[refpolicy] [PATCH 6/7] Allow zabbix server to connect to agent (active monitoring)

[sven.vermeulen@siphos.be (Sven Vermeulen)]

On Mon, Jun 13, 2011 at 10:35:53AM +0200, Sven Vermeulen wrote:
> The zabbix server also connects to the agents (this is called "active
> monitoring" in the zabbix terms). So we create a zabbix_agent_tcp_connect
> interface, use it for the zabbix_t domain and, since zabbix can use
> hostname-based connections, allow DNS resolving for the zabbix server.

Should've copied better.

corenet_sendrecv_zabbix_agent_packets doesn't exist, it's
corenet_sendrecv_zabbix_agent_client_packets.

Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
---
 policy/modules/services/zabbix.if |   21 +++++++++++++++++++++
 policy/modules/services/zabbix.te |    4 ++++
 2 files changed, 25 insertions(+), 0 deletions(-)

diff --git a/policy/modules/services/zabbix.if b/policy/modules/services/zabbix.if
index 7e37c21..9e8898d 100644
--- a/policy/modules/services/zabbix.if
+++ b/policy/modules/services/zabbix.if
@@ -79,6 +79,27 @@ interface(`zabbix_read_pid_files',`
 
 ########################################
 ## <summary>
+##      Allow connectivity to a zabbix agent
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+#
+interface(`zabbix_agent_tcp_connect',`
+        gen_require(`
+                type zabbix_agent_t;
+        ')
+
+        corenet_tcp_recvfrom_labeled($1, zabbix_agent_t)
+        corenet_tcp_sendrecv_zabbix_agent_port($1)
+        corenet_tcp_connect_zabbix_agent_port($1)
+        corenet_sendrecv_zabbix_agent_client_packets($1)
+')
+
+########################################
+## <summary>
 ##      Allow connectivity to the zabbix server
 ## </summary>
 ## <param name="domain">
diff --git a/policy/modules/services/zabbix.te b/policy/modules/services/zabbix.te
index a5fc923..ec4fccd 100644
--- a/policy/modules/services/zabbix.te
+++ b/policy/modules/services/zabbix.te
@@ -58,11 +58,15 @@ files_pid_filetrans(zabbix_t, zabbix_var_run_t, { dir file })
 rw_files_pattern(zabbix_t, zabbix_tmpfs_t, zabbix_tmpfs_t)
 fs_tmpfs_filetrans(zabbix_t, zabbix_tmpfs_t, { dir file })
 
+sysnet_dns_name_resolve(zabbix_t)
+
 files_read_etc_files(zabbix_t)
 
 corenet_tcp_bind_generic_node(zabbix_t)
 corenet_tcp_bind_zabbix_port(zabbix_t)
 
+zabbix_agent_tcp_connect(zabbix_t)
+
 miscfiles_read_localization(zabbix_t)
 
 optional_policy(`
-- 
1.7.3.4