zabbix/zabbix-proxy.te

module zabbix-proxy 1.1;

require {
        type var_lib_t;
        type ping_t;
        type initrc_t;
        type unlabeled_t;
        type zabbix_t;
        class file { read getattr };
        class sem { unix_read unix_write associate destroy };
        class shm { unix_read unix_write associate destroy };
        class tcp_socket { create getattr accept shutdown read };
        class netlink_route_socket { create bind };
        class process setrlimit;
}

#============= ping_t ==============
allow ping_t var_lib_t:file { read getattr };
allow initrc_t unlabeled_t:sem { unix_read unix_write associate destroy };
allow initrc_t unlabeled_t:shm { unix_read unix_write associate destroy };
allow unlabeled_t self:tcp_socket { create getattr accept shutdown read };
allow unlabeled_t self:netlink_route_socket { create bind };
allow zabbix_t self:process setrlimit;