-
Notifications
You must be signed in to change notification settings - Fork 1
/
Copy pathgrafana.te
209 lines (160 loc) · 5.44 KB
/
grafana.te
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
policy_module(grafana, 1.0.4)
########################################
#
# Declarations
#
#permissive grafana_t;
## <desc>
## <p>
## Allow grafana to be used with a reverse proxy
## </p>
## </desc>
gen_tunable(grafana_can_reverse_proxy, false)
## <desc>
## <p>
## Allow grafana to connect to elasticsearch's default tcp port of 9200
## </p>
## </desc>
gen_tunable(grafana_can_tcp_connect_elasticsearch_port, false)
## <desc>
## <p>
## Allow grafana to connect to mysql's default tcp port of 3306
## </p>
## </desc>
gen_tunable(grafana_can_tcp_connect_mysql_port, false)
## <desc>
## <p>
## Allow grafana to connect to prometheus' default tcp port of 9090
## </p>
## </desc>
gen_tunable(grafana_can_tcp_connect_prometheus_port, false)
## <desc>
## <p>
## Allow grafana to connect to postgresql's default tcp port of 5432
## </p>
## </desc>
gen_tunable(grafana_can_tcp_connect_postgresql_port, false)
type grafana_t;
type grafana_exec_t;
init_daemon_domain(grafana_t, grafana_exec_t)
init_nnp_daemon_domain(grafana_t)
type grafana_unit_file_t;
systemd_unit_file(grafana_unit_file_t)
type grafana_conf_t;
files_config_file(grafana_conf_t)
type grafana_db_t;
files_config_file(grafana_db_t)
type grafana_tmp_t;
files_tmp_file(grafana_tmp_t)
type grafana_tmpfs_t;
files_tmpfs_file(grafana_tmpfs_t)
type grafana_log_t;
logging_log_file(grafana_log_t)
type grafana_var_run_t;
files_pid_file(grafana_var_run_t)
type grafana_var_lib_t;
files_type(grafana_var_lib_t)
type grafana_port_t;
corenet_port(grafana_port_t)
type grafana_pcp_exec_t;
corecmd_executable_file(grafana_pcp_exec_t)
can_exec(grafana_t, grafana_pcp_exec_t)
# Ports 32768-60999 (pcp port is 44322)
corenet_tcp_connect_all_ephemeral_ports(grafana_t)
grafana_exec(grafana_t)
# Allow grafana to connect to mssql's default tcp port of 1433
corenet_tcp_connect_mssql_port(grafana_t)
########################################
#
# grafana local policy
#
allow grafana_t self:tcp_socket create_stream_socket_perms;
allow grafana_t self:udp_socket create_stream_socket_perms;
allow grafana_t self:unix_dgram_socket create_socket_perms;
allow grafana_t grafana_port_t:tcp_socket { name_bind name_connect };
allow grafana_t self:unix_stream_socket connectto;
allow grafana_t self:netlink_route_socket { create bind getattr nlmsg_read };
optional_policy(`
require {
type smtp_port_t;
class tcp_socket { name_connect };
}
allow grafana_t smtp_port_t:tcp_socket name_connect;
')
optional_policy(`
require {
type usr_t;
class file { execute execute_no_trans };
}
allow grafana_t usr_t:file { execute execute_no_trans };
')
optional_policy(`
require {
type postgresql_t;
type postgresql_var_run_t;
class unix_stream_socket { connectto };
class sock_file { write };
}
allow grafana_t postgresql_t:unix_stream_socket connectto;
allow grafana_t postgresql_var_run_t:sock_file write;
')
optional_policy(`
require {
type autofs_t;
class dir {getattr};
}
allow grafana_t autofs_t:dir getattr;
')
manage_dirs_pattern(grafana_t, grafana_conf_t, grafana_conf_t)
manage_files_pattern(grafana_t, grafana_conf_t, grafana_conf_t)
manage_dirs_pattern(grafana_t, grafana_db_t, grafana_db_t)
manage_files_pattern(grafana_t, grafana_db_t, grafana_db_t)
manage_dirs_pattern(grafana_t, grafana_tmp_t, grafana_tmp_t)
manage_files_pattern(grafana_t, grafana_tmp_t, grafana_tmp_t)
manage_sock_files_pattern(grafana_t, grafana_tmp_t, grafana_tmp_t)
files_tmp_filetrans(grafana_t, grafana_tmp_t, { dir file sock_file })
manage_dirs_pattern(grafana_t, grafana_tmpfs_t, grafana_tmpfs_t)
manage_files_pattern(grafana_t, grafana_tmpfs_t, grafana_tmpfs_t)
fs_tmpfs_filetrans(grafana_t, grafana_tmpfs_t, {dir file})
manage_dirs_pattern(grafana_t, grafana_log_t, grafana_log_t)
manage_files_pattern(grafana_t, grafana_log_t, grafana_log_t)
logging_log_filetrans(grafana_t, grafana_log_t, { dir file })
manage_dirs_pattern(grafana_t, grafana_var_run_t, grafana_var_run_t)
manage_files_pattern(grafana_t, grafana_var_run_t, grafana_var_run_t)
files_pid_filetrans(grafana_t, grafana_var_run_t, { dir file })
manage_dirs_pattern(grafana_t, grafana_var_lib_t, grafana_var_lib_t)
manage_files_pattern(grafana_t, grafana_var_lib_t, grafana_var_lib_t)
manage_lnk_files_pattern(grafana_t, grafana_var_lib_t, grafana_var_lib_t)
files_var_lib_filetrans(grafana_t, grafana_var_lib_t, { dir file })
corenet_tcp_connect_http_port(grafana_t)
corenet_tcp_bind_generic_node(grafana_t)
kernel_dgram_send(grafana_t)
kernel_read_net_sysctls(grafana_t)
kernel_read_system_state(grafana_t)
auth_read_passwd(grafana_t)
dev_read_sysfs(grafana_t)
sysnet_read_config(grafana_t)
logging_send_syslog_msg(grafana_t)
miscfiles_read_generic_certs(grafana_t)
tunable_policy(`grafana_can_reverse_proxy',`
gen_require(`
type httpd_t;
')
connect_grafana_port(httpd_t) # Reverse proxy support
corenet_tcp_connect_http_port(grafana_t)
')
tunable_policy(`grafana_can_tcp_connect_elasticsearch_port',` # Elasticsearch default tcp port 9200
corenet_tcp_connect_wap_wsp_port(grafana_t)
')
tunable_policy(`grafana_can_tcp_connect_mysql_port',` # Mysql default tcp port 3306
corenet_tcp_connect_mysqld_port(grafana_t)
')
tunable_policy(`grafana_can_tcp_connect_prometheus_port',` # Prometheus default tcp port 9090
corenet_tcp_connect_websm_port(grafana_t)
')
tunable_policy(`grafana_can_tcp_connect_postgresql_port',` # Postgresql default tcp port 5432
corenet_tcp_connect_postgresql_port(grafana_t)
')
optional_policy(`
systemd_private_tmp(grafana_tmp_t)
')