From 72f79922ae7cbbed64c9926ad27d4334e1bf8439 Mon Sep 17 00:00:00 2001
From: Ralph Bean <rbean@redhat.com>
Date: Fri, 18 Jul 2014 19:38:00 +0000
Subject: [PATCH] Add selinux module for collectd.

---
 .../collectd/base/files/selinux/fi-collectd.mod | Bin 0 -> 1425 bytes
 .../collectd/base/files/selinux/fi-collectd.pp  | Bin 0 -> 1441 bytes
 .../collectd/base/files/selinux/fi-collectd.te  |  16 ++++++++++++++++
 roles/collectd/base/tasks/main.yml              |  14 ++++++++++++++
 4 files changed, 30 insertions(+)
 create mode 100644 roles/collectd/base/files/selinux/fi-collectd.mod
 create mode 100644 roles/collectd/base/files/selinux/fi-collectd.pp
 create mode 100644 roles/collectd/base/files/selinux/fi-collectd.te

diff --git a/roles/collectd/base/files/selinux/fi-collectd.mod b/roles/collectd/base/files/selinux/fi-collectd.mod
new file mode 100644
index 0000000000000000000000000000000000000000..a5bf03c63894b634821e834097f7af2b73b980f5
GIT binary patch
literal 1425
zcmb_cT}s3-5FUR}Q9-=HUO>?s_~M&Bd4Q5lrrk){lq4%Icm)salk#ml?igB-)enXy
zGhe=$Ognx5eEYZ{qNn@WgI}&*XOF?HTHYt3OCs7Mq7&+IMntv0vY~C+W_LhDx7Rm!
zLsSDHF#u~Q!2svu@vv<;o1Ej}5J6tetbNOf!57)M(}9OQ{Bq8k&dh!5^ZI=7I%BKw
z!ZCWsxFAlz2bC(ZiFR=`l$JO*ej|<aX`QMrM`KwEK?AS`!u*+SuA;v7)LNk9(iU7q
z^hI0qY*^O5sZ*7~EF1Wf*}spTSvF8JyOcv@Xi8;MC@TY`1^}ussa#%z&Njvqe#wJh
z^fhOf9O!`L)+lpe5B=Zf5RBChEqr7pG`Gx!2>^EC2+Fep^s>w+^_BjqervyAD&JrH
z{{`F`=6poyV)!)i7m+=l7^&?aLr1X2xXYO9af0~f<o9UmlYK-+v5ag-Pe;b^1%UKk
A%>V!Z

literal 0
HcmV?d00001

diff --git a/roles/collectd/base/files/selinux/fi-collectd.pp b/roles/collectd/base/files/selinux/fi-collectd.pp
new file mode 100644
index 0000000000000000000000000000000000000000..559d78dc9a383e8e00493c68edb50d6fc9f27723
GIT binary patch
literal 1441
zcmb_cT~5O=3^qRk1W3RQb^#FFfEV82i33zwl8&HisgevaX;(m;cTYoK8#5EN5*mDx
z)x`ed&vEO1ZdU6(B7$8K(Z^=Bz96FKhsmRxFWx6l-YgosPefOlc0xVQh^Thg+Bc2W
z$s7>T-OcTNj!GcJ24KyifN|kCyJj}2l)_=>CxWhI)~>OL!56GDr<sR6{CrNUR!v>w
z((*iejnb8WvmrQRaY3Ab4_T^cRnRX-xwL50%yp?DAD6LeQ&8G+A!q>BfS<lvovI+O
zJ+@}ZIJX5C;ryIi^0c4VZdS)Cfmt^2C$oPaJ+o|}WVSK+V3Ct68$($cz%>BK3ggQ8
zHAuA~9`j2c{G4BMcF{lwSX-jhz#jR3tHBtm9l7w4m5|(03ljkB!eNwW8R%uH$Mu!|
zv3^TGV@&Ta{{I5*3^OjEbT)jN_>1r!PmI*|k0B#iW88Vn<v1aEck+8Q<;gz6qgY0^
JqbDOn_yX06Vd4M)

literal 0
HcmV?d00001

diff --git a/roles/collectd/base/files/selinux/fi-collectd.te b/roles/collectd/base/files/selinux/fi-collectd.te
new file mode 100644
index 0000000000..5c01df0df8
--- /dev/null
+++ b/roles/collectd/base/files/selinux/fi-collectd.te
@@ -0,0 +1,16 @@
+
+module fi-collectd 1.0;
+
+require {
+	type configfs_t;
+	type pstorefs_t;
+	type collectd_t;
+	class capability { dac_read_search sys_ptrace setgid dac_override };
+	class file read;
+	class dir getattr;
+}
+
+#============= collectd_t ==============
+allow collectd_t configfs_t:dir getattr;
+allow collectd_t pstorefs_t:dir getattr;
+allow collectd_t self:capability { dac_read_search sys_ptrace setgid dac_override };
diff --git a/roles/collectd/base/tasks/main.yml b/roles/collectd/base/tasks/main.yml
index 4029ec352c..476d701992 100644
--- a/roles/collectd/base/tasks/main.yml
+++ b/roles/collectd/base/tasks/main.yml
@@ -42,6 +42,20 @@
   - restart collectd
   when: collectd_apache is defined
 
+
+# Three tasks for handling our custom selinux module
+- name: ensure a directory exists for our custom selinux module
+  file: dest=/usr/share/collectd state=directory
+
+- name: copy over our custom selinux module
+  copy: src=selinux/fi-collectd.pp dest=/usr/share/collectd/fi-collectd.pp
+  register: selinux_module
+
+- name: install our custom selinux module
+  command: semodule -i /usr/share/collectd/fi-collectd.pp
+  when: selinux_module|changed
+
+
   
 # each of the below should move to a separate task list
 # since they are odd-balls and one-offs