policy_module(centreon-monitoring-agent, @VERSION@)

########################################
#
# Declarations
#
require {
	type centreon_agent_t;
	type centreon_etc_t;
	type unconfined_t;
	type unconfined_service_t;
	type setroubleshootd_t;
	type init_t;
	type kernel_t;
	type fs_t;
	type bin_t;
	type tmp_t;
	type node_t;
	type httpd_t;
	type ld_so_cache_t;
	type ldconfig_exec_t;
	type sysfs_t;
	type sysctl_net_t;
	type var_log_t;
	type var_lib_t;
	type cert_t;
	type nagios_unconfined_plugin_exec_t;
	type snmpd_var_lib_t;
	type mysqld_db_t;
	type ssh_exec_t;
	type ssh_home_t;
	type setfiles_t;
	type unconfined_domain_type;
}

type centreon_agent_t;
type centreon_agent_exec_t;
init_daemon_domain(centreon_agent_t, centreon_agent_exec_t)

########################################
#
# Centreon local policy
#

allow centreon_agent_t self:process { setpgid signal_perms execmem };
allow centreon_agent_t self:fifo_file { read open getattr ioctl write rw_fifo_file_perms };
allow centreon_agent_t self:tcp_socket { create accept listen bind setopt getopt getattr shutdown };
allow centreon_agent_t self:udp_socket { create accept listen bind setopt getopt getattr };
allow centreon_agent_t self:file { create read open write getattr read_file_perms relabelto unlink rename };
allow centreon_agent_t self:dir { add_name write remove_name };
allow centreon_agent_t self:capability { setuid net_raw };
allow centreon_agent_t self:rawip_socket { create read write setopt };
allow centreon_agent_t fs_t:filesystem associate;
allow centreon_agent_t ld_so_cache_t:file execute;
allow centreon_agent_t bin_t:file { execute execute_no_trans };
allow centreon_agent_t sysfs_t:dir read;
allow centreon_agent_t sysctl_net_t:dir search;
allow centreon_agent_t sysctl_net_t:file { open read getattr };
allow centreon_agent_t cert_t:dir search;
allow centreon_agent_t node_t:tcp_socket node_bind;
allow centreon_agent_t nagios_unconfined_plugin_exec_t:file { open read execute execute_no_trans };
allow centreon_agent_t var_log_t:dir { write add_name remove_name };
allow centreon_agent_t var_log_t:file { create open write read setattr unlink };
allow centreon_agent_t snmpd_var_lib_t:dir { open read getattr search };
allow centreon_agent_t snmpd_var_lib_t:file { open read getattr };
allow centreon_agent_t centreon_agent_t:dir search;
allow centreon_agent_t centreon_agent_t:fifo_file { open read getattr ioctl };
allow centreon_agent_t ldconfig_exec_t:file { open execute getattr ioctl read};
allow centreon_agent_t tmp_t:dir { add_name search getattr setattr write unlink create open read remove_name rmdir };
allow centreon_agent_t tmp_t:file { getattr setattr write unlink create open read };
allow centreon_agent_t centreon_etc_t:dir { add_name search getattr setattr write unlink create open read remove_name rmdir };
allow centreon_agent_t ssh_exec_t:file { create read open write getattr setattr read_file_perms relabelto unlink rename ioctl };
allow centreon_agent_t ssh_home_t:dir { add_name search getattr setattr write unlink create open read remove_name rmdir };
allow centreon_agent_t ssh_home_t:file { create read open write getattr setattr read_file_perms relabelto unlink rename ioctl };

#============= setroubleshootd_t ==============
allow setroubleshootd_t centreon_agent_t:file getattr;
allow setroubleshootd_t centreon_agent_t:dir { search getattr };
allow setroubleshootd_t centreon_agent_t:fifo_file getattr;

#============= unconfined_t ==============
allow unconfined_t centreon_agent_t:dir { getattr setattr search relabelto relabelfrom create write add_name };
allow unconfined_t centreon_agent_t:file { create read open write getattr setattr read_file_perms relabelto unlink rename ioctl };
allow unconfined_t centreon_agent_t:fifo_file { read open getattr ioctl write setattr };

#============= unconfined_service_t ==============
allow unconfined_service_t centreon_agent_t:fifo_file { open read write getattr ioctl };
allow unconfined_service_t centreon_agent_t:dir { getattr setattr search relabelto relabelfrom create write add_name remove_name };
allow unconfined_service_t centreon_agent_t:file { create read open write getattr setattr read_file_perms relabelto unlink rename ioctl };

#============= httpd_t ==============
allow httpd_t centreon_agent_t:dir { search getattr };
allow httpd_t centreon_agent_t:fifo_file { open read write getattr };
allow httpd_t centreon_agent_t:file { execute execute_no_trans map open read getattr setattr };
allow httpd_t centreon_agent_exec_t:file { execute execute_no_trans map open read getattr setattr };

#============= setfiles_t ==============
allow setfiles_t centreon_agent_t:dir relabelto;
allow setfiles_t centreon_agent_t:fifo_file relabelto;
allow setfiles_t centreon_agent_t:file relabelto;

#============= init_t ==============
allow init_t centreon_agent_t:dir { add_name open read remove_name write search };
allow init_t centreon_agent_t:fifo_file { create open read write getattr unlink };
allow init_t centreon_agent_t:file { create execute execute_no_trans getattr map open read unlink write rename };

#============= kernel_t ==============
allow kernel_t centreon_agent_t:dir { add_name open read remove_name write search };
allow kernel_t centreon_agent_t:fifo_file { create open read write getattr unlink };
allow kernel_t centreon_agent_t:file { create execute execute_no_trans getattr map open read unlink write rename };

#============= cluster ===============
allow daemon initrc_transition_domain:fifo_file { ioctl read write getattr lock append };                                        
allow centreon_agent_t domain:lnk_file { read getattr }; 
allow centreon_agent_t domain:dir { ioctl read getattr lock search open }; 
allow domain unconfined_domain_type:association recvfrom; 
allow domain domain:key { search link }; 
allow domain unconfined_domain_type:tcp_socket recvfrom; 
allow centreon_agent_t domain:file { ioctl read getattr lock open }; 
allow daemon initrc_domain:fd use; 
allow daemon initrc_domain:process sigchld; 
allow domain unconfined_domain_type:peer recv; 
allow daemon initrc_transition_domain:fd use; 
allow daemon initrc_domain:fifo_file { ioctl read write getattr lock append }; 

kernel_read_kernel_sysctls(centreon_agent_t)
kernel_read_net_sysctls(centreon_agent_t)
kernel_read_network_state(centreon_agent_t)
kernel_read_system_state(centreon_agent_t)
kernel_request_load_module(centreon_agent_t)

corecmd_exec_bin(centreon_agent_t)
corecmd_exec_shell(centreon_agent_t)

corenet_port(centreon_agent_t)
corenet_all_recvfrom_unlabeled(centreon_agent_t)
corenet_all_recvfrom_netlabel(centreon_agent_t)
corenet_tcp_sendrecv_generic_if(centreon_agent_t)
corenet_udp_sendrecv_generic_if(centreon_agent_t)
corenet_tcp_sendrecv_generic_node(centreon_agent_t)
corenet_udp_sendrecv_generic_node(centreon_agent_t)
corenet_tcp_bind_generic_node(centreon_agent_t)
corenet_udp_bind_generic_node(centreon_agent_t)
corenet_sendrecv_all_client_packets(centreon_agent_t)
corenet_tcp_connect_all_ports(centreon_agent_t)
corenet_tcp_sendrecv_all_ports(centreon_agent_t)

corenet_sendrecv_inetd_child_server_packets(centreon_agent_t)
corenet_tcp_bind_inetd_child_port(centreon_agent_t)
corenet_tcp_sendrecv_inetd_child_port(centreon_agent_t)

dev_read_sysfs(centreon_agent_t)
dev_read_urand(centreon_agent_t)

domain_use_interactive_fds(centreon_agent_t)
domain_read_all_domains_state(centreon_agent_t)

files_read_etc_runtime_files(centreon_agent_t)
files_read_usr_files(centreon_agent_t)

fs_getattr_all_fs(centreon_agent_t)
fs_search_auto_mountpoints(centreon_agent_t)

auth_use_nsswitch(centreon_agent_t)

logging_send_syslog_msg(centreon_agent_t)

miscfiles_read_localization(centreon_agent_t)

userdom_dontaudit_use_unpriv_user_fds(centreon_agent_t)
