From: "Sven Vermeulen" <sven.vermeulen@siphos.be>
To: gentoo-commits@lists.gentoo.org
Subject: [gentoo-commits] proj/hardened-refpolicy:master commit in: /
Date: Thu, 27 Sep 2012 18:05:11 +0000 (UTC) [thread overview]
Message-ID: <1348766138.5e4308f800b9859fcb9654e8242e8fa6ffe059fb.SwifT@gentoo> (raw)
commit: 5e4308f800b9859fcb9654e8242e8fa6ffe059fb
Author: Dominick Grift <dominick.grift <AT> gmail <DOT> com>
AuthorDate: Mon Sep 24 10:40:58 2012 +0000
Commit: Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Thu Sep 27 17:15:38 2012 +0000
URL: http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=5e4308f8
Initial collectd policy module
collectd is a daemon which collects system performance statistics
periodically and provides mechanisms to store the values in a variety of
ways, for example in RRD files.
Ported from Fedora with changes
Signed-off-by: Dominick Grift <dominick.grift <AT> gmail.com>
Signed-off-by: Sven Vermeulen <sven.vermeulen <AT> siphos.be>
---
collectd.fc | 9 ++++++
collectd.if | 39 +++++++++++++++++++++++++
collectd.te | 90 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
3 files changed, 138 insertions(+), 0 deletions(-)
diff --git a/collectd.fc b/collectd.fc
new file mode 100644
index 0000000..79a3abe
--- /dev/null
+++ b/collectd.fc
@@ -0,0 +1,9 @@
+/etc/rc\.d/init\.d/collectd -- gen_context(system_u:object_r:collectd_initrc_exec_t,s0)
+
+/usr/sbin/collectd -- gen_context(system_u:object_r:collectd_exec_t,s0)
+
+/var/lib/collectd(/.*)? gen_context(system_u:object_r:collectd_var_lib_t,s0)
+
+/var/run/collectd\.pid -- gen_context(system_u:object_r:collectd_var_run_t,s0)
+
+/usr/share/collectd/collection3/bin/.*\.cgi -- gen_context(system_u:object_r:httpd_collectd_script_exec_t,s0)
diff --git a/collectd.if b/collectd.if
new file mode 100644
index 0000000..954309e
--- /dev/null
+++ b/collectd.if
@@ -0,0 +1,39 @@
+## <summary>Statistics collection daemon for filling RRD files.</summary>
+
+########################################
+## <summary>
+## All of the rules required to
+## administrate an collectd environment.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+## <param name="role">
+## <summary>
+## Role allowed access.
+## </summary>
+## </param>
+## <rolecap/>
+#
+interface(`collectd_admin',`
+ gen_require(`
+ type collectd_t, collectd_initrc_exec_t, collectd_var_run_t;
+ type collectd_var_lib_t;
+ ')
+
+ allow $1 collectd_t:process { ptrace signal_perms };
+ ps_process_pattern($1, collectd_t)
+
+ init_labeled_script_domtrans($1, collectd_initrc_exec_t)
+ domain_system_change_exemption($1)
+ role_transition $2 collectd_initrc_exec_t system_r;
+ allow $2 system_r;
+
+ files_search_pids($1)
+ admin_pattern($1, collectd_var_run_t)
+
+ files_search_var_lib($1)
+ admin_pattern($1, collectd_var_lib_t)
+')
diff --git a/collectd.te b/collectd.te
new file mode 100644
index 0000000..6471fa8
--- /dev/null
+++ b/collectd.te
@@ -0,0 +1,90 @@
+policy_module(collectd, 1.0.0)
+
+########################################
+#
+# Declarations
+#
+
+## <desc>
+## <p>
+## Determine whether collectd can connect
+## to the network using TCP.
+## </p>
+## </desc>
+gen_tunable(collectd_tcp_network_connect, false)
+
+type collectd_t;
+type collectd_exec_t;
+init_daemon_domain(collectd_t, collectd_exec_t)
+
+type collectd_initrc_exec_t;
+init_script_file(collectd_initrc_exec_t)
+
+type collectd_var_lib_t;
+files_type(collectd_var_lib_t)
+
+type collectd_var_run_t;
+files_pid_file(collectd_var_run_t)
+
+apache_content_template(collectd)
+
+########################################
+#
+# Local policy
+#
+
+allow collectd_t self:capability { ipc_lock sys_nice };
+allow collectd_t self:process { getsched setsched signal };
+allow collectd_t self:fifo_file rw_fifo_file_perms;
+allow collectd_t self:packet_socket create_socket_perms;
+allow collectd_t self:unix_stream_socket { accept listen };
+
+manage_dirs_pattern(collectd_t, collectd_var_lib_t, collectd_var_lib_t)
+manage_files_pattern(collectd_t, collectd_var_lib_t, collectd_var_lib_t)
+files_var_lib_filetrans(collectd_t, collectd_var_lib_t, dir)
+
+manage_files_pattern(collectd_t, collectd_var_run_t, collectd_var_run_t)
+files_pid_filetrans(collectd_t, collectd_var_run_t, file)
+
+domain_use_interactive_fds(collectd_t)
+
+kernel_read_network_state(collectd_t)
+kernel_read_net_sysctls(collectd_t)
+kernel_read_system_state(collectd_t)
+
+dev_read_rand(collectd_t)
+dev_read_sysfs(collectd_t)
+dev_read_urand(collectd_t)
+
+files_getattr_all_dirs(collectd_t)
+files_read_etc_files(collectd_t)
+files_read_usr_files(collectd_t)
+
+fs_getattr_all_fs(collectd_t)
+
+miscfiles_read_localization(collectd_t)
+
+logging_send_syslog_msg(collectd_t)
+
+sysnet_dns_name_resolve(collectd_t)
+
+tunable_policy(`collectd_tcp_network_connect',`
+ corenet_sendrecv_all_client_packets(collectd_t)
+ corenet_tcp_connect_all_ports(collectd_t)
+ corenet_tcp_sendrecv_all_ports(collectd_t)
+')
+
+optional_policy(`
+ virt_read_config(collectd_t)
+')
+
+########################################
+#
+# Web local policy
+#
+
+optional_policy(`
+ read_files_pattern(httpd_collectd_script_t, collectd_var_lib_t, collectd_var_lib_t)
+ list_dirs_pattern(httpd_collectd_script_t, collectd_var_lib_t, collectd_var_lib_t)
+ miscfiles_setattr_fonts_cache_dirs(httpd_collectd_script_t)
+')
next reply other threads:[~2012-09-27 18:08 UTC|newest]
Thread overview: 103+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-09-27 18:05 Sven Vermeulen [this message]
-- strict thread matches above, loose matches on Subject: below --
2012-09-27 18:05 [gentoo-commits] proj/hardened-refpolicy:master commit in: / Sven Vermeulen
2012-10-02 18:11 Sven Vermeulen
2012-10-02 18:11 Sven Vermeulen
2012-10-04 17:36 Sven Vermeulen
2012-10-04 17:36 Sven Vermeulen
2012-10-04 17:36 Sven Vermeulen
2012-10-06 15:56 Sven Vermeulen
2012-10-06 15:56 Sven Vermeulen
2012-10-06 17:05 Sven Vermeulen
2012-10-06 17:05 Sven Vermeulen
2012-10-06 17:14 Sven Vermeulen
2012-10-16 17:39 Sven Vermeulen
2012-10-16 17:39 Sven Vermeulen
2012-10-16 17:39 Sven Vermeulen
2012-10-17 17:41 Sven Vermeulen
2012-10-22 18:15 Sven Vermeulen
2012-10-27 11:06 Sven Vermeulen
2012-11-06 20:21 Sven Vermeulen
2012-12-03 9:35 Sven Vermeulen
2012-12-03 21:03 Sven Vermeulen
2012-12-08 12:41 Sven Vermeulen
2013-01-16 19:48 Sven Vermeulen
2013-05-01 18:23 Sven Vermeulen
2013-05-01 18:23 Sven Vermeulen
2013-09-23 6:29 [gentoo-commits] proj/hardened-refpolicy:merge " Sven Vermeulen
2013-09-23 13:31 ` [gentoo-commits] proj/hardened-refpolicy:master " Sven Vermeulen
2013-09-23 6:29 [gentoo-commits] proj/hardened-refpolicy:merge " Sven Vermeulen
2013-09-23 13:31 ` [gentoo-commits] proj/hardened-refpolicy:master " Sven Vermeulen
2013-09-23 13:31 Sven Vermeulen
2013-09-26 13:19 Sven Vermeulen
2013-09-30 19:03 Sven Vermeulen
2013-09-30 19:03 Sven Vermeulen
2014-01-19 19:01 Sven Vermeulen
2014-03-06 15:20 Sven Vermeulen
2014-03-17 8:24 Sven Vermeulen
2014-03-17 8:24 Sven Vermeulen
2014-03-17 8:24 Sven Vermeulen
2014-06-25 19:06 Sven Vermeulen
2014-09-21 14:08 [gentoo-commits] proj/hardened-refpolicy:mailinfra " Sven Vermeulen
2014-09-13 9:38 ` [gentoo-commits] proj/hardened-refpolicy:master " Sven Vermeulen
2014-11-22 16:25 Sven Vermeulen
2014-11-27 8:31 Jason Zaman
2014-12-04 1:46 Jason Zaman
2015-02-15 17:39 Sven Vermeulen
2015-03-29 9:59 Jason Zaman
2015-10-26 5:36 [gentoo-commits] proj/hardened-refpolicy:next " Jason Zaman
2015-10-26 5:48 ` [gentoo-commits] proj/hardened-refpolicy:master " Jason Zaman
2015-12-17 16:10 Jason Zaman
2016-05-13 5:37 Jason Zaman
2016-05-13 5:37 Jason Zaman
2016-08-31 16:38 Jason Zaman
2016-08-31 16:38 Jason Zaman
2016-10-24 16:02 Sven Vermeulen
2016-10-24 16:02 [gentoo-commits] proj/hardened-refpolicy:swift " Sven Vermeulen
2016-10-24 16:02 ` [gentoo-commits] proj/hardened-refpolicy:master " Sven Vermeulen
2016-10-24 16:02 [gentoo-commits] proj/hardened-refpolicy:swift " Sven Vermeulen
2016-10-24 16:02 ` [gentoo-commits] proj/hardened-refpolicy:master " Sven Vermeulen
2016-12-06 13:39 Jason Zaman
2017-01-13 18:43 Sven Vermeulen
2017-01-13 18:43 Sven Vermeulen
2017-01-13 18:43 Sven Vermeulen
2017-01-23 15:44 Jason Zaman
2017-01-23 15:44 Jason Zaman
2017-01-23 15:44 Jason Zaman
2017-02-05 6:29 Jason Zaman
2017-02-21 7:11 Jason Zaman
2017-02-21 7:11 Jason Zaman
2017-02-25 16:58 Jason Zaman
2017-02-27 10:50 Jason Zaman
2017-03-02 10:17 Sven Vermeulen
2017-03-30 17:06 Jason Zaman
2017-03-30 17:06 Jason Zaman
2017-04-10 16:59 Sven Vermeulen
2017-06-13 8:25 Jason Zaman
2018-01-18 16:37 Sven Vermeulen
2018-03-25 10:29 Sven Vermeulen
2018-06-24 8:46 Jason Zaman
2018-07-08 11:47 Jason Zaman
2019-02-10 4:14 Jason Zaman
2019-07-13 7:01 Jason Zaman
2019-07-13 7:01 Jason Zaman
2019-12-16 17:48 Jason Zaman
2020-10-13 3:02 Jason Zaman
2021-01-11 1:27 Jason Zaman
2021-02-07 3:20 Jason Zaman
2021-02-07 3:20 Jason Zaman
2021-02-07 3:20 Jason Zaman
2021-02-07 3:20 Jason Zaman
2021-02-07 3:20 Jason Zaman
2021-02-07 3:20 Jason Zaman
2021-02-07 3:20 Jason Zaman
2021-02-07 3:21 Jason Zaman
2021-04-03 3:10 Jason Zaman
2021-11-11 21:27 Jason Zaman
2022-03-31 3:31 Jason Zaman
2022-03-31 3:31 Jason Zaman
2022-03-31 3:31 Jason Zaman
2022-03-31 3:31 Jason Zaman
2023-02-10 20:30 Kenton Groombridge
2024-03-01 19:56 Kenton Groombridge
2024-03-01 19:56 Kenton Groombridge
2024-03-01 19:56 Kenton Groombridge
2024-03-01 19:56 Kenton Groombridge
2024-03-01 19:56 Kenton Groombridge
2024-09-22 0:03 Jason Zaman
2024-09-22 0:03 Jason Zaman
2025-03-08 23:55 Jason Zaman
2025-03-08 23:55 Jason Zaman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1348766138.5e4308f800b9859fcb9654e8242e8fa6ffe059fb.SwifT@gentoo \
--to=sven.vermeulen@siphos.be \
--cc=gentoo-commits@lists.gentoo.org \
--cc=gentoo-dev@lists.gentoo.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox