forked from georou/prometheus-selinux
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathprometheusd.te
158 lines (114 loc) · 5.5 KB
/
prometheusd.te
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
policy_module(prometheusd, 1.0.1)
########################################
#
# Declarations
#
#permissive prometheusd_t;
#attribute prometheusd_exporter_domain;
#attribute prometheusd_domain;
## <desc>
## <p>
## Allow node exporter to use the wifi collector which requires a kernel module to load
## </p>
## </desc>
gen_tunable(node_exporter_can_load_wifi_module, false)
type prometheusd_t;
type prometheusd_exec_t;
init_daemon_domain(prometheusd_t, prometheusd_exec_t)
role system_r types prometheusd_t;
type prometheusd_conf_t;
files_config_file(prometheusd_conf_t)
type prometheusd_db_t;
files_type(prometheusd_db_t)
type prometheusd_unit_t;
systemd_unit_file(prometheusd_unit_t)
type prometheusd_port_t;
corenet_port(prometheusd_port_t)
prometheusd_exporter_template(node)
prometheusd_module_template(alertmanager)
# node_exporter
type node_prometheusd_exporter_unit_t;
systemd_unit_file(node_prometheusd_exporter_unit_t)
type node_prometheusd_exporter_port_t;
corenet_port(node_prometheusd_exporter_port_t)
# alertmanager
type alertmanager_prometheusd_unit_t;
systemd_unit_file(alertmanager_prometheusd_unit_t)
type alertmanager_prometheusd_port_t;
corenet_port(alertmanager_prometheusd_port_t)
########################################
#
# prometheusd local policy
#
allow prometheusd_t self:tcp_socket create_stream_socket_perms;
allow prometheusd_t self:udp_socket create_stream_socket_perms;
allow prometheusd_t alertmanager_prometheusd_port_t:tcp_socket name_connect;
allow prometheusd_t node_prometheusd_exporter_port_t:tcp_socket name_connect;
allow prometheusd_t prometheusd_port_t:tcp_socket name_connect;
manage_dirs_pattern(prometheusd_t, prometheusd_conf_t, prometheusd_conf_t)
manage_files_pattern(prometheusd_t, prometheusd_conf_t, prometheusd_conf_t)
manage_dirs_pattern(prometheusd_t, prometheusd_db_t, prometheusd_db_t)
manage_files_pattern(prometheusd_t, prometheusd_db_t, prometheusd_db_t)
files_usr_filetrans(prometheusd_t, prometheusd_db_t, dir, "data")
kernel_read_net_sysctls(prometheusd_t)
kernel_read_system_state(prometheusd_t)
corenet_tcp_bind_generic_node(prometheusd_t)
corenet_tcp_bind_websm_port(prometheusd_t)
corenet_tcp_connect_hplip_port(prometheusd_t)
corenet_tcp_connect_websm_port(prometheusd_t)
sysnet_read_config(prometheusd_t)
###################################
#
# node exporter local policy
#
allow node_prometheusd_exporter_t self:tcp_socket create_stream_socket_perms;
allow node_prometheusd_exporter_t self:udp_socket create_stream_socket_perms;
allow node_prometheusd_exporter_t self:netlink_route_socket create_netlink_socket_perms;
allow node_prometheusd_exporter_t self:netlink_socket create_socket_perms;
kernel_read_fs_sysctls(node_prometheusd_exporter_t)
kernel_read_net_sysctls(node_prometheusd_exporter_t)
kernel_read_network_state(node_prometheusd_exporter_t)
kernel_read_software_raid_state(node_prometheusd_exporter_t)
kernel_read_system_state(node_prometheusd_exporter_t)
corenet_tcp_bind_generic_node(node_prometheusd_exporter_t)
corenet_tcp_bind_hplip_port(node_prometheusd_exporter_t)
# Used for supervisor and gmond. Uncomment if you need to use them
#corenet_tcp_connect_tor_port(node_prometheusd_exporter_t) # 9001/tcp node_exporter --collector=supervisord
#corenet_tcp_connect_unreserved_ports(node_prometheusd_exporter_t) # 8649/tcp node_exporter --collector=gmond MARKED AS DEPRECATED !!
dbus_send_system_bus(node_prometheusd_exporter_t)
dbus_system_bus_client(node_prometheusd_exporter_t)
dev_read_sysfs(node_prometheusd_exporter_t)
fs_getattr_rpc_pipefs(node_prometheusd_exporter_t)
fs_getattr_tmpfs(node_prometheusd_exporter_t)
fs_getattr_xattr_fs(node_prometheusd_exporter_t)
init_dbus_chat(node_prometheusd_exporter_t)
init_read_state(node_prometheusd_exporter_t)
init_status(node_prometheusd_exporter_t)
rpc_search_nfs_state_data(node_prometheusd_exporter_t)
systemd_dbus_chat_logind(node_prometheusd_exporter_t)
sysnet_read_config(node_prometheusd_exporter_t)
userdom_search_user_tmp_dirs(node_prometheusd_exporter_t)
tunable_policy(`node_exporter_can_load_wifi_module',`
kernel_request_load_module(node_prometheusd_exporter_t) # Loads module net-pf-16-proto-16-family-nl80211. Probably used with --collector=wifi
')
###################################
#
# alertmanager local policy
#
allow alertmanager_prometheusd_t self:tcp_socket create_stream_socket_perms;
allow alertmanager_prometheusd_t self:udp_socket create_stream_socket_perms;
allow alertmanager_prometheusd_t self:netlink_route_socket create_netlink_socket_perms;
allow alertmanager_prometheusd_t alertmanager_prometheusd_port_t:tcp_socket name_bind;
manage_dirs_pattern(alertmanager_prometheusd_t, alertmanager_prometheusd_conf_t, alertmanager_prometheusd_conf_t)
manage_files_pattern(alertmanager_prometheusd_t, alertmanager_prometheusd_conf_t, alertmanager_prometheusd_conf_t)
manage_dirs_pattern(alertmanager_prometheusd_t, alertmanager_prometheusd_data_t, alertmanager_prometheusd_data_t)
manage_files_pattern(alertmanager_prometheusd_t, alertmanager_prometheusd_data_t, alertmanager_prometheusd_data_t)
files_usr_filetrans(alertmanager_prometheusd_t, alertmanager_prometheusd_data_t, dir, "data")
kernel_read_net_sysctls(alertmanager_prometheusd_t)
kernel_read_system_state(alertmanager_prometheusd_t)
kernel_search_network_sysctl(alertmanager_prometheusd_t)
corenet_tcp_bind_cyphesis_port(alertmanager_prometheusd_t)
corenet_tcp_bind_generic_node(alertmanager_prometheusd_t)
corenet_tcp_connect_smtp_port(alertmanager_prometheusd_t)
sysnet_read_config(alertmanager_prometheusd_t)
miscfiles_read_generic_certs(alertmanager_prometheusd_t)