Primary Selinux policy for tendrl

Initial selinux policy for tendrl server to run in permissive domain This provides selinux permissive policies for tendrl-server, grafana and carbon with the following features: - Allows tendrl processes to run in permissive mode - Perform checks but will not enforce - Users don't have to switch to permissive mode globally - Allows to catch AVC messages Signed-off-by: Lukas Vrabec <[email protected]> Signed-off-by: Timothy Asir J <[email protected]>
Tendrl · Sep 14, 2017 · b204cbd · b204cbd
1 parent ff298f9
commit b204cbd
Show file tree

Hide file tree

Showing 4 changed files with 66 additions and 0 deletions.
diff --git a/selinux/grafana.fc b/selinux/grafana.fc
@@ -0,0 +1,9 @@
+/etc/grafana(/.*)?         gen_context(system_u:object_r:grafana_conf_t,s0)
+
+/usr/sbin/grafana-server		--	gen_context(system_u:object_r:grafana_exec_t,s0)
+
+/usr/lib/systemd/system/grafana-server.*		--	gen_context(system_u:object_r:grafana_unit_file_t,s0)
+
+/var/lib/grafana(/.*)?		gen_context(system_u:object_r:grafana_var_lib_t,s0)
+
+/var/log/grafana(/.*)?		gen_context(system_u:object_r:grafana_log_t,s0)
diff --git a/selinux/grafana.te b/selinux/grafana.te
@@ -0,0 +1,29 @@
+policy_module(grafana, 1.0.0)
+
+########################################
+#
+# Declarations
+#
+
+type grafana_t;
+type grafana_exec_t;
+init_daemon_domain(grafana_t, grafana_exec_t)
+
+type grafana_conf_t;
+files_config_file(grafana_conf_t)
+
+type grafana_log_t;
+logging_log_file(grafana_log_t)
+
+type grafana_var_lib_t;
+files_type(grafana_var_lib_t)
+
+type grafana_var_run_t;
+files_pid_file(grafana_var_run_t)
+
+type grafana_unit_file_t;
+systemd_unit_file(grafana_unit_file_t)
+
+permissive grafana_t;
+
+########################################
diff --git a/selinux/tendrl.if b/selinux/tendrl.if
@@ -0,0 +1,19 @@
+########################################
+## <summary>
+##	Allow the specified domain to read
+##	tendrl configuration files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`tendrl_read_config',`
+	gen_require(`
+		type tendrl_conf_t;
+	')
+
+	read_files_pattern($1, tendrl_conf_t, tendrl_conf_t)
+')
diff --git a/selinux/tendrl.te b/selinux/tendrl.te
@@ -38,3 +38,12 @@ allow tendrl_t self:tcp_socket { accept listen };
 allow tendrl_t self:netlink_route_socket nlmsg_write;
 corecmd_exec_shell(tendrl_t)
 corecmd_exec_bin(tendrl_t)
+
+optional_policy(`
+
+    gen_require(`
+	type httpd_t;
+    ')
+    corenet_tcp_bind_amanda_port(httpd_t)
+    tendrl_read_config(httpd_t)
+')