Fix SELinux policy for proxy

tags/zabbix-3.4.4-4
Daniel Berteaud 7 years ago
parent fe8b17a1c5
commit e0e3e67f2b
  1. 7
      zabbix-proxy.te

@ -1,4 +1,4 @@
module zabbix-proxy 1.1; module zabbix-proxy 1.2;
require { require {
type var_lib_t; type var_lib_t;
@ -6,12 +6,15 @@ require {
type initrc_t; type initrc_t;
type unlabeled_t; type unlabeled_t;
type zabbix_t; type zabbix_t;
type zabbix_var_run_t;
class file { read getattr }; class file { read getattr };
class sem { unix_read unix_write associate destroy }; class sem { unix_read unix_write associate destroy };
class shm { unix_read unix_write associate destroy }; class shm { unix_read unix_write associate destroy };
class tcp_socket { create getattr accept shutdown read }; class tcp_socket { create getattr accept shutdown read };
class sock_file { create write };
class netlink_route_socket { create bind }; class netlink_route_socket { create bind };
class process setrlimit; class process setrlimit;
class unix_stream_socket connectto;
} }
#============= ping_t ============== #============= ping_t ==============
@ -21,3 +24,5 @@ allow initrc_t unlabeled_t:shm { unix_read unix_write associate destroy };
allow unlabeled_t self:tcp_socket { create getattr accept shutdown read }; allow unlabeled_t self:tcp_socket { create getattr accept shutdown read };
allow unlabeled_t self:netlink_route_socket { create bind }; allow unlabeled_t self:netlink_route_socket { create bind };
allow zabbix_t self:process setrlimit; allow zabbix_t self:process setrlimit;
allow zabbix_t zabbix_var_run_t:sock_file create;
allow zabbix_t self:unix_stream_socket connectto;

Loading…
Cancel
Save