From d516352a45d3bae02cdf2e45f911bf284160f4e2 Mon Sep 17 00:00:00 2001
From: CoprDistGit <infra@openeuler.org>
Date: Tue, 22 Aug 2023 07:42:22 +0000
Subject: automatic import of zabbix

---
 zabbix.if | 199 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 199 insertions(+)
 create mode 100644 zabbix.if

(limited to 'zabbix.if')

diff --git a/zabbix.if b/zabbix.if
new file mode 100644
index 0000000..7cf8202
--- /dev/null
+++ b/zabbix.if
@@ -0,0 +1,199 @@
+## <summary>Distributed infrastructure monitoring</summary>
+
+########################################
+## <summary>
+##	Execute a domain transition to run zabbix.
+## </summary>
+## <param name="domain">
+## <summary>
+##	Domain allowed to transition.
+## </summary>
+## </param>
+#
+interface(`zabbix_domtrans',`
+	gen_require(`
+		type zabbix_t, zabbix_exec_t;
+	')
+
+	domtrans_pattern($1, zabbix_exec_t, zabbix_t)
+')
+
+########################################
+## <summary>
+##	Execute a domain transition to run zabbix_script.
+## </summary>
+## <param name="domain">
+## <summary>
+##	Domain allowed to transition.
+## </summary>
+## </param>
+#
+interface(`zabbix_script_domtrans',`
+	gen_require(`
+		type zabbix_script_t, zabbix_script_exec_t;
+	')
+
+	domtrans_pattern($1, zabbix_script_exec_t, zabbix_script_t)
+')
+
+########################################
+## <summary>
+## 	Allow connectivity to the zabbix server
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`zabbix_tcp_connect',`
+	gen_require(`
+		type zabbix_t;
+	')
+
+	corenet_sendrecv_zabbix_agent_client_packets($1)
+	corenet_tcp_connect_zabbix_port($1)
+	corenet_tcp_recvfrom_labeled($1, zabbix_t)
+	corenet_tcp_sendrecv_zabbix_port($1)
+')
+
+########################################
+## <summary>
+##	Allow the specified domain to read zabbix's log files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`zabbix_read_log',`
+	gen_require(`
+		type zabbix_log_t;
+	')
+
+	logging_search_logs($1)
+	read_files_pattern($1, zabbix_log_t, zabbix_log_t)
+')
+
+########################################
+## <summary>
+##	Allow the specified domain to read zabbix's tmp files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`zabbix_read_tmp',`
+	gen_require(`
+		type zabbix_tmp_t;
+	')
+
+	files_search_tmp($1)
+	read_files_pattern($1, zabbix_tmp_t, zabbix_tmp_t)
+')
+
+########################################
+## <summary>
+##	Allow the specified domain to append
+##	zabbix log files.
+## </summary>
+## <param name="domain">
+## 	<summary>
+##	Domain allowed access.
+## 	</summary>
+## </param>
+#
+interface(`zabbix_append_log',`
+	gen_require(`
+		type zabbix_log_t;
+	')
+
+	logging_search_logs($1)
+	append_files_pattern($1, zabbix_log_t, zabbix_log_t)
+')
+
+########################################
+## <summary>
+##	Read zabbix PID files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`zabbix_read_pid_files',`
+	gen_require(`
+		type zabbix_var_run_t;
+	')
+
+	files_search_pids($1)
+	allow $1 zabbix_var_run_t:file read_file_perms;
+')
+
+########################################
+## <summary>
+## 	Allow connectivity to a zabbix agent
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`zabbix_agent_tcp_connect',`
+	gen_require(`
+		type zabbix_t, zabbix_agent_t;
+	')
+
+	corenet_sendrecv_zabbix_agent_client_packets($1)
+	corenet_tcp_connect_zabbix_agent_port($1)
+	corenet_tcp_recvfrom_labeled($1, zabbix_t)
+	corenet_tcp_sendrecv_zabbix_agent_port($1)
+')
+
+########################################
+## <summary>
+##	All of the rules required to administrate
+##	an zabbix environment
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="role">
+##	<summary>
+##	The role to be allowed to manage the zabbix domain.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`zabbix_admin',`
+	gen_require(`
+		type zabbix_t, zabbix_log_t, zabbix_var_run_t;
+		type zabbix_initrc_exec_t;
+	')
+
+	allow $1 zabbix_t:process signal_perms;
+	ps_process_pattern($1, zabbix_t)
+	tunable_policy(`deny_ptrace',`',`
+		allow $1 zabbix_t:process ptrace;
+	')
+
+	init_labeled_script_domtrans($1, zabbix_initrc_exec_t)
+	domain_system_change_exemption($1)
+	role_transition $2 zabbix_initrc_exec_t system_r;
+	allow $2 system_r;
+
+	logging_list_logs($1)
+	admin_pattern($1, zabbix_log_t)
+
+	files_list_pids($1)
+	admin_pattern($1, zabbix_var_run_t)
+')
-- 
cgit v1.2.3