# Joe Presbrey # presbrey@mit.edu # 2006/1/15 policy_module(nrpe,1.0.0) require { type nrpe_t, nrpe_exec_t; type inaddr_any_node_t; type inetd_child_port_t; type initrc_var_run_t; type nrpe_t; type port_t; type var_run_t; }; ######################################## # # nrpe local policy files_read_etc_files(nrpe_t) files_rw_etc_runtime_files(nrpe_t) libs_use_ld_so(nrpe_t) libs_use_shared_libs(nrpe_t) miscfiles_read_localization(nrpe_t) sysnet_dns_name_resolve(nrpe_t) corenet_tcp_sendrecv_all_nodes(nrpe_t) corenet_udp_sendrecv_all_nodes(nrpe_t) nagios_read_config(nrpe_t) files_rw_generic_pids(nrpe_t) allow nrpe_t self:capability { setgid setuid }; allow nrpe_t self:tcp_socket { accept bind create listen setopt }; require { attribute domain; attribute file_type; attribute filesystem_type; }; domain_read_all_domains_state(nrpe_t) dontaudit nrpe_t domain:dir getattr; dontaudit nrpe_t file_type:dir all_dir_perms; dontaudit nrpe_t file_type:file all_file_perms; files_getattr_all_dirs(nrpe_t) files_getattr_all_files(nrpe_t) fs_getattr_all_fs(nrpe_t) fs_get_xattr_fs_quotas(nrpe_t) allow nrpe_t inaddr_any_node_t:tcp_socket node_bind; allow nrpe_t inetd_child_port_t:tcp_socket name_bind; allow nrpe_t initrc_var_run_t:file { lock read }; allow nrpe_t port_t:tcp_socket { recv_msg send_msg }; allow nrpe_t var_run_t:dir { add_name write }; allow nrpe_t var_run_t:file create;