# Joe Presbrey
# presbrey@mit.edu
# 2006/1/15

policy_module(nrpe,1.0.0)

require {
	type nrpe_t, nrpe_exec_t;
        type inaddr_any_node_t;
        type inetd_child_port_t;
        type initrc_var_run_t;
        type nrpe_t;
        type port_t;
        type var_run_t;
};

########################################
#
# nrpe local policy

files_read_etc_files(nrpe_t)
files_rw_etc_runtime_files(nrpe_t)
libs_use_ld_so(nrpe_t)
libs_use_shared_libs(nrpe_t)
miscfiles_read_localization(nrpe_t)

sysnet_dns_name_resolve(nrpe_t)
corenet_tcp_sendrecv_all_nodes(nrpe_t)
corenet_udp_sendrecv_all_nodes(nrpe_t)

nagios_read_config(nrpe_t)
files_rw_generic_pids(nrpe_t)
allow nrpe_t self:capability { setgid setuid };
allow nrpe_t self:tcp_socket { accept bind create listen setopt };

require {
	attribute domain;
	attribute file_type;
	attribute filesystem_type;
};

domain_read_all_domains_state(nrpe_t)
dontaudit nrpe_t domain:dir getattr;
dontaudit nrpe_t file_type:dir all_dir_perms;
dontaudit nrpe_t file_type:file all_file_perms;
files_getattr_all_dirs(nrpe_t)
files_getattr_all_files(nrpe_t)
fs_getattr_all_fs(nrpe_t)
fs_get_xattr_fs_quotas(nrpe_t)

allow nrpe_t inaddr_any_node_t:tcp_socket node_bind;
allow nrpe_t inetd_child_port_t:tcp_socket name_bind;
allow nrpe_t initrc_var_run_t:file { lock read };
allow nrpe_t port_t:tcp_socket { recv_msg send_msg };
allow nrpe_t var_run_t:dir { add_name write };
allow nrpe_t var_run_t:file create;
