From: sven.vermeulen@siphos.be (Sven Vermeulen) Date: Wed, 15 Jun 2011 18:57:43 +0200 Subject: [refpolicy] [PATCH 5/7] Zabbix agent binds on its own port, connects to zabbix server In-Reply-To: <20110613083412.GF18072@siphos.be> References: <20110613082006.GA18072@siphos.be> <20110613082550.GB18072@siphos.be> <20110613082815.GC18072@siphos.be> <20110613082930.GD18072@siphos.be> <20110613083136.GE18072@siphos.be> <20110613083412.GF18072@siphos.be> Message-ID: <20110615165742.GB17584@siphos.be> To: refpolicy@oss.tresys.com List-Id: refpolicy.oss.tresys.com The zabbix agent has its own dedicated port (10050) on which it needs to bind/listen. Also, the agent connects to the server so we add the zabbix_tcp_connect interface (shamelessly copied from mysql_tcp_connect) and use it for the zabbix_agent_t domain. Update: structure interface calls more closely to styleguide Signed-off-by: Sven Vermeulen --- policy/modules/kernel/corenetwork.te.in | 1 + policy/modules/services/zabbix.if | 21 +++++++++++++++++++++ policy/modules/services/zabbix.te | 7 +++++++ 3 files changed, 29 insertions(+), 0 deletions(-) diff --git a/policy/modules/kernel/corenetwork.te.in b/policy/modules/kernel/corenetwork.te.in index f4937b9..fb5dd13 100644 --- a/policy/modules/kernel/corenetwork.te.in +++ b/policy/modules/kernel/corenetwork.te.in @@ -224,6 +224,7 @@ network_port(xfs, tcp,7100,s0) network_port(xserver, tcp,6000-6020,s0) network_port(zarafa, tcp,236,s0, tcp,237,s0) network_port(zabbix, tcp,10051,s0) +network_port(zabbix_agent, tcp,10050,s0) network_port(zookeeper_client, tcp,2181,s0) network_port(zookeeper_election, tcp,3888,s0) network_port(zookeeper_leader, tcp,2888,s0) diff --git a/policy/modules/services/zabbix.if b/policy/modules/services/zabbix.if index d77e631..e1cc9b5 100644 --- a/policy/modules/services/zabbix.if +++ b/policy/modules/services/zabbix.if @@ -79,6 +79,27 @@ interface(`zabbix_read_pid_files',` ######################################## ## +## Allow connectivity to the zabbix server +## +## +## +## Domain allowed access. +## +## +# +interface(`zabbix_tcp_connect',` + gen_require(` + type zabbix_t; + ') + + corenet_sendrecv_zabbix_agent_packets($1) + corenet_tcp_connect_zabbix_port($1) + corenet_tcp_recvfrom_labeled($1, zabbix_t) + corenet_tcp_sendrecv_zabbix_port($1) +') + +######################################## +## ## All of the rules required to administrate ## an zabbix environment ## diff --git a/policy/modules/services/zabbix.te b/policy/modules/services/zabbix.te index 457aa2f..f0b241b 100644 --- a/policy/modules/services/zabbix.te +++ b/policy/modules/services/zabbix.te @@ -97,6 +97,9 @@ manage_files_pattern(zabbix_agent_t, zabbix_log_t, zabbix_log_t) manage_files_pattern(zabbix_agent_t, zabbix_var_run_t, zabbix_var_run_t) files_pid_filetrans(zabbix_agent_t, zabbix_var_run_t, file) +# Network access to zabbix server +zabbix_tcp_connect(zabbix_agent_t) + # Shared Memory support rw_files_pattern(zabbix_agent_t, zabbix_tmpfs_t, zabbix_tmpfs_t) fs_tmpfs_filetrans(zabbix_agent_t, zabbix_tmpfs_t, file) @@ -104,3 +107,7 @@ fs_tmpfs_filetrans(zabbix_agent_t, zabbix_tmpfs_t, file) ## Kernel layer module calls ## System layer module calls + +# sysnetwork module +sysnet_dns_name_resolve(zabbix_agent_t) + -- 1.7.3.4