Primary Selinux policy for tendrl

Makefile

@@ -8,11 +8,19 @@ all: srpm
 
 dist:
 	mkdir -p $(NAME)-$(VERSION)
-	cp -r app config docs lib public spec $(NAME)-$(VERSION)/
+	cp -r app config docs lib public spec selinux $(NAME)-$(VERSION)/
 	cp config.ru Gemfile* Makefile Rakefile README* tendrl-api.* $(NAME)-$(VERSION)/
 	tar -zcf $(NAME)-$(VERSION).tar.gz $(NAME)-$(VERSION)
 	rm -rf $(NAME)-$(VERSION)
 
+bzip-selinux-policy:
+	@cd selinux; \
+	rm -f *.pp.bz2 tmp; \
+	make -f /usr/share/selinux/devel/Makefile; \
+	bzip2 -9 tendrl.pp; \
+        bzip2 -9 carbon.pp; \
+        bzip2 -9 grafana.pp
+
 clean:
 	rm -f $(NAME)-$(VERSION).tar.gz
 	rm -f $(NAME)-$(VERSION)*.rpm

selinux/carbon.fc

@@ -0,0 +1,13 @@
+/usr/bin/carbon-aggregator		--	gen_context(system_u:object_r:carbon_exec_t,s0)
+/usr/bin/carbon-cache		--	gen_context(system_u:object_r:carbon_exec_t,s0)
+/usr/bin/carbon-client		--	gen_context(system_u:object_r:carbon_exec_t,s0)
+/usr/bin/carbon-relay		--	gen_context(system_u:object_r:carbon_exec_t,s0)
+/usr/bin/validate-storage-schemas	--	gen_context(system_u:object_r:carbon_exec_t,s0)
+
+/usr/lib/systemd/system/carbon*  --              gen_context(system_u:object_r:carbon_unit_file_t,s0)
+
+/var/lib/carbon(/.*)?	gen_context(system_u:object_r:carbon_var_lib_t,s0)
+
+/var/log/carbon(/.*)?	gen_context(system_u:object_r:carbon_log_t,s0)
+
+/var/run/carbon-(aggregator|cache)\.pid		gen_context(system_u:object_r:carbon_var_run_t,s0)

selinux/carbon.if

@@ -0,0 +1,56 @@
+
+## <summary>policy for carbon</summary>
+
+########################################
+## <summary>
+##	http stub interface.  No access allowed.
+## </summary>
+## <param name="domain" unused="true">
+##	<summary>
+##	Domain allowed access
+##	</summary>
+## </param>
+#
+interface(`carbon_stub_httpd',`
+	gen_require(`
+		type httpd_t;
+	')
+')
+
+########################################
+## <summary>
+##	Manage carbon lib files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`carbon_manage_lib_files',`
+	gen_require(`
+		type carbon_var_lib_t;
+	')
+
+	files_search_var_lib($1)
+	manage_files_pattern($1, carbon_var_lib_t, carbon_var_lib_t)
+')
+
+########################################
+## <summary>
+##	Manage carbon lib directories.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`carbon_manage_lib_dirs',`
+	gen_require(`
+		type carbon_var_lib_t;
+	')
+
+	files_search_var_lib($1)
+	manage_dirs_pattern($1, carbon_var_lib_t, carbon_var_lib_t)
+')

selinux/carbon.te

@@ -0,0 +1,39 @@
+policy_module(carbon, 1.0.0)
+
+########################################
+#
+# Declarations
+#
+
+type carbon_t;
+type carbon_exec_t;
+init_daemon_domain(carbon_t, carbon_exec_t)
+
+type carbon_var_lib_t;
+files_type(carbon_var_lib_t)
+
+type carbon_log_t;
+logging_log_file(carbon_log_t)
+
+type carbon_var_run_t;
+files_pid_file(carbon_var_run_t)
+
+type carbon_unit_file_t;
+systemd_unit_file(carbon_unit_file_t)
+
+permissive carbon_t;
+
+########################################
+#
+# carbon local policy
+#
+allow carbon_t self:capability { dac_override fowner fsetid setgid setuid };
+allow carbon_t self:unix_stream_socket create_stream_socket_perms;
+allow carbon_t self:tcp_socket { listen accept create_socket_perms };
+
+optional_policy(`
+        carbon_stub_httpd()
+	manage_dirs_pattern(httpd_t, carbon_var_lib_t, carbon_var_lib_t)
+	manage_files_pattern(httpd_t, carbon_var_lib_t, carbon_var_lib_t)
+	corenet_tcp_bind_amanda_port(httpd_t)
+')

selinux/grafana.fc

@@ -0,0 +1,9 @@
+/etc/grafana(/.*)?         gen_context(system_u:object_r:grafana_conf_t,s0)
+
+/usr/sbin/grafana-server		--	gen_context(system_u:object_r:grafana_exec_t,s0)
+
+/usr/lib/systemd/system/grafana-server.*		--	gen_context(system_u:object_r:grafana_unit_file_t,s0)
+
+/var/lib/grafana(/.*)?		gen_context(system_u:object_r:grafana_var_lib_t,s0)
+
+/var/log/grafana(/.*)?		gen_context(system_u:object_r:grafana_log_t,s0)

selinux/grafana.te

@@ -0,0 +1,29 @@
+policy_module(grafana, 1.0.0)
+
+########################################
+#
+# Declarations
+#
+
+type grafana_t;
+type grafana_exec_t;
+init_daemon_domain(grafana_t, grafana_exec_t)
+
+type grafana_conf_t;
+files_config_file(grafana_conf_t)
+
+type grafana_log_t;
+logging_log_file(grafana_log_t)
+
+type grafana_var_lib_t;
+files_type(grafana_var_lib_t)
+
+type grafana_var_run_t;
+files_pid_file(grafana_var_run_t)
+
+type grafana_unit_file_t;
+systemd_unit_file(grafana_unit_file_t)
+
+permissive grafana_t;
+
+########################################

selinux/tendrl.fc

@@ -0,0 +1,13 @@
+/etc/tendrl(/.*)?         gen_context(system_u:object_r:tendrl_conf_t,s0)
+
+/usr/bin/tendrl-monitoring-integration		--	gen_context(system_u:object_r:tendrl_exec_t,s0)
+/usr/bin/tendrl-node-agent			--	gen_context(system_u:object_r:tendrl_exec_t,s0)
+/usr/bin/puma			--	gen_context(system_u:object_r:tendrl_exec_t,s0)
+
+/usr/lib/systemd/system/tendrl-monitoring-integration.*		--	gen_context(system_u:object_r:tendrl_unit_file_t,s0)
+/usr/lib/systemd/system/tendrl-node-agent.*		--	gen_context(system_u:object_r:tendrl_unit_file_t,s0)
+/usr/lib/systemd/system/tendrl-api.*		--	gen_context(system_u:object_r:tendrl_unit_file_t,s0)
+
+/var/lib/tendrl(/.*)?		gen_context(system_u:object_r:tendrl_var_lib_t,s0)
+
+/var/log/tendrl(/.*)?		gen_context(system_u:object_r:tendrl_log_t,s0)

selinux/tendrl.if

@@ -0,0 +1,19 @@
+########################################
+## <summary>
+##	Allow the specified domain to read
+##	tendrl configuration files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`tendrl_read_config',`
+	gen_require(`
+		type tendrl_conf_t;
+	')
+
+	read_files_pattern($1, tendrl_conf_t, tendrl_conf_t)
+')

selinux/tendrl.te

@@ -0,0 +1,49 @@
+policy_module(tendrl, 1.0.0)
+
+########################################
+#
+# Declarations
+#
+
+type tendrl_t;
+type tendrl_exec_t;
+init_daemon_domain(tendrl_t, tendrl_exec_t)
+
+type tendrl_conf_t;
+files_config_file(tendrl_conf_t)
+
+type tendrl_log_t;
+logging_log_file(tendrl_log_t)
+
+type tendrl_var_lib_t;
+files_type(tendrl_var_lib_t)
+
+type tendrl_var_run_t;
+files_pid_file(tendrl_var_run_t)
+
+type tendrl_unit_file_t;
+systemd_unit_file(tendrl_unit_file_t)
+
+permissive tendrl_t;
+
+########################################
+#
+# tendrl local policy
+#
+allow tendrl_t self:capability { sys_rawio sys_admin net_admin };
+allow tendrl_t self:capability2 block_suspend;
+allow tendrl_t self:fifo_file rw_fifo_file_perms;
+allow tendrl_t self:unix_stream_socket create_stream_socket_perms;
+allow tendrl_t self:tcp_socket { accept listen };
+allow tendrl_t self:netlink_route_socket nlmsg_write;
+corecmd_exec_shell(tendrl_t)
+corecmd_exec_bin(tendrl_t)
+
+optional_policy(`
+
+    gen_require(`
+	type httpd_t;
+    ')
+    corenet_tcp_bind_amanda_port(httpd_t)
+    tendrl_read_config(httpd_t)
+')