policy_module(icinga, 1.0.0)

########################################
#
# Declarations
#

require {
	type nagios_admin_plugin_t; type nagios_admin_plugin_exec_t;
	type nagios_checkdisk_plugin_t; type nagios_checkdisk_plugin_exec_t;
	type nagios_mail_plugin_t; type nagios_mail_plugin_exec_t;
	type nagios_services_plugin_t; type nagios_services_plugin_exec_t;
	type nagios_system_plugin_t; type nagios_system_plugin_exec_t;
	type httpd_t;
}

type icinga_t;
type icinga_exec_t;
init_daemon_domain(icinga_t, icinga_exec_t)

# permissive icinga_t;

type icinga_initrc_exec_t;
init_script_file(icinga_initrc_exec_t)

type icinga_log_t;
logging_log_file(icinga_log_t)

type icinga_tmp_t;
files_tmp_file(icinga_tmp_t)

type icinga_var_run_t;
files_pid_file(icinga_var_run_t)

type icinga_spool_t;
files_type(icinga_spool_t)

type icinga_command_t;
files_type(icinga_command_t)

type icinga_web_log_t;
logging_log_file(icinga_web_log_t)

type icinga_web_cache_t;
files_type(icinga_web_cache_t)

type ido2db_t;
type ido2db_exec_t;
init_daemon_domain(ido2db_t, ido2db_exec_t)

# permissive ido2db_t;

type ido2db_initrc_exec_t;
init_script_file(ido2db_initrc_exec_t)

type ido2db_var_run_t;
files_pid_file(ido2db_var_run_t)

########################################
#
# icinga local policy
#
allow icinga_t self:fifo_file rw_fifo_file_perms;
allow icinga_t self:unix_stream_socket create_stream_socket_perms;
dontaudit icinga_t self:capability { dac_override }; # needed?
allow icinga_t self:capability { setuid setgid dac_read_search }; # needed?
allow icinga_t self:process { signal setpgid };

manage_dirs_pattern(icinga_t, icinga_log_t, icinga_log_t)
manage_files_pattern(icinga_t, icinga_log_t, icinga_log_t)
logging_log_filetrans(icinga_t, icinga_log_t, { dir file })

manage_dirs_pattern(icinga_t, icinga_tmp_t, icinga_tmp_t)
manage_files_pattern(icinga_t, icinga_tmp_t, icinga_tmp_t)
files_tmp_filetrans(icinga_t, icinga_tmp_t, { dir file })

manage_dirs_pattern(icinga_t, icinga_var_run_t, icinga_var_run_t)
manage_files_pattern(icinga_t, icinga_var_run_t, icinga_var_run_t)
files_pid_filetrans(icinga_t, icinga_var_run_t, { dir file })
# needs chcon in initscript

manage_dirs_pattern(icinga_t, icinga_spool_t, icinga_spool_t)
manage_files_pattern(icinga_t, icinga_spool_t, icinga_spool_t)
manage_sock_files_pattern(icinga_t, icinga_spool_t, icinga_spool_t)
manage_fifo_files_pattern(icinga_t, icinga_spool_t, icinga_spool_t)
manage_lnk_files_pattern(icinga_t, icinga_spool_t, icinga_spool_t)
files_spool_filetrans(icinga_t, icinga_spool_t, { dir file })

manage_dirs_pattern(icinga_t, icinga_command_t, icinga_command_t)
manage_files_pattern(icinga_t, icinga_command_t, icinga_command_t)
manage_fifo_files_pattern(icinga_t, icinga_command_t, icinga_command_t)

domain_use_interactive_fds(icinga_t)

files_read_etc_files(icinga_t)
files_read_usr_files(icinga_t)

dev_read_urand(icinga_t)

miscfiles_read_localization(icinga_t)

logging_send_syslog_msg(icinga_t)

ido2db_stream_connect(icinga_t)

# should be moved to nagios_plugin_template in nagios.if
icinga_execstrans(nagios_admin_plugin_exec_t, nagios_admin_plugin_t)
icinga_execstrans(nagios_checkdisk_plugin_exec_t, nagios_checkdisk_plugin_t)
icinga_execstrans(nagios_mail_plugin_exec_t, nagios_mail_plugin_t)
icinga_execstrans(nagios_services_plugin_exec_t, nagios_services_plugin_t)
icinga_execstrans(nagios_system_plugin_exec_t, nagios_system_plugin_t)

kernel_read_kernel_sysctls(icinga_t)
kernel_read_system_state(icinga_t)

auth_read_passwd(icinga_t) # needed?

corecmd_exec_shell(icinga_t)

########################################
#
# Icinga CGI local policy
#

optional_policy(`
	apache_content_template(icinga)

	icinga_read_spool_files(httpd_icinga_script_t)
	read_files_pattern(httpd_icinga_script_t, icinga_spool_t, icinga_tmp_t) # icinga moves tmp to spool (status.dat, retention.dat)

	icinga_manage_log(httpd_icinga_script_t)

	icinga_send_commands(httpd_icinga_script_t)

	# permissive httpd_icinga_script_t;
')

########################################
#
# Icinga-Web local policy
#

optional_policy(`
	apache_content_template(icinga_web)
	# should be a boolean in apache-policy
	icinga_send_commands(httpd_t)
')

########################################
#
# ido2db local policy
#
allow ido2db_t self:fifo_file rw_fifo_file_perms;
allow ido2db_t self:unix_stream_socket create_stream_socket_perms;
allow ido2db_t self:capability { setuid setgid }; # needed?
allow ido2db_t self:process signal;

manage_dirs_pattern(ido2db_t, ido2db_var_run_t, ido2db_var_run_t)
manage_files_pattern(ido2db_t, ido2db_var_run_t, ido2db_var_run_t)
files_pid_filetrans(ido2db_t, ido2db_var_run_t, { dir file })
# needs chcon in initscript

manage_files_pattern(ido2db_t, icinga_spool_t, icinga_spool_t)
manage_sock_files_pattern(ido2db_t, icinga_spool_t, icinga_spool_t)

domain_use_interactive_fds(ido2db_t)

files_read_etc_files(ido2db_t)
files_read_usr_files(ido2db_t)
files_search_spool(ido2db_t)

miscfiles_read_localization(ido2db_t)

logging_send_syslog_msg(ido2db_t)

mysql_stream_connect(ido2db_t)
mysql_tcp_connect(ido2db_t)
postgresql_stream_connect(ido2db_t)
postgresql_tcp_connect(ido2db_t)

kernel_read_kernel_sysctls(ido2db_t)

auth_read_passwd(ido2db_t) # needed?


