagios_checkdisk_plugin_t)
|
||||
|
||||
#######################################
|
||||
#
|
||||
# Services local policy
|
||||
#
|
||||
|
||||
allow nagios_services_plugin_t self:capability { net_bind_service net_raw setuid };
|
||||
allow nagios_services_plugin_t self:process { sigkill signal };
|
||||
allow nagios_services_plugin_t self:tcp_socket create_stream_socket_perms;
|
||||
allow nagios_services_plugin_t self:udp_socket create_socket_perms;
|
||||
allow nagios_services_plugin_t self:unix_dgram_socket create_socket_perms;
|
||||
allow nagios_services_plugin_t self:rawip_socket create_socket_perms;
|
||||
|
||||
corecmd_exec_bin(nagios_services_plugin_t)
|
||||
|
||||
corenet_all_recvfrom_unlabeled(nagios_services_plugin_t)
|
||||
corenet_all_recvfrom_netlabel(nagios_services_plugin_t)
|
||||
corenet_tcp_sendrecv_generic_if(nagios_services_plugin_t)
|
||||
corenet_udp_sendrecv_generic_if(nagios_services_plugin_t)
|
||||
corenet_tcp_sendrecv_generic_node(nagios_services_plugin_t)
|
||||
corenet_udp_sendrecv_generic_node(nagios_services_plugin_t)
|
||||
corenet_udp_bind_generic_node(nagios_services_plugin_t)
|
||||
|
||||
corenet_sendrecv_all_client_packets(nagios_services_plugin_t)
|
||||
corenet_tcp_connect_all_ports(nagios_services_plugin_t)
|
||||
corenet_tcp_sendrecv_all_ports(nagios_services_plugin_t)
|
||||
|
||||
corenet_sendrecv_dhcpc_server_packets(nagios_services_plugin_t)
|
||||
corenet_udp_bind_dhcpc_port(nagios_services_plugin_t)
|
||||
corenet_udp_sendrecv_dhcpc_port(nagios_services_plugin_t)
|
||||
|
||||
auth_use_nsswitch(nagios_services_plugin_t)
|
||||
|
||||
domain_read_all_domains_state(nagios_services_plugin_t)
|
||||
logging_send_syslog_msg(nagios_services_plugin_t)
|
||||
|
||||
optional_policy(`
|
||||
netutils_domtrans_ping(nagios_services_plugin_t)
|
||||
netutils_signal_ping(nagios_services_plugin_t)
|
||||
netutils_kill_ping(nagios_services_plugin_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
mysql_stream_connect(nagios_services_plugin_t)
|
||||
mysql_read_config(nagios_services_plugin_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
postgresql_stream_connect(nagios_services_plugin_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
snmp_read_snmp_var_lib_files(nagios_services_plugin_t)
|
||||
')
|
||||
|
||||
######################################
|
||||
#
|
||||
# System local policy
|
||||
#
|
||||
|
||||
allow nagios_system_plugin_t self:capability { dac_read_search };
|
||||
dontaudit nagios_system_plugin_t self:capability { setgid setuid };
|
||||
|
||||
allow nagios_system_plugin_t nrpe_exec_t:file read_file_perms;
|
||||
allow nagios_system_plugin_t nagios_exec_t:file read_file_perms;
|
||||
|
||||
read_files_pattern(nagios_system_plugin_t, nagios_log_t, nagios_log_t)
|
||||
read_files_pattern(nagios_system_plugin_t, nagios_spool_t, nagios_spool_t)
|
||||
manage_files_pattern(nagios_system_plugin_t, nagios_system_plugin_tmp_t, nagios_system_plugin_tmp_t)
|
||||
manage_dirs_pattern(nagios_system_plugin_t, nagios_system_plugin_tmp_t, nagios_system_plugin_tmp_t)
|
||||
files_tmp_filetrans(nagios_system_plugin_t, nagios_system_plugin_tmp_t, { dir file })
|
||||
|
||||
kernel_read_system_state(nagios_system_plugin_t)
|
||||
kernel_read_kernel_sysctls(nagios_system_plugin_t)
|
||||
|
||||
corecmd_exec_bin(nagios_system_plugin_t)
|
||||
corecmd_exec_shell(nagios_system_plugin_t)
|
||||
corecmd_getattr_all_executables(nagios_system_plugin_t)
|
||||
|
||||
dev_read_sysfs(nagios_system_plugin_t)
|
||||
|
||||
domain_read_all_domains_state(nagios_system_plugin_t)
|
||||
|
||||
fs_getattr_all_fs(nagios_system_plugin_t)
|
||||
|
||||
auth_read_passwd(nagios_system_plugin_t)
|
||||
|
||||
optional_policy(`
|
||||
init_read_utmp(nagios_system_plugin_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
mrtg_read_lib_files(nagios_system_plugin_t)
|
||||
')
|
||||
|
||||
#######################################
|
||||
#
|
||||
# Event local policy
|
||||
#
|
||||
|
||||
manage_files_pattern(nagios_eventhandler_plugin_t, nagios_eventhandler_plugin_tmp_t, nagios_eventhandler_plugin_tmp_t)
|
||||
manage_dirs_pattern(nagios_eventhandler_plugin_t, nagios_eventhandler_plugin_tmp_t, nagios_eventhandler_plugin_tmp_t)
|
||||
files_tmp_filetrans(nagios_eventhandler_plugin_t, nagios_eventhandler_plugin_tmp_t, { dir file })
|
||||
|
||||
corecmd_exec_bin(nagios_eventhandler_plugin_t)
|
||||
corecmd_exec_shell(nagios_eventhandler_plugin_t)
|
||||
|
||||
init_domtrans_script(nagios_eventhandler_plugin_t)
|
||||
|
||||
systemd_exec_systemctl(nagios_eventhandler_plugin_t)
|
||||
|
||||
allow nagios_t nagios_eventhandler_plugin_exec_t:dir list_dir_perms;
|
||||
|
||||
optional_policy(`
|
||||
unconfined_domain(nagios_eventhandler_plugin_t)
|
||||
')
|
||||
|
||||
########################################
|
||||
#
|
||||
# nagios openshift plugin policy
|
||||
#
|
||||
|
||||
allow nagios_openshift_plugin_t self:capability sys_ptrace;
|
||||
|
||||
manage_dirs_pattern(nagios_openshift_plugin_t, nagios_openshift_plugin_tmp_t, nagios_openshift_plugin_tmp_t)
|
||||
manage_files_pattern(nagios_openshift_plugin_t, nagios_openshift_plugin_tmp_t, nagios_openshift_plugin_tmp_t)
|
||||
files_tmp_filetrans(nagios_openshift_plugin_t, nagios_openshift_plugin_tmp_t, { file dir })
|
||||
|
||||
corecmd_exec_bin(nagios_openshift_plugin_t)
|
||||
corecmd_exec_shell(nagios_openshift_plugin_t)
|
||||
|
||||
domain_read_all_domains_state(nagios_openshift_plugin_t)
|
||||
|
||||
fs_getattr_all_fs(nagios_openshift_plugin_t)
|
||||
|
||||
optional_policy(`
|
||||
apache_read_config(nagios_openshift_plugin_t)
|
||||
')
|
||||
|
||||
######################################
|
||||
#
|
||||
# nagios plugin domain policy
|
||||
#
|
||||
|
||||
optional_policy(`
|
||||
unconfined_domain(nagios_unconfined_plugin_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
systemd_dbus_chat_logind(nagios_unconfined_plugin_t)
|
||||
')
|
||||
2
sources
2
sources
|
|
@ -1 +1 @@
|
|||
SHA512 (nagioscore-nagios-4.5.9.tar.gz) = 90bd71f772b6686b32fbe5f543468938f0dfc9c5bade1d41c27d63b1971d5000d16d6ca843b3eccab5550daa1bc649f16e8d68890052149126601a060ac9230d
|
||||
SHA512 (nagioscore-nagios-4.4.14.tar.gz) = 6dfe19887f035f3a3f6774a0f1c515902608934a75b08835fe9a5163812657547c97a20f3df42b89a34cad949eb4b587853b4131718c30703490b11fbee0d0ee
|
||||
|
|
|
|||
|
|
@ -1,41 +0,0 @@
|
|||
- hosts: localhost
|
||||
|
||||
roles:
|
||||
- role: standard-test-beakerlib
|
||||
tags:
|
||||
- classic
|
||||
repositories:
|
||||
- repo: https://pagure.io/DSP_test.git
|
||||
dest: DSP_test
|
||||
version: master
|
||||
|
||||
tests:
|
||||
- DSP_test
|
||||
environment:
|
||||
# RPM package containing the policy module
|
||||
TEST_RPM: nagios-selinux
|
||||
# policy module name
|
||||
TEST_POLICY: nagios
|
||||
# policy sources will be extracted from corresponding .src.rpm
|
||||
# policy tar filename regexp (e.g. "usbguard-selinux*.tar.gz")
|
||||
# or empty string if policy sources are not inside a tar archive
|
||||
POLICY_TAR: ''
|
||||
# path to policy sources (in of the tar archive) -- <POLICY_TAR>/<POLICY_PATH>/<TEST_POLICY>.(te|if|fc)
|
||||
# or path in the src.rpm if there is no tar archive -- <src.rpm>/<POLICY_PATH>/<TEST_POLICY>.(te|if|fc)
|
||||
# can contain wildcards (e.g. for versions etc.)
|
||||
POLICY_PATH: .
|
||||
# allow rules ignored by "Unsound/dangerous policy practices" test
|
||||
IGNORE_RULES: >-
|
||||
nagios_script_t:system_map_t:file
|
||||
nagios_script_t:boot_t:dir
|
||||
|
||||
required_packages:
|
||||
- policycoreutils
|
||||
- selinux-policy
|
||||
- selinux-policy-targeted
|
||||
- setools-console
|
||||
- libselinux-utils
|
||||
- rpm
|
||||
- tar
|
||||
- git
|
||||
- nagios-selinux
|
||||
Loading…
Add table
Add a link
Reference in a new issue