parent
282a4abffb
commit
a3ecef0f9e
2 changed files with 52 additions and 2 deletions
@ -0,0 +1,27 @@ |
|||||||
|
module zabbix-agent-addons 1.0; |
||||||
|
|
||||||
|
require { |
||||||
|
type kernel_t; |
||||||
|
type devlog_t; |
||||||
|
type zabbix_var_lib_t; |
||||||
|
type sudo_exec_t; |
||||||
|
type proc_mdstat_t; |
||||||
|
type zabbix_agent_t; |
||||||
|
class process setrlimit; |
||||||
|
class capability { audit_write dac_override sys_resource }; |
||||||
|
class file { execute execute_no_trans getattr ioctl open read }; |
||||||
|
class netlink_audit_socket { create nlmsg_relay }; |
||||||
|
class sock_file write; |
||||||
|
class unix_dgram_socket { connect create sendto }; |
||||||
|
} |
||||||
|
|
||||||
|
#============= zabbix_agent_t ============== |
||||||
|
allow zabbix_agent_t devlog_t:sock_file write; |
||||||
|
allow zabbix_agent_t kernel_t:unix_dgram_socket sendto; |
||||||
|
allow zabbix_agent_t proc_mdstat_t:file { getattr ioctl open read }; |
||||||
|
allow zabbix_agent_t self:capability { audit_write dac_override sys_resource }; |
||||||
|
allow zabbix_agent_t self:netlink_audit_socket { create nlmsg_relay }; |
||||||
|
allow zabbix_agent_t self:process setrlimit; |
||||||
|
allow zabbix_agent_t self:unix_dgram_socket { connect create }; |
||||||
|
allow zabbix_agent_t sudo_exec_t:file { execute execute_no_trans }; |
||||||
|
allow zabbix_agent_t zabbix_var_lib_t:file { execute execute_no_trans ioctl open read }; |
Loading…
Reference in new issue