Primary Selinux policy for tendrl

Initial selinux policy for tendrl server to run in permissive domain
This provides selinux permissive policies for tendrl-server,
grafana and carbon with the following features:
  - Allows tendrl processes to run in permissive mode
  - Perform checks but will not enforce
  - Users don't have to switch to permissive mode globally
  - Allows to catch AVC messages

Signed-off-by: Lukas Vrabec <[email protected]>
Signed-off-by: Timothy Asir J <[email protected]>

selinux/carbon.if

@@ -0,0 +1,56 @@
+
+## <summary>policy for carbon</summary>
+
+########################################
+## <summary>
+##	http stub interface.  No access allowed.
+## </summary>
+## <param name="domain" unused="true">
+##	<summary>
+##	Domain allowed access
+##	</summary>
+## </param>
+#
+interface(`carbon_stub_httpd',`
+	gen_require(`
+		type httpd_t;
+	')
+')
+
+########################################
+## <summary>
+##	Manage carbon lib files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`carbon_manage_lib_files',`
+	gen_require(`
+		type carbon_var_lib_t;
+	')
+
+	files_search_var_lib($1)
+	manage_files_pattern($1, carbon_var_lib_t, carbon_var_lib_t)
+')
+
+########################################
+## <summary>
+##	Manage carbon lib directories.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`carbon_manage_lib_dirs',`
+	gen_require(`
+		type carbon_var_lib_t;
+	')
+
+	files_search_var_lib($1)
+	manage_dirs_pattern($1, carbon_var_lib_t, carbon_var_lib_t)
+')

selinux/carbon.te

@@ -30,3 +30,10 @@ permissive carbon_t;
 allow carbon_t self:capability { dac_override fowner fsetid setgid setuid };
 allow carbon_t self:unix_stream_socket create_stream_socket_perms;
 allow carbon_t self:tcp_socket { listen accept create_socket_perms };
+
+optional_policy(`
+        carbon_stub_httpd()
+	manage_dirs_pattern(httpd_t, carbon_var_lib_t, carbon_var_lib_t)
+	manage_files_pattern(httpd_t, carbon_var_lib_t, carbon_var_lib_t)
+	corenet_tcp_bind_amanda_port(httpd_t)
+')