diff --git a/roles/nagios/server/files/selinux/Makefile b/roles/nagios/server/files/selinux/Makefile index 9f2c724098..6924f038f4 100644 --- a/roles/nagios/server/files/selinux/Makefile +++ b/roles/nagios/server/files/selinux/Makefile @@ -2,3 +2,6 @@ module: checkmodule -Mmo nagios_hostname.mod nagios_hostname.te semodule_package -o nagios_hostname.pp -m nagios_hostname.mod rm nagios_hostname.mod + checkmodule -Mmo nagios_42.mod nagios_42.te + semodule_package -o nagios_42.pp -m nagios_42.mod + rm nagios_42.mod diff --git a/roles/nagios/server/files/selinux/nagios_42.pp b/roles/nagios/server/files/selinux/nagios_42.pp new file mode 100644 index 0000000000..6ea759e5cb Binary files /dev/null and b/roles/nagios/server/files/selinux/nagios_42.pp differ diff --git a/roles/nagios/server/files/selinux/nagios_42.te b/roles/nagios/server/files/selinux/nagios_42.te new file mode 100644 index 0000000000..f810a55b64 --- /dev/null +++ b/roles/nagios/server/files/selinux/nagios_42.te @@ -0,0 +1,15 @@ +# Custom policy by puiterwijk for Nagios 4.2 in Fedora Infra +module nagios_42 1.0; + +require { + type nagios_services_plugin_t; + type devlog_t; + type kernel_t; + class sock_file write; + class unix_dgram_socket { sendto connect create }; +}; + +#============= nagios_services_plugin_t ============== +allow nagios_services_plugin_t devlog_t:sock_file write; +allow nagios_services_plugin_t kernel_t:unix_dgram_socket sendto; +allow nagios_services_plugin_t self:unix_dgram_socket { connect create }; diff --git a/roles/nagios/server/tasks/main.yml b/roles/nagios/server/tasks/main.yml index 66da47408a..647ab9043f 100644 --- a/roles/nagios/server/tasks/main.yml +++ b/roles/nagios/server/tasks/main.yml @@ -133,6 +133,18 @@ tags: - nagios/server +- name: Copy over our custom nagios 4.2 selinux module + copy: src=selinux/nagios_42.pp dest=/usr/local/share/nagios-policy/nagios_42.pp + register: selinux_module + tags: + - nagios/server + +- name: Install our custom nagios 4.2 selinux module + command: semodule -i /usr/local/share/nagios-policy/nagios_42.pp + when: selinux_module|changed + tags: + - nagios/server + - name: Start and autostart services service: name={{item}} state=started enabled=yes with_items: