* [refpolicy] [PATCH 0/7] Updates on zabbix service @ 2011-06-13 8:20 Sven Vermeulen 2011-06-13 8:25 ` [refpolicy] [PATCH 1/7] zabbix server spawns multiple processes Sven Vermeulen 2011-06-15 18:20 ` [refpolicy] [PATCH 0/7] Updates on zabbix service Christopher J. PeBenito 0 siblings, 2 replies; 18+ messages in thread From: Sven Vermeulen @ 2011-06-13 8:20 UTC (permalink / raw) To: refpolicy Zabbix is an open-source/free software monitoring solution. A module already exists in the refpolicy, but does not work properly. Also, the module does not support a different domain for the agents (zabbix agents) although this is greatly preferred. The following set of patches introduce the following to this module set: 1. Zabbix server is a multi-process system requiring signals to be sent and (exclusive) locks to be taken where needed (for instance used with logging) 2. Zabbix servers use posix shared memory (using tmpfs backend), so create a zabbix_tmpfs_t domain and allow the server access to manage it 3. Zabbix uses a dedicated port (10051) for its server. Allow the servers to bind to it, and of course define it as a specific port in SELinux 4. Start with the definition of the zabbix_agent_t domain 5. Allow zabbix_agent to bind on its own port (10050) and connect to the zabbix server (for the regular metric submissions) 6. The zabbix server also needs to connect to the agent (for what Zabbix calls "active monitoring") 7. Give zabbix_agent_t the privileges it needs to scan the system (get system state, read files, check services, ...) Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be> ^ permalink raw reply [flat|nested] 18+ messages in thread
* [refpolicy] [PATCH 1/7] zabbix server spawns multiple processes 2011-06-13 8:20 [refpolicy] [PATCH 0/7] Updates on zabbix service Sven Vermeulen @ 2011-06-13 8:25 ` Sven Vermeulen 2011-06-13 8:28 ` [refpolicy] [PATCH 2/7] Support shared memory Sven Vermeulen 2011-06-15 18:20 ` [refpolicy] [PATCH 0/7] Updates on zabbix service Christopher J. PeBenito 1 sibling, 1 reply; 18+ messages in thread From: Sven Vermeulen @ 2011-06-13 8:25 UTC (permalink / raw) To: refpolicy The zabbix server process is a multi-process system. In order to, for instance, shut it down, signalling within the domain is necessary. Otherwise, the processes remain running. Also, since there are multiple processes trying to use the same log file, the zabbix server uses semaphores to ensure proper access to the log files (concurrency). Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be> --- policy/modules/services/zabbix.te | 2 ++ 1 files changed, 2 insertions(+), 0 deletions(-) diff --git a/policy/modules/services/zabbix.te b/policy/modules/services/zabbix.te index c26ecf5..3dd76ca 100644 --- a/policy/modules/services/zabbix.te +++ b/policy/modules/services/zabbix.te @@ -27,7 +27,9 @@ files_pid_file(zabbix_var_run_t) allow zabbix_t self:capability { setuid setgid }; allow zabbix_t self:fifo_file rw_file_perms; +allow zabbix_t self:process { setsched getsched signal }; allow zabbix_t self:unix_stream_socket create_stream_socket_perms; +allow zabbix_t self:sem create_sem_perms; # log files allow zabbix_t zabbix_log_t:dir setattr; -- 1.7.3.4 ^ permalink raw reply related [flat|nested] 18+ messages in thread
* [refpolicy] [PATCH 2/7] Support shared memory 2011-06-13 8:25 ` [refpolicy] [PATCH 1/7] zabbix server spawns multiple processes Sven Vermeulen @ 2011-06-13 8:28 ` Sven Vermeulen 2011-06-13 8:29 ` [refpolicy] [PATCH 3/7] Define zabbix port and allow server to listen/bind on it Sven Vermeulen 2011-06-13 10:10 ` [refpolicy] [PATCH 2/7] Support shared memory Sven Vermeulen 0 siblings, 2 replies; 18+ messages in thread From: Sven Vermeulen @ 2011-06-13 8:28 UTC (permalink / raw) To: refpolicy Zabbix servers use shared memory to keep common information and structures. This is implemented on tmpfs. We support this by introducing a zabbix_tmpfs_t type and allow the server proper access to it. Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be> --- policy/modules/services/zabbix.te | 9 +++++++++ 1 files changed, 9 insertions(+), 0 deletions(-) diff --git a/policy/modules/services/zabbix.te b/policy/modules/services/zabbix.te index 3dd76ca..bec98e9 100644 --- a/policy/modules/services/zabbix.te +++ b/policy/modules/services/zabbix.te @@ -16,6 +16,10 @@ init_script_file(zabbix_initrc_exec_t) type zabbix_log_t; logging_log_file(zabbix_log_t) +# shared memory +type zabbix_tmpfs_t; +files_tmpfs_file(zabbix_tmpfs_t); + # pid files type zabbix_var_run_t; files_pid_file(zabbix_var_run_t) @@ -30,6 +34,7 @@ allow zabbix_t self:fifo_file rw_file_perms; allow zabbix_t self:process { setsched getsched signal }; allow zabbix_t self:unix_stream_socket create_stream_socket_perms; allow zabbix_t self:sem create_sem_perms; +allow zabbix_t self:shm create_shm_perms; # log files allow zabbix_t zabbix_log_t:dir setattr; @@ -41,6 +46,10 @@ manage_dirs_pattern(zabbix_t, zabbix_var_run_t, zabbix_var_run_t) manage_files_pattern(zabbix_t, zabbix_var_run_t, zabbix_var_run_t) files_pid_filetrans(zabbix_t, zabbix_var_run_t, { dir file }) +# shared memory +rw_files_pattern(zabbix_t, zabbix_tmpfs_t, zabbix_tmpfs_t) +fs_tmpfs_filetrans(zabbix_t, zabbix_tmpfs_t, { dir file }) + files_read_etc_files(zabbix_t) miscfiles_read_localization(zabbix_t) -- 1.7.3.4 ^ permalink raw reply related [flat|nested] 18+ messages in thread
* [refpolicy] [PATCH 3/7] Define zabbix port and allow server to listen/bind on it 2011-06-13 8:28 ` [refpolicy] [PATCH 2/7] Support shared memory Sven Vermeulen @ 2011-06-13 8:29 ` Sven Vermeulen 2011-06-13 8:31 ` [refpolicy] [PATCH 4/7] Support different domain for zabbix agent (start with skeleton) Sven Vermeulen 2011-06-13 10:10 ` [refpolicy] [PATCH 2/7] Support shared memory Sven Vermeulen 1 sibling, 1 reply; 18+ messages in thread From: Sven Vermeulen @ 2011-06-13 8:29 UTC (permalink / raw) To: refpolicy The zabbix server uses a dedicated port (10051). We define it and allow the zabbix server to bind/listen on it. Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be> --- policy/modules/kernel/corenetwork.te.in | 1 + policy/modules/services/zabbix.te | 4 ++++ 2 files changed, 5 insertions(+), 0 deletions(-) diff --git a/policy/modules/kernel/corenetwork.te.in b/policy/modules/kernel/corenetwork.te.in index 4676d6e..f4937b9 100644 --- a/policy/modules/kernel/corenetwork.te.in +++ b/policy/modules/kernel/corenetwork.te.in @@ -223,6 +223,7 @@ network_port(xen, tcp,8002,s0) network_port(xfs, tcp,7100,s0) network_port(xserver, tcp,6000-6020,s0) network_port(zarafa, tcp,236,s0, tcp,237,s0) +network_port(zabbix, tcp,10051,s0) network_port(zookeeper_client, tcp,2181,s0) network_port(zookeeper_election, tcp,3888,s0) network_port(zookeeper_leader, tcp,2888,s0) diff --git a/policy/modules/services/zabbix.te b/policy/modules/services/zabbix.te index bec98e9..839422c 100644 --- a/policy/modules/services/zabbix.te +++ b/policy/modules/services/zabbix.te @@ -35,6 +35,7 @@ allow zabbix_t self:process { setsched getsched signal }; allow zabbix_t self:unix_stream_socket create_stream_socket_perms; allow zabbix_t self:sem create_sem_perms; allow zabbix_t self:shm create_shm_perms; +allow zabbix_t self:tcp_socket create_stream_socket_perms; # log files allow zabbix_t zabbix_log_t:dir setattr; @@ -52,6 +53,9 @@ fs_tmpfs_filetrans(zabbix_t, zabbix_tmpfs_t, { dir file }) files_read_etc_files(zabbix_t) +corenet_tcp_bind_generic_node(zabbix_t) +corenet_tcp_bind_zabbix_port(zabbix_t) + miscfiles_read_localization(zabbix_t) optional_policy(` -- 1.7.3.4 ^ permalink raw reply related [flat|nested] 18+ messages in thread
* [refpolicy] [PATCH 4/7] Support different domain for zabbix agent (start with skeleton) 2011-06-13 8:29 ` [refpolicy] [PATCH 3/7] Define zabbix port and allow server to listen/bind on it Sven Vermeulen @ 2011-06-13 8:31 ` Sven Vermeulen 2011-06-13 8:34 ` [refpolicy] [PATCH 5/7] Zabbix agent binds on its own port, connects to zabbix server Sven Vermeulen ` (2 more replies) 0 siblings, 3 replies; 18+ messages in thread From: Sven Vermeulen @ 2011-06-13 8:31 UTC (permalink / raw) To: refpolicy The zabbix agent should be confined within its own domain. We start with the definition of a small(er) skeleton to work from. This includes proper file context definitions, standard interdomain privileges (which are quite similar to those of the server) and the proper log- and pid access privileges. Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be> --- policy/modules/services/zabbix.fc | 4 +++- policy/modules/services/zabbix.te | 35 +++++++++++++++++++++++++++++++++++ 2 files changed, 38 insertions(+), 1 deletions(-) diff --git a/policy/modules/services/zabbix.fc b/policy/modules/services/zabbix.fc index 3102286..125529a 100644 --- a/policy/modules/services/zabbix.fc +++ b/policy/modules/services/zabbix.fc @@ -1,6 +1,8 @@ /etc/rc\.d/init\.d/zabbix -- gen_context(system_u:object_r:zabbix_initrc_exec_t,s0) +/etc/rc\.d/init\.d/zabbix-agentd -- gen_context(system_u:object_r:zabbix_agent_initrc_exec_t,s0) -/usr/bin/zabbix_server -- gen_context(system_u:object_r:zabbix_exec_t,s0) +/usr/(s)?bin/zabbix_server -- gen_context(system_u:object_r:zabbix_exec_t,s0) +/usr/(s)?bin/zabbix_agentd -- gen_context(system_u:object_r:zabbix_agent_exec_t,s0) /var/log/zabbix(/.*)? gen_context(system_u:object_r:zabbix_log_t,s0) diff --git a/policy/modules/services/zabbix.te b/policy/modules/services/zabbix.te index 839422c..83bb522 100644 --- a/policy/modules/services/zabbix.te +++ b/policy/modules/services/zabbix.te @@ -9,9 +9,16 @@ type zabbix_t; type zabbix_exec_t; init_daemon_domain(zabbix_t, zabbix_exec_t) +type zabbix_agent_t; +type zabbix_agent_exec_t; +init_daemon_domain(zabbix_agent_t, zabbix_agent_exec_t) + type zabbix_initrc_exec_t; init_script_file(zabbix_initrc_exec_t) +type zabbix_agent_initrc_exec_t; +init_script_file(zabbix_agent_initrc_exec_t) + # log files type zabbix_log_t; logging_log_file(zabbix_log_t) @@ -65,3 +72,31 @@ optional_policy(` optional_policy(` postgresql_stream_connect(zabbix_t) ') + +######################################## +# +# zabbix agent local policy +# + +allow zabbix_agent_t self:capability { setuid setgid }; +allow zabbix_agent_t self:process { setsched getsched signal }; +allow zabbix_agent_t self:fifo_file rw_file_perms; +allow zabbix_agent_t self:unix_stream_socket create_stream_socket_perms; +allow zabbix_agent_t self:sem create_sem_perms; +allow zabbix_agent_t self:tcp_socket create_stream_socket_perms; +allow zabbix_agent_t self:shm create_shm_perms; + +## Rules relating to the objects managed by this policy file +# Logging access +filetrans_pattern(zabbix_agent_t, zabbix_log_t, zabbix_log_t, file) +manage_files_pattern(zabbix_agent_t, zabbix_log_t, zabbix_log_t) +# PID file management +manage_files_pattern(zabbix_agent_t, zabbix_var_run_t, zabbix_var_run_t) +files_pid_filetrans(zabbix_agent_t, zabbix_var_run_t, file) +# Shared memory +rw_files_pattern(zabbix_agent_t, zabbix_tmpfs_t, zabbix_tmpfs_t) +fs_tmpfs_filetrans(zabbix_agent_t, zabbix_tmpfs_t, { dir file }) + +## kernel layer module calls + +## system layer module calls -- 1.7.3.4 ^ permalink raw reply related [flat|nested] 18+ messages in thread
* [refpolicy] [PATCH 5/7] Zabbix agent binds on its own port, connects to zabbix server 2011-06-13 8:31 ` [refpolicy] [PATCH 4/7] Support different domain for zabbix agent (start with skeleton) Sven Vermeulen @ 2011-06-13 8:34 ` Sven Vermeulen 2011-06-13 8:35 ` [refpolicy] [PATCH 6/7] Allow zabbix server to connect to agent (active monitoring) Sven Vermeulen ` (2 more replies) [not found] ` <20110613101151.GB26655@siphos.be> 2011-06-15 16:56 ` Sven Vermeulen 2 siblings, 3 replies; 18+ messages in thread From: Sven Vermeulen @ 2011-06-13 8:34 UTC (permalink / raw) To: refpolicy The zabbix agent has its own dedicated port (10050) on which it needs to bind/listen. Also, the agent connects to the server so we add the zabbix_tcp_connect interface (shamelessly copied from mysql_tcp_connect) and use it for the zabbix_agent_t domain. Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be> --- policy/modules/kernel/corenetwork.te.in | 1 + policy/modules/services/zabbix.if | 21 +++++++++++++++++++++ policy/modules/services/zabbix.te | 6 ++++++ 3 files changed, 28 insertions(+), 0 deletions(-) diff --git a/policy/modules/kernel/corenetwork.te.in b/policy/modules/kernel/corenetwork.te.in index f4937b9..fb5dd13 100644 --- a/policy/modules/kernel/corenetwork.te.in +++ b/policy/modules/kernel/corenetwork.te.in @@ -224,6 +224,7 @@ network_port(xfs, tcp,7100,s0) network_port(xserver, tcp,6000-6020,s0) network_port(zarafa, tcp,236,s0, tcp,237,s0) network_port(zabbix, tcp,10051,s0) +network_port(zabbix_agent, tcp,10050,s0) network_port(zookeeper_client, tcp,2181,s0) network_port(zookeeper_election, tcp,3888,s0) network_port(zookeeper_leader, tcp,2888,s0) diff --git a/policy/modules/services/zabbix.if b/policy/modules/services/zabbix.if index d77e631..7e37c21 100644 --- a/policy/modules/services/zabbix.if +++ b/policy/modules/services/zabbix.if @@ -79,6 +79,27 @@ interface(`zabbix_read_pid_files',` ######################################## ## <summary> +## Allow connectivity to the zabbix server +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`zabbix_tcp_connect',` + gen_require(` + type zabbix_t; + ') + + corenet_tcp_recvfrom_labeled($1, zabbix_t) + corenet_tcp_sendrecv_zabbix_port($1) + corenet_tcp_connect_zabbix_port($1) + corenet_sendrecv_zabbix_agent_packets($1) +') + +######################################## +## <summary> ## All of the rules required to administrate ## an zabbix environment ## </summary> diff --git a/policy/modules/services/zabbix.te b/policy/modules/services/zabbix.te index 83bb522..a5fc923 100644 --- a/policy/modules/services/zabbix.te +++ b/policy/modules/services/zabbix.te @@ -93,10 +93,16 @@ manage_files_pattern(zabbix_agent_t, zabbix_log_t, zabbix_log_t) # PID file management manage_files_pattern(zabbix_agent_t, zabbix_var_run_t, zabbix_var_run_t) files_pid_filetrans(zabbix_agent_t, zabbix_var_run_t, file) +# Port access +zabbix_tcp_connect(zabbix_agent_t) # Shared memory rw_files_pattern(zabbix_agent_t, zabbix_tmpfs_t, zabbix_tmpfs_t) fs_tmpfs_filetrans(zabbix_agent_t, zabbix_tmpfs_t, { dir file }) ## kernel layer module calls +corenet_tcp_bind_generic_node(zabbix_agent_t) +corenet_tcp_bind_zabbix_agent_port(zabbix_agent_t) +corenet_tcp_connect_zabbix_port(zabbix_agent_t) ## system layer module calls +sysnet_dns_name_resolve(zabbix_agent_t) -- 1.7.3.4 ^ permalink raw reply related [flat|nested] 18+ messages in thread
* [refpolicy] [PATCH 6/7] Allow zabbix server to connect to agent (active monitoring) 2011-06-13 8:34 ` [refpolicy] [PATCH 5/7] Zabbix agent binds on its own port, connects to zabbix server Sven Vermeulen @ 2011-06-13 8:35 ` Sven Vermeulen 2011-06-13 8:40 ` [refpolicy] [PATCH 7/7] Allow zabbix agent to query system state and other monitorable aspects Sven Vermeulen ` (2 more replies) 2011-06-13 10:13 ` [refpolicy] [PATCH 5/7] Zabbix agent binds on its own port, connects to zabbix server Sven Vermeulen 2011-06-15 16:57 ` Sven Vermeulen 2 siblings, 3 replies; 18+ messages in thread From: Sven Vermeulen @ 2011-06-13 8:35 UTC (permalink / raw) To: refpolicy The zabbix server also connects to the agents (this is called "active monitoring" in the zabbix terms). So we create a zabbix_agent_tcp_connect interface, use it for the zabbix_t domain and, since zabbix can use hostname-based connections, allow DNS resolving for the zabbix server. Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be> --- policy/modules/services/zabbix.if | 21 +++++++++++++++++++++ policy/modules/services/zabbix.te | 4 ++++ 2 files changed, 25 insertions(+), 0 deletions(-) diff --git a/policy/modules/services/zabbix.if b/policy/modules/services/zabbix.if index 7e37c21..9e8898d 100644 --- a/policy/modules/services/zabbix.if +++ b/policy/modules/services/zabbix.if @@ -79,6 +79,27 @@ interface(`zabbix_read_pid_files',` ######################################## ## <summary> +## Allow connectivity to a zabbix agent +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`zabbix_agent_tcp_connect',` + gen_require(` + type zabbix_agent_t; + ') + + corenet_tcp_recvfrom_labeled($1, zabbix_agent_t) + corenet_tcp_sendrecv_zabbix_agent_port($1) + corenet_tcp_connect_zabbix_agent_port($1) + corenet_sendrecv_zabbix_agent_packets($1) +') + +######################################## +## <summary> ## Allow connectivity to the zabbix server ## </summary> ## <param name="domain"> diff --git a/policy/modules/services/zabbix.te b/policy/modules/services/zabbix.te index a5fc923..ec4fccd 100644 --- a/policy/modules/services/zabbix.te +++ b/policy/modules/services/zabbix.te @@ -58,11 +58,15 @@ files_pid_filetrans(zabbix_t, zabbix_var_run_t, { dir file }) rw_files_pattern(zabbix_t, zabbix_tmpfs_t, zabbix_tmpfs_t) fs_tmpfs_filetrans(zabbix_t, zabbix_tmpfs_t, { dir file }) +sysnet_dns_name_resolve(zabbix_t) + files_read_etc_files(zabbix_t) corenet_tcp_bind_generic_node(zabbix_t) corenet_tcp_bind_zabbix_port(zabbix_t) +zabbix_agent_tcp_connect(zabbix_t) + miscfiles_read_localization(zabbix_t) optional_policy(` -- 1.7.3.4 ^ permalink raw reply related [flat|nested] 18+ messages in thread
* [refpolicy] [PATCH 7/7] Allow zabbix agent to query system state and other monitorable aspects 2011-06-13 8:35 ` [refpolicy] [PATCH 6/7] Allow zabbix server to connect to agent (active monitoring) Sven Vermeulen @ 2011-06-13 8:40 ` Sven Vermeulen 2011-06-15 13:26 ` Christopher J. PeBenito 2011-06-15 16:59 ` Sven Vermeulen 2011-06-13 10:14 ` [refpolicy] [PATCH 6/7] Allow zabbix server to connect to agent (active monitoring) Sven Vermeulen 2011-06-15 16:58 ` Sven Vermeulen 2 siblings, 2 replies; 18+ messages in thread From: Sven Vermeulen @ 2011-06-13 8:40 UTC (permalink / raw) To: refpolicy The zabbix agent is responsible for collecting the system state and other monitorable aspects. This include - information from /proc - read attributes of various files (tamper detection) - connect to the ssh service (check if it is reachable) - get file system information - read login information - ... It should be noted that the agent can do a lot more, depending on the target system (what is being monitored) and the running services. The allowed privileges here will in the future expand more as more templates are checked. Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be> --- policy/modules/services/zabbix.te | 15 +++++++++++++++ 1 files changed, 15 insertions(+), 0 deletions(-) diff --git a/policy/modules/services/zabbix.te b/policy/modules/services/zabbix.te index ec4fccd..939d827 100644 --- a/policy/modules/services/zabbix.te +++ b/policy/modules/services/zabbix.te @@ -104,9 +104,24 @@ rw_files_pattern(zabbix_agent_t, zabbix_tmpfs_t, zabbix_tmpfs_t) fs_tmpfs_filetrans(zabbix_agent_t, zabbix_tmpfs_t, { dir file }) ## kernel layer module calls +kernel_read_all_sysctls(zabbix_agent_t) +kernel_read_system_state(zabbix_agent_t) +corecmd_read_all_executables(zabbix_agent_t) corenet_tcp_bind_generic_node(zabbix_agent_t) corenet_tcp_bind_zabbix_agent_port(zabbix_agent_t) +corenet_tcp_connect_ssh_port(zabbix_agent_t) corenet_tcp_connect_zabbix_port(zabbix_agent_t) +dev_getattr_all_blk_files(zabbix_agent_t) +dev_getattr_all_chr_files(zabbix_agent_t) +domain_search_all_domains_state(zabbix_agent_t) +files_getattr_all_dirs(zabbix_agent_t) +files_getattr_all_files(zabbxi_agent_t) +files_read_all_symlinks(zabbix_agent_t) +files_read_etc_files(zabbix_agent_t) +fs_getattr_all_fs(zabbix_agent_t) ## system layer module calls +init_read_utmp(zabbix_agent_t) +logging_search_logs(zabbix_agent_t) +miscfiles_read_localization(zabbix_agent_t) sysnet_dns_name_resolve(zabbix_agent_t) -- 1.7.3.4 ^ permalink raw reply related [flat|nested] 18+ messages in thread
* [refpolicy] [PATCH 7/7] Allow zabbix agent to query system state and other monitorable aspects 2011-06-13 8:40 ` [refpolicy] [PATCH 7/7] Allow zabbix agent to query system state and other monitorable aspects Sven Vermeulen @ 2011-06-15 13:26 ` Christopher J. PeBenito 2011-06-15 16:59 ` Sven Vermeulen 1 sibling, 0 replies; 18+ messages in thread From: Christopher J. PeBenito @ 2011-06-15 13:26 UTC (permalink / raw) To: refpolicy On 06/13/11 04:40, Sven Vermeulen wrote: > The zabbix agent is responsible for collecting the system state and other > monitorable aspects. This include > - information from /proc > - read attributes of various files (tamper detection) > - connect to the ssh service (check if it is reachable) > - get file system information > - read login information > - ... > > It should be noted that the agent can do a lot more, depending on the target > system (what is being monitored) and the running services. The allowed > privileges here will in the future expand more as more templates are > checked. The style in this patch (and the others adding zabbix_agent_t) needs to be cleaned up. > Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be> > --- > policy/modules/services/zabbix.te | 15 +++++++++++++++ > 1 files changed, 15 insertions(+), 0 deletions(-) > > diff --git a/policy/modules/services/zabbix.te b/policy/modules/services/zabbix.te > index ec4fccd..939d827 100644 > --- a/policy/modules/services/zabbix.te > +++ b/policy/modules/services/zabbix.te > @@ -104,9 +104,24 @@ rw_files_pattern(zabbix_agent_t, zabbix_tmpfs_t, zabbix_tmpfs_t) > fs_tmpfs_filetrans(zabbix_agent_t, zabbix_tmpfs_t, { dir file }) > > ## kernel layer module calls > +kernel_read_all_sysctls(zabbix_agent_t) > +kernel_read_system_state(zabbix_agent_t) > +corecmd_read_all_executables(zabbix_agent_t) > corenet_tcp_bind_generic_node(zabbix_agent_t) > corenet_tcp_bind_zabbix_agent_port(zabbix_agent_t) > +corenet_tcp_connect_ssh_port(zabbix_agent_t) > corenet_tcp_connect_zabbix_port(zabbix_agent_t) > +dev_getattr_all_blk_files(zabbix_agent_t) > +dev_getattr_all_chr_files(zabbix_agent_t) > +domain_search_all_domains_state(zabbix_agent_t) > +files_getattr_all_dirs(zabbix_agent_t) > +files_getattr_all_files(zabbxi_agent_t) > +files_read_all_symlinks(zabbix_agent_t) > +files_read_etc_files(zabbix_agent_t) > +fs_getattr_all_fs(zabbix_agent_t) > > ## system layer module calls > +init_read_utmp(zabbix_agent_t) > +logging_search_logs(zabbix_agent_t) > +miscfiles_read_localization(zabbix_agent_t) > sysnet_dns_name_resolve(zabbix_agent_t) -- Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com ^ permalink raw reply [flat|nested] 18+ messages in thread
* [refpolicy] [PATCH 7/7] Allow zabbix agent to query system state and other monitorable aspects 2011-06-13 8:40 ` [refpolicy] [PATCH 7/7] Allow zabbix agent to query system state and other monitorable aspects Sven Vermeulen 2011-06-15 13:26 ` Christopher J. PeBenito @ 2011-06-15 16:59 ` Sven Vermeulen 1 sibling, 0 replies; 18+ messages in thread From: Sven Vermeulen @ 2011-06-15 16:59 UTC (permalink / raw) To: refpolicy The zabbix agent is responsible for collecting the system state and other monitorable aspects. This include - information from /proc - read attributes of various files (tamper detection) - connect to the ssh service (check if it is reachable) - get file system information - read login information - ... It should be noted that the agent can do a lot more, depending on the target system (what is being monitored) and the running services. The allowed privileges here will in the future expand more as more templates are checked. Update: follow styleguide Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be> --- policy/modules/services/zabbix.te | 38 +++++++++++++++++++++++++++++++++++++ 1 files changed, 38 insertions(+), 0 deletions(-) diff --git a/policy/modules/services/zabbix.te b/policy/modules/services/zabbix.te index da44bfa..df90d73 100644 --- a/policy/modules/services/zabbix.te +++ b/policy/modules/services/zabbix.te @@ -119,8 +119,46 @@ fs_tmpfs_filetrans(zabbix_agent_t, zabbix_tmpfs_t, file) ## Kernel layer module calls +# kernel module +kernel_read_all_sysctls(zabbix_agent_t) +kernel_read_system_state(zabbix_agent_t) + +# corecommands module +corecmd_read_all_executables(zabbix_agent_t) + +# corenetwork module +corenet_tcp_bind_generic_node(zabbix_agent_t) +corenet_tcp_bind_zabbix_agent_port(zabbix_agent_t) +corenet_tcp_connect_ssh_port(zabbix_agent_t) +corenet_tcp_connect_zabbix_port(zabbix_agent_t) + +# devices module +dev_getattr_all_blk_files(zabbix_agent_t) +dev_getattr_all_chr_files(zabbix_agent_t) + +# domain module +domain_search_all_domains_state(zabbix_agent_t) + +# files module +files_getattr_all_dirs(zabbix_agent_t) +files_getattr_all_files(zabbix_agent_t) +files_read_all_symlinks(zabbix_agent_t) +files_read_etc_files(zabbix_agent_t) + +# filesystem module +fs_getattr_all_fs(zabbix_agent_t) + ## System layer module calls +# init module +init_read_utmp(zabbix_agent_t) + +# logging module +logging_search_logs(zabbix_agent_t) + +# miscfiles module +miscfiles_read_localization(zabbix_agent_t) + # sysnetwork module sysnet_dns_name_resolve(zabbix_agent_t) -- 1.7.3.4 ^ permalink raw reply related [flat|nested] 18+ messages in thread
* [refpolicy] [PATCH 6/7] Allow zabbix server to connect to agent (active monitoring) 2011-06-13 8:35 ` [refpolicy] [PATCH 6/7] Allow zabbix server to connect to agent (active monitoring) Sven Vermeulen 2011-06-13 8:40 ` [refpolicy] [PATCH 7/7] Allow zabbix agent to query system state and other monitorable aspects Sven Vermeulen @ 2011-06-13 10:14 ` Sven Vermeulen 2011-06-15 16:58 ` Sven Vermeulen 2 siblings, 0 replies; 18+ messages in thread From: Sven Vermeulen @ 2011-06-13 10:14 UTC (permalink / raw) To: refpolicy On Mon, Jun 13, 2011 at 10:35:53AM +0200, Sven Vermeulen wrote: > The zabbix server also connects to the agents (this is called "active > monitoring" in the zabbix terms). So we create a zabbix_agent_tcp_connect > interface, use it for the zabbix_t domain and, since zabbix can use > hostname-based connections, allow DNS resolving for the zabbix server. Should've copied better. corenet_sendrecv_zabbix_agent_packets doesn't exist, it's corenet_sendrecv_zabbix_agent_client_packets. Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be> --- policy/modules/services/zabbix.if | 21 +++++++++++++++++++++ policy/modules/services/zabbix.te | 4 ++++ 2 files changed, 25 insertions(+), 0 deletions(-) diff --git a/policy/modules/services/zabbix.if b/policy/modules/services/zabbix.if index 7e37c21..9e8898d 100644 --- a/policy/modules/services/zabbix.if +++ b/policy/modules/services/zabbix.if @@ -79,6 +79,27 @@ interface(`zabbix_read_pid_files',` ######################################## ## <summary> +## Allow connectivity to a zabbix agent +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`zabbix_agent_tcp_connect',` + gen_require(` + type zabbix_agent_t; + ') + + corenet_tcp_recvfrom_labeled($1, zabbix_agent_t) + corenet_tcp_sendrecv_zabbix_agent_port($1) + corenet_tcp_connect_zabbix_agent_port($1) + corenet_sendrecv_zabbix_agent_client_packets($1) +') + +######################################## +## <summary> ## Allow connectivity to the zabbix server ## </summary> ## <param name="domain"> diff --git a/policy/modules/services/zabbix.te b/policy/modules/services/zabbix.te index a5fc923..ec4fccd 100644 --- a/policy/modules/services/zabbix.te +++ b/policy/modules/services/zabbix.te @@ -58,11 +58,15 @@ files_pid_filetrans(zabbix_t, zabbix_var_run_t, { dir file }) rw_files_pattern(zabbix_t, zabbix_tmpfs_t, zabbix_tmpfs_t) fs_tmpfs_filetrans(zabbix_t, zabbix_tmpfs_t, { dir file }) +sysnet_dns_name_resolve(zabbix_t) + files_read_etc_files(zabbix_t) corenet_tcp_bind_generic_node(zabbix_t) corenet_tcp_bind_zabbix_port(zabbix_t) +zabbix_agent_tcp_connect(zabbix_t) + miscfiles_read_localization(zabbix_t) optional_policy(` -- 1.7.3.4 ^ permalink raw reply related [flat|nested] 18+ messages in thread
* [refpolicy] [PATCH 6/7] Allow zabbix server to connect to agent (active monitoring) 2011-06-13 8:35 ` [refpolicy] [PATCH 6/7] Allow zabbix server to connect to agent (active monitoring) Sven Vermeulen 2011-06-13 8:40 ` [refpolicy] [PATCH 7/7] Allow zabbix agent to query system state and other monitorable aspects Sven Vermeulen 2011-06-13 10:14 ` [refpolicy] [PATCH 6/7] Allow zabbix server to connect to agent (active monitoring) Sven Vermeulen @ 2011-06-15 16:58 ` Sven Vermeulen 2 siblings, 0 replies; 18+ messages in thread From: Sven Vermeulen @ 2011-06-15 16:58 UTC (permalink / raw) To: refpolicy The zabbix server also connects to the agents (this is called "active monitoring" in the zabbix terms). So we create a zabbix_agent_tcp_connect interface, use it for the zabbix_t domain and, since zabbix can use hostname-based connections, allow DNS resolving for the zabbix server. Update: Follow styleguide Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be> --- policy/modules/services/zabbix.if | 22 ++++++++++++++++++++++ policy/modules/services/zabbix.te | 15 ++++++++++++++- 2 files changed, 36 insertions(+), 1 deletions(-) diff --git a/policy/modules/services/zabbix.if b/policy/modules/services/zabbix.if index e1cc9b5..3aa16ab 100644 --- a/policy/modules/services/zabbix.if +++ b/policy/modules/services/zabbix.if @@ -79,6 +79,28 @@ interface(`zabbix_read_pid_files',` ######################################## ## <summary> +## Allow connectivity to a zabbix agent +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`zabbix_agent_tcp_connect',` + gen_require(` + type zabbix_agent_t; + ') + + corenet_sendrecv_zabbix_agent_packets($1) + corenet_tcp_connect_zabbix_agent_port($1) + corenet_tcp_recvfrom_labeled($1, zabbix_t) + corenet_tcp_sendrecv_zabbix_agent_port($1) +') + + +######################################## +## <summary> ## Allow connectivity to the zabbix server ## </summary> ## <param name="domain"> diff --git a/policy/modules/services/zabbix.te b/policy/modules/services/zabbix.te index f0b241b..da44bfa 100644 --- a/policy/modules/services/zabbix.te +++ b/policy/modules/services/zabbix.te @@ -59,13 +59,26 @@ files_pid_filetrans(zabbix_t, zabbix_var_run_t, { dir file }) rw_files_pattern(zabbix_t, zabbix_tmpfs_t, zabbix_tmpfs_t) fs_tmpfs_filetrans(zabbix_t, zabbix_tmpfs_t, file) -files_read_etc_files(zabbix_t) +# network access to zabbix agent +zabbix_agent_tcp_connect(zabbix_t) + +## Kernel layer module calls +# corenetwork module corenet_tcp_bind_generic_node(zabbix_t) corenet_tcp_bind_zabbix_port(zabbix_t) +# files module +files_read_etc_files(zabbix_t) + +## System layer module calls + +# miscfiles module miscfiles_read_localization(zabbix_t) +# sysnetwork module +sysnet_dns_name_resolve(zabbix_t) + optional_policy(` mysql_stream_connect(zabbix_t) ') -- 1.7.3.4 ^ permalink raw reply related [flat|nested] 18+ messages in thread
* [refpolicy] [PATCH 5/7] Zabbix agent binds on its own port, connects to zabbix server 2011-06-13 8:34 ` [refpolicy] [PATCH 5/7] Zabbix agent binds on its own port, connects to zabbix server Sven Vermeulen 2011-06-13 8:35 ` [refpolicy] [PATCH 6/7] Allow zabbix server to connect to agent (active monitoring) Sven Vermeulen @ 2011-06-13 10:13 ` Sven Vermeulen 2011-06-15 16:57 ` Sven Vermeulen 2 siblings, 0 replies; 18+ messages in thread From: Sven Vermeulen @ 2011-06-13 10:13 UTC (permalink / raw) To: refpolicy On Mon, Jun 13, 2011 at 10:34:12AM +0200, Sven Vermeulen wrote: > The zabbix agent has its own dedicated port (10050) on which it needs to > bind/listen. > > Also, the agent connects to the server so we add the zabbix_tcp_connect > interface (shamelessly copied from mysql_tcp_connect) and use it for the > zabbix_agent_t domain. I should copy better. Old patch referred to corenet_sendrecv_zabbix_packets which doesn't exist, it's corenet_sendrecv_zabbix_client_packets. Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be> --- policy/modules/kernel/corenetwork.te.in | 1 + policy/modules/services/zabbix.if | 21 +++++++++++++++++++++ policy/modules/services/zabbix.te | 6 ++++++ 3 files changed, 28 insertions(+), 0 deletions(-) diff --git a/policy/modules/kernel/corenetwork.te.in b/policy/modules/kernel/corenetwork.te.in index f4937b9..fb5dd13 100644 --- a/policy/modules/kernel/corenetwork.te.in +++ b/policy/modules/kernel/corenetwork.te.in @@ -224,6 +224,7 @@ network_port(xfs, tcp,7100,s0) network_port(xserver, tcp,6000-6020,s0) network_port(zarafa, tcp,236,s0, tcp,237,s0) network_port(zabbix, tcp,10051,s0) +network_port(zabbix_agent, tcp,10050,s0) network_port(zookeeper_client, tcp,2181,s0) network_port(zookeeper_election, tcp,3888,s0) network_port(zookeeper_leader, tcp,2888,s0) diff --git a/policy/modules/services/zabbix.if b/policy/modules/services/zabbix.if index d77e631..7e37c21 100644 --- a/policy/modules/services/zabbix.if +++ b/policy/modules/services/zabbix.if @@ -79,6 +79,27 @@ interface(`zabbix_read_pid_files',` ######################################## ## <summary> +## Allow connectivity to the zabbix server +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`zabbix_tcp_connect',` + gen_require(` + type zabbix_t; + ') + + corenet_tcp_recvfrom_labeled($1, zabbix_t) + corenet_tcp_sendrecv_zabbix_port($1) + corenet_tcp_connect_zabbix_port($1) + corenet_sendrecv_zabbix_client_packets($1) +') + +######################################## +## <summary> ## All of the rules required to administrate ## an zabbix environment ## </summary> diff --git a/policy/modules/services/zabbix.te b/policy/modules/services/zabbix.te index 83bb522..a5fc923 100644 --- a/policy/modules/services/zabbix.te +++ b/policy/modules/services/zabbix.te @@ -93,10 +93,16 @@ manage_files_pattern(zabbix_agent_t, zabbix_log_t, zabbix_log_t) # PID file management manage_files_pattern(zabbix_agent_t, zabbix_var_run_t, zabbix_var_run_t) files_pid_filetrans(zabbix_agent_t, zabbix_var_run_t, file) +# Port access +zabbix_tcp_connect(zabbix_agent_t) # Shared memory rw_files_pattern(zabbix_agent_t, zabbix_tmpfs_t, zabbix_tmpfs_t) fs_tmpfs_filetrans(zabbix_agent_t, zabbix_tmpfs_t, { dir file }) ## kernel layer module calls +corenet_tcp_bind_generic_node(zabbix_agent_t) +corenet_tcp_bind_zabbix_agent_port(zabbix_agent_t) +corenet_tcp_connect_zabbix_port(zabbix_agent_t) ## system layer module calls +sysnet_dns_name_resolve(zabbix_agent_t) -- 1.7.3.4 ^ permalink raw reply related [flat|nested] 18+ messages in thread
* [refpolicy] [PATCH 5/7] Zabbix agent binds on its own port, connects to zabbix server 2011-06-13 8:34 ` [refpolicy] [PATCH 5/7] Zabbix agent binds on its own port, connects to zabbix server Sven Vermeulen 2011-06-13 8:35 ` [refpolicy] [PATCH 6/7] Allow zabbix server to connect to agent (active monitoring) Sven Vermeulen 2011-06-13 10:13 ` [refpolicy] [PATCH 5/7] Zabbix agent binds on its own port, connects to zabbix server Sven Vermeulen @ 2011-06-15 16:57 ` Sven Vermeulen 2 siblings, 0 replies; 18+ messages in thread From: Sven Vermeulen @ 2011-06-15 16:57 UTC (permalink / raw) To: refpolicy The zabbix agent has its own dedicated port (10050) on which it needs to bind/listen. Also, the agent connects to the server so we add the zabbix_tcp_connect interface (shamelessly copied from mysql_tcp_connect) and use it for the zabbix_agent_t domain. Update: structure interface calls more closely to styleguide Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be> --- policy/modules/kernel/corenetwork.te.in | 1 + policy/modules/services/zabbix.if | 21 +++++++++++++++++++++ policy/modules/services/zabbix.te | 7 +++++++ 3 files changed, 29 insertions(+), 0 deletions(-) diff --git a/policy/modules/kernel/corenetwork.te.in b/policy/modules/kernel/corenetwork.te.in index f4937b9..fb5dd13 100644 --- a/policy/modules/kernel/corenetwork.te.in +++ b/policy/modules/kernel/corenetwork.te.in @@ -224,6 +224,7 @@ network_port(xfs, tcp,7100,s0) network_port(xserver, tcp,6000-6020,s0) network_port(zarafa, tcp,236,s0, tcp,237,s0) network_port(zabbix, tcp,10051,s0) +network_port(zabbix_agent, tcp,10050,s0) network_port(zookeeper_client, tcp,2181,s0) network_port(zookeeper_election, tcp,3888,s0) network_port(zookeeper_leader, tcp,2888,s0) diff --git a/policy/modules/services/zabbix.if b/policy/modules/services/zabbix.if index d77e631..e1cc9b5 100644 --- a/policy/modules/services/zabbix.if +++ b/policy/modules/services/zabbix.if @@ -79,6 +79,27 @@ interface(`zabbix_read_pid_files',` ######################################## ## <summary> +## Allow connectivity to the zabbix server +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`zabbix_tcp_connect',` + gen_require(` + type zabbix_t; + ') + + corenet_sendrecv_zabbix_agent_packets($1) + corenet_tcp_connect_zabbix_port($1) + corenet_tcp_recvfrom_labeled($1, zabbix_t) + corenet_tcp_sendrecv_zabbix_port($1) +') + +######################################## +## <summary> ## All of the rules required to administrate ## an zabbix environment ## </summary> diff --git a/policy/modules/services/zabbix.te b/policy/modules/services/zabbix.te index 457aa2f..f0b241b 100644 --- a/policy/modules/services/zabbix.te +++ b/policy/modules/services/zabbix.te @@ -97,6 +97,9 @@ manage_files_pattern(zabbix_agent_t, zabbix_log_t, zabbix_log_t) manage_files_pattern(zabbix_agent_t, zabbix_var_run_t, zabbix_var_run_t) files_pid_filetrans(zabbix_agent_t, zabbix_var_run_t, file) +# Network access to zabbix server +zabbix_tcp_connect(zabbix_agent_t) + # Shared Memory support rw_files_pattern(zabbix_agent_t, zabbix_tmpfs_t, zabbix_tmpfs_t) fs_tmpfs_filetrans(zabbix_agent_t, zabbix_tmpfs_t, file) @@ -104,3 +107,7 @@ fs_tmpfs_filetrans(zabbix_agent_t, zabbix_tmpfs_t, file) ## Kernel layer module calls ## System layer module calls + +# sysnetwork module +sysnet_dns_name_resolve(zabbix_agent_t) + -- 1.7.3.4 ^ permalink raw reply related [flat|nested] 18+ messages in thread
[parent not found: <20110613101151.GB26655@siphos.be>]
* [refpolicy] [PATCH 4/7] Support different domain for zabbix agent (start with skeleton) [not found] ` <20110613101151.GB26655@siphos.be> @ 2011-06-13 10:22 ` Sven Vermeulen 0 siblings, 0 replies; 18+ messages in thread From: Sven Vermeulen @ 2011-06-13 10:22 UTC (permalink / raw) To: refpolicy On Mon, Jun 13, 2011 at 10:31:36AM +0200, Sven Vermeulen wrote: > The zabbix agent should be confined within its own domain. We start with the > definition of a small(er) skeleton to work from. This includes proper file > context definitions, standard interdomain privileges (which are quite > similar to those of the server) and the proper log- and pid access > privileges. Same as with PATCH 2/7: we do not need the dir support in the fs_tmpfs_filetrans here. Update patch to only include file-based transition. Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be> --- policy/modules/services/zabbix.fc | 4 +++- policy/modules/services/zabbix.te | 35 +++++++++++++++++++++++++++++++++++ 2 files changed, 38 insertions(+), 1 deletions(-) diff --git a/policy/modules/services/zabbix.fc b/policy/modules/services/zabbix.fc index 3102286..125529a 100644 --- a/policy/modules/services/zabbix.fc +++ b/policy/modules/services/zabbix.fc @@ -1,6 +1,8 @@ /etc/rc\.d/init\.d/zabbix -- gen_context(system_u:object_r:zabbix_initrc_exec_t,s0) +/etc/rc\.d/init\.d/zabbix-agentd -- gen_context(system_u:object_r:zabbix_agent_initrc_exec_t,s0) -/usr/bin/zabbix_server -- gen_context(system_u:object_r:zabbix_exec_t,s0) +/usr/(s)?bin/zabbix_server -- gen_context(system_u:object_r:zabbix_exec_t,s0) +/usr/(s)?bin/zabbix_agentd -- gen_context(system_u:object_r:zabbix_agent_exec_t,s0) /var/log/zabbix(/.*)? gen_context(system_u:object_r:zabbix_log_t,s0) diff --git a/policy/modules/services/zabbix.te b/policy/modules/services/zabbix.te index 839422c..83bb522 100644 --- a/policy/modules/services/zabbix.te +++ b/policy/modules/services/zabbix.te @@ -9,9 +9,16 @@ type zabbix_t; type zabbix_exec_t; init_daemon_domain(zabbix_t, zabbix_exec_t) +type zabbix_agent_t; +type zabbix_agent_exec_t; +init_daemon_domain(zabbix_agent_t, zabbix_agent_exec_t) + type zabbix_initrc_exec_t; init_script_file(zabbix_initrc_exec_t) +type zabbix_agent_initrc_exec_t; +init_script_file(zabbix_agent_initrc_exec_t) + # log files type zabbix_log_t; logging_log_file(zabbix_log_t) @@ -65,3 +72,31 @@ optional_policy(` optional_policy(` postgresql_stream_connect(zabbix_t) ') + +######################################## +# +# zabbix agent local policy +# + +allow zabbix_agent_t self:capability { setuid setgid }; +allow zabbix_agent_t self:process { setsched getsched signal }; +allow zabbix_agent_t self:fifo_file rw_file_perms; +allow zabbix_agent_t self:unix_stream_socket create_stream_socket_perms; +allow zabbix_agent_t self:sem create_sem_perms; +allow zabbix_agent_t self:tcp_socket create_stream_socket_perms; +allow zabbix_agent_t self:shm create_shm_perms; + +## Rules relating to the objects managed by this policy file +# Logging access +filetrans_pattern(zabbix_agent_t, zabbix_log_t, zabbix_log_t, file) +manage_files_pattern(zabbix_agent_t, zabbix_log_t, zabbix_log_t) +# PID file management +manage_files_pattern(zabbix_agent_t, zabbix_var_run_t, zabbix_var_run_t) +files_pid_filetrans(zabbix_agent_t, zabbix_var_run_t, file) +# Shared memory +rw_files_pattern(zabbix_agent_t, zabbix_tmpfs_t, zabbix_tmpfs_t) +fs_tmpfs_filetrans(zabbix_agent_t, zabbix_tmpfs_t, file) + +## kernel layer module calls + +## system layer module calls -- 1.7.3.4 ^ permalink raw reply related [flat|nested] 18+ messages in thread
* [refpolicy] [PATCH 4/7] Support different domain for zabbix agent (start with skeleton) 2011-06-13 8:31 ` [refpolicy] [PATCH 4/7] Support different domain for zabbix agent (start with skeleton) Sven Vermeulen 2011-06-13 8:34 ` [refpolicy] [PATCH 5/7] Zabbix agent binds on its own port, connects to zabbix server Sven Vermeulen [not found] ` <20110613101151.GB26655@siphos.be> @ 2011-06-15 16:56 ` Sven Vermeulen 2 siblings, 0 replies; 18+ messages in thread From: Sven Vermeulen @ 2011-06-15 16:56 UTC (permalink / raw) To: refpolicy The zabbix agent should be confined within its own domain. We start with the definition of a small(er) skeleton to work from. This includes proper file context definitions, standard interdomain privileges (which are quite similar to those of the server) and the proper log- and pid access privileges. Update: attempt to follow styleguide more closely Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be> --- policy/modules/services/zabbix.fc | 4 ++- policy/modules/services/zabbix.te | 39 +++++++++++++++++++++++++++++++++++++ 2 files changed, 42 insertions(+), 1 deletions(-) diff --git a/policy/modules/services/zabbix.fc b/policy/modules/services/zabbix.fc index 3102286..fb88f70 100644 --- a/policy/modules/services/zabbix.fc +++ b/policy/modules/services/zabbix.fc @@ -1,6 +1,8 @@ /etc/rc\.d/init\.d/zabbix -- gen_context(system_u:object_r:zabbix_initrc_exec_t,s0) +/etc/rc\.d/init\.d/zabbix-agentd -- gen_context(system_u:object_r:zabbix_agent_initrc_exec_t,s0) -/usr/bin/zabbix_server -- gen_context(system_u:object_r:zabbix_exec_t,s0) +/usr/(s)?bin/zabbix_server -- gen_context(system_u:object_r:zabbix_exec_t,s0) +/usr/(s)?bin/zabbix_agentd -- gen_context(system_u:object_r:zabbix_agent_t,s0) /var/log/zabbix(/.*)? gen_context(system_u:object_r:zabbix_log_t,s0) diff --git a/policy/modules/services/zabbix.te b/policy/modules/services/zabbix.te index 163f581..457aa2f 100644 --- a/policy/modules/services/zabbix.te +++ b/policy/modules/services/zabbix.te @@ -12,6 +12,14 @@ init_daemon_domain(zabbix_t, zabbix_exec_t) type zabbix_initrc_exec_t; init_script_file(zabbix_initrc_exec_t) +# agent definition +type zabbix_agent_t; +type zabbix_agent_exec_t; +init_daemon_domain(zabbix_agent_t, zabbix_agent_exec_t) + +type zabbix_agent_initrc_exec_t; +init_script_file(zabbix_agent_initrc_exec_t) + # log files type zabbix_log_t; logging_log_file(zabbix_log_t) @@ -65,3 +73,34 @@ optional_policy(` optional_policy(` postgresql_stream_connect(zabbix_t) ') + +######################################## +# +# zabbix agent local policy +# + +allow zabbix_agent_t self:capability { setuid setgid }; +allow zabbix_agent_t self:process { setsched getsched signal }; +allow zabbix_agent_t self:fifo_file rw_file_perms; +allow zabbix_agent_t self:sem create_sem_perms; +allow zabbix_agent_t self:shm create_shm_perms; +allow zabbix_agent_t self:tcp_socket create_stream_socket_perms; +allow zabbix_agent_t self:unix_stream_socket create_stream_socket_perms; + +## Rules related to the types managed by this policy file + +# Logging access +filetrans_pattern(zabbix_agent_t, zabbix_log_t, zabbix_log_t, file) +manage_files_pattern(zabbix_agent_t, zabbix_log_t, zabbix_log_t) + +# PID file management +manage_files_pattern(zabbix_agent_t, zabbix_var_run_t, zabbix_var_run_t) +files_pid_filetrans(zabbix_agent_t, zabbix_var_run_t, file) + +# Shared Memory support +rw_files_pattern(zabbix_agent_t, zabbix_tmpfs_t, zabbix_tmpfs_t) +fs_tmpfs_filetrans(zabbix_agent_t, zabbix_tmpfs_t, file) + +## Kernel layer module calls + +## System layer module calls -- 1.7.3.4 ^ permalink raw reply related [flat|nested] 18+ messages in thread
* [refpolicy] [PATCH 2/7] Support shared memory 2011-06-13 8:28 ` [refpolicy] [PATCH 2/7] Support shared memory Sven Vermeulen 2011-06-13 8:29 ` [refpolicy] [PATCH 3/7] Define zabbix port and allow server to listen/bind on it Sven Vermeulen @ 2011-06-13 10:10 ` Sven Vermeulen 1 sibling, 0 replies; 18+ messages in thread From: Sven Vermeulen @ 2011-06-13 10:10 UTC (permalink / raw) To: refpolicy On Mon, Jun 13, 2011 at 10:28:15AM +0200, Sven Vermeulen wrote: > Zabbix servers use shared memory to keep common information and structures. > This is implemented on tmpfs. We support this by introducing a > zabbix_tmpfs_t type and allow the server proper access to it. After a small discussion and a few more tests, drop the "dir" in fs_tmpfs_filetrans. For posterity's sake, this is the denial one gets when no tmpfs_t related privileges are given: Jun 13 11:24:06 build kernel: [ 213.054230] type=1400 audit(1307957046.001:106): avc: denied { read write } for pid=3162 comm="zabbix_agentd" path=2F535953563663303132323534202864656C6574656429 dev=tmpfs ino=32768 scontext=system_u:system_r:zabbix_agent_t tcontext=system_u:object_r:tmpfs_t tclass=file With fs_tmpfs_filetrans(..., file) the same denial is given, but as tcontext=zabbix_tmpfs_t. Hence the rw_files_pattern() enhancement. Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be> --- policy/modules/services/zabbix.te | 9 +++++++++ 1 files changed, 9 insertions(+), 0 deletions(-) diff --git a/policy/modules/services/zabbix.te b/policy/modules/services/zabbix.te index 3dd76ca..bec98e9 100644 --- a/policy/modules/services/zabbix.te +++ b/policy/modules/services/zabbix.te @@ -16,6 +16,10 @@ init_script_file(zabbix_initrc_exec_t) type zabbix_log_t; logging_log_file(zabbix_log_t) +# shared memory +type zabbix_tmpfs_t; +files_tmpfs_file(zabbix_tmpfs_t); + # pid files type zabbix_var_run_t; files_pid_file(zabbix_var_run_t) @@ -30,6 +34,7 @@ allow zabbix_t self:fifo_file rw_file_perms; allow zabbix_t self:process { setsched getsched signal }; allow zabbix_t self:unix_stream_socket create_stream_socket_perms; allow zabbix_t self:sem create_sem_perms; +allow zabbix_t self:shm create_shm_perms; # log files allow zabbix_t zabbix_log_t:dir setattr; @@ -41,6 +46,10 @@ manage_dirs_pattern(zabbix_t, zabbix_var_run_t, zabbix_var_run_t) manage_files_pattern(zabbix_t, zabbix_var_run_t, zabbix_var_run_t) files_pid_filetrans(zabbix_t, zabbix_var_run_t, { dir file }) +# shared memory +rw_files_pattern(zabbix_t, zabbix_tmpfs_t, zabbix_tmpfs_t) +fs_tmpfs_filetrans(zabbix_t, zabbix_tmpfs_t, file) + files_read_etc_files(zabbix_t) miscfiles_read_localization(zabbix_t) -- 1.7.3.4 ^ permalink raw reply related [flat|nested] 18+ messages in thread
* [refpolicy] [PATCH 0/7] Updates on zabbix service 2011-06-13 8:20 [refpolicy] [PATCH 0/7] Updates on zabbix service Sven Vermeulen 2011-06-13 8:25 ` [refpolicy] [PATCH 1/7] zabbix server spawns multiple processes Sven Vermeulen @ 2011-06-15 18:20 ` Christopher J. PeBenito 1 sibling, 0 replies; 18+ messages in thread From: Christopher J. PeBenito @ 2011-06-15 18:20 UTC (permalink / raw) To: refpolicy On 06/13/11 04:20, Sven Vermeulen wrote: > Zabbix is an open-source/free software monitoring solution. A module already > exists in the refpolicy, but does not work properly. Also, the module does > not support a different domain for the agents (zabbix agents) although this > is greatly preferred. > > The following set of patches introduce the following to this module set: > > 1. Zabbix server is a multi-process system requiring signals to be sent and > (exclusive) locks to be taken where needed (for instance used with > logging) > 2. Zabbix servers use posix shared memory (using tmpfs backend), so create a > zabbix_tmpfs_t domain and allow the server access to manage it > 3. Zabbix uses a dedicated port (10051) for its server. Allow the servers to > bind to it, and of course define it as a specific port in SELinux > 4. Start with the definition of the zabbix_agent_t domain > 5. Allow zabbix_agent to bind on its own port (10050) and connect to the > zabbix server (for the regular metric submissions) > 6. The zabbix server also needs to connect to the agent (for what Zabbix > calls "active monitoring") > 7. Give zabbix_agent_t the privileges it needs to scan the system (get > system state, read files, check services, ...) Merged. In the future, when you revise a patch set, please resend the entire set. Then I know for sure I have all of the up-to-date patches, rather than digging through the replies for the right patch. -- Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com ^ permalink raw reply [flat|nested] 18+ messages in thread
end of thread, other threads:[~2011-06-15 18:20 UTC | newest]
Thread overview: 18+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2011-06-13 8:20 [refpolicy] [PATCH 0/7] Updates on zabbix service Sven Vermeulen
2011-06-13 8:25 ` [refpolicy] [PATCH 1/7] zabbix server spawns multiple processes Sven Vermeulen
2011-06-13 8:28 ` [refpolicy] [PATCH 2/7] Support shared memory Sven Vermeulen
2011-06-13 8:29 ` [refpolicy] [PATCH 3/7] Define zabbix port and allow server to listen/bind on it Sven Vermeulen
2011-06-13 8:31 ` [refpolicy] [PATCH 4/7] Support different domain for zabbix agent (start with skeleton) Sven Vermeulen
2011-06-13 8:34 ` [refpolicy] [PATCH 5/7] Zabbix agent binds on its own port, connects to zabbix server Sven Vermeulen
2011-06-13 8:35 ` [refpolicy] [PATCH 6/7] Allow zabbix server to connect to agent (active monitoring) Sven Vermeulen
2011-06-13 8:40 ` [refpolicy] [PATCH 7/7] Allow zabbix agent to query system state and other monitorable aspects Sven Vermeulen
2011-06-15 13:26 ` Christopher J. PeBenito
2011-06-15 16:59 ` Sven Vermeulen
2011-06-13 10:14 ` [refpolicy] [PATCH 6/7] Allow zabbix server to connect to agent (active monitoring) Sven Vermeulen
2011-06-15 16:58 ` Sven Vermeulen
2011-06-13 10:13 ` [refpolicy] [PATCH 5/7] Zabbix agent binds on its own port, connects to zabbix server Sven Vermeulen
2011-06-15 16:57 ` Sven Vermeulen
[not found] ` <20110613101151.GB26655@siphos.be>
2011-06-13 10:22 ` [refpolicy] [PATCH 4/7] Support different domain for zabbix agent (start with skeleton) Sven Vermeulen
2011-06-15 16:56 ` Sven Vermeulen
2011-06-13 10:10 ` [refpolicy] [PATCH 2/7] Support shared memory Sven Vermeulen
2011-06-15 18:20 ` [refpolicy] [PATCH 0/7] Updates on zabbix service Christopher J. PeBenito
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.