Nagios NRPE client should be able to read its own configuration file
PATCH 1/1 Nagios NRPE client should be able to read its own configuration file
Currently, the nagios nrpe_t definition has no read access to its own nrpe_etc_t. I suspect this to be a copy/paste problem. Since the nrpe configuration file is stored in /etc/nagios (nagios_etc_t), NRPE does need search privileges in nagios_etc_t. This is easily accomplished through read_files_pattern.
--- policy/modules/services/nagios.te | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)
policy/modules/services/nagios.te +1 -1
@@ -187,7 +187,7 @@ allow nrpe_t self:tcp_socket create_stream_socket_perms; domtrans_pattern(nrpe_t, nagios_checkdisk_plugin_exec_t, nagios_checkdisk_plugin_t) -read_files_pattern(nrpe_t, nagios_etc_t, nagios_etc_t) +read_files_pattern(nrpe_t, nagios_etc_t, nrpe_etc_t) files_search_etc(nrpe_t) manage_files_pattern(nrpe_t, nrpe_var_run_t, nrpe_var_run_t)
Signature · 1 line
1.7.3.4
PATCH 1/1 Nagios NRPE client should be able to read its own configuration file
Quoted 5 lines · Sven Vermeulen
Currently, the nagios
nrpe_tdefinition has no read access to its ownnrpe_etc_t. I suspect this to be a copy/paste problem. Since the nrpe configuration file is stored in/etc/nagios(nagios_etc_t), NRPE does need search privileges innagios_etc_t. This is easily accomplished throughread_files_pattern.
Merged.
Quoted 18 lines
Signed-off-by Sven Vermeulen<[email protected]>--- policy/modules/services/nagios.te | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)policy/modules/services/nagios.te +1
-1@@ -187,7 +187,7 @@ allow nrpe_t self:tcp_socket create_stream_socket_perms; domtrans_pattern(nrpe_t, nagios_checkdisk_plugin_exec_t, nagios_checkdisk_plugin_t) -read_files_pattern(nrpe_t, nagios_etc_t, nagios_etc_t) +read_files_pattern(nrpe_t, nagios_etc_t, nrpe_etc_t) files_search_etc(nrpe_t) manage_files_pattern(nrpe_t, nrpe_var_run_t, nrpe_var_run_t)
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com