Attachment 1488214 Details for Bug 1634128 – zabbix_agent.te Policy written by me. Known to work on 5.3 version

zabbix_agent.te Policy written by me. Known to work on 5.3 version

file_1634128.txt (text/plain), 1.52 KB, created by Chris Walker on 2018-09-28 19:44:14 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Chris Walker

Created: 2018-09-28 19:44:14 UTC

Size: 1.52 KB

patch

obsolete

>module zabbix_agent 1.4;
>
>require {
>	type zabbix_agent_t;
>	
>	type cron_var_lib_t;
>	type postfix_local_t;
>	
>	type sudo_exec_t;
>	type user_home_t;
>	
>	type devlog_t;
>	type kernel_t;
>	
>	type httpd_log_t;
>	
>	class dir { unlink create write read setattr add_name remove_name search };
>	class file { unlink execute execute_no_trans create write read open setattr ioctl };
>	
>	class capability { audit_write sys_resource };
>	class netlink_audit_socket { create nlmsg_relay };
>	class process { execmem };
>	class unix_dgram_socket { connect create sendto };
>	class sock_file { write read };
>	
>	class process { setrlimit };
>	
>}
>
>#============= zabbix_agent_t ==============
>allow zabbix_agent_t cron_var_lib_t:file { unlink read setattr open create write ioctl };
>allow zabbix_agent_t cron_var_lib_t:dir { unlink read create write setattr add_name remove_name };
>allow zabbix_agent_t self:capability { audit_write sys_resource };
>allow zabbix_agent_t self:netlink_audit_socket { create nlmsg_relay };
>allow zabbix_agent_t self:process execmem;
>allow zabbix_agent_t self:unix_dgram_socket { connect create };
>allow zabbix_agent_t sudo_exec_t:file { execute execute_no_trans };
>allow zabbix_agent_t user_home_t:sock_file write;
>allow zabbix_agent_t self:process setrlimit;
>allow zabbix_agent_t devlog_t:sock_file write;
>allow zabbix_agent_t kernel_t:unix_dgram_socket sendto;
>allow zabbix_agent_t httpd_log_t:file { open read };
>#============= postfix_local_t ==============
>allow postfix_local_t cron_var_lib_t:dir search;

Actions: View

Attachments on bug 1634128: 1488198 | 1488214 | 1488215