Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Drop cf-runalerts.service + SELinux policy updates #5487

Merged
merged 3 commits into from
May 2, 2024
Merged

Drop cf-runalerts.service + SELinux policy updates #5487

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
fb513cd
Drop cf-runalerts.service
vpodzime Apr 25, 2024
b80ccee
Allow httpd to open tmp files
vpodzime Apr 26, 2024
eb909fe
Adapt SELinux policy to cf-reactor running alerts periodically
vpodzime Apr 26, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 0 additions & 1 deletion configure.ac
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1569,7 +1569,6 @@ AS_IF([test "x$SYSTEMD_SERVICE_PATH" = "x"], [], [
AC_CONFIG_FILES([misc/systemd/cf-reactor.service])
AC_CONFIG_FILES([misc/systemd/cf-monitord.service])
AC_CONFIG_FILES([misc/systemd/cf-postgres.service])
AC_CONFIG_FILES([misc/systemd/cf-runalerts.service])
AC_CONFIG_FILES([misc/systemd/cf-serverd.service])
])

Expand Down
2 changes: 0 additions & 2 deletions misc/Makefile.am
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,6 @@ EXTRA_DIST= init.d/cfengine3.in \
systemd/cf-hub.service.in \
systemd/cf-monitord.service.in \
systemd/cf-postgres.service.in \
systemd/cf-runalerts.service.in \
systemd/cf-serverd.service.in \
systemd/cfengine3.service.in

Expand All @@ -28,7 +27,6 @@ systemd_DATA += systemd/cf-hub.service
systemd_DATA += systemd/cf-reactor.service
systemd_DATA += systemd/cf-monitord.service
systemd_DATA += systemd/cf-postgres.service
systemd_DATA += systemd/cf-runalerts.service
systemd_DATA += systemd/cf-serverd.service

install-data-hook:
Expand Down
32 changes: 23 additions & 9 deletions misc/selinux/cfengine-enterprise.te.all
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -638,7 +638,7 @@ allow cfengine_httpd_t sssd_var_lib_t:dir search;
allow cfengine_httpd_t sssd_var_lib_t:sock_file write;
allow cfengine_httpd_t syslogd_var_run_t:dir search;
allow cfengine_httpd_t tmp_t:sock_file write;
allow cfengine_httpd_t tmp_t:file { create setattr unlink write rename };
allow cfengine_httpd_t tmp_t:file { create setattr unlink write rename open };
allow cfengine_httpd_t tmp_t:dir { add_name remove_name write read };
allow cfengine_httpd_t var_t:dir read;

Expand Down Expand Up @@ -740,6 +740,11 @@ type_transition cfengine_reactor_t cfengine_cfbs_exec_t:process cfengine_cfbs_t;
allow cfengine_reactor_t cfengine_cfbs_t:process transition;
allow cfengine_reactor_t cfengine_cfbs_exec_t:file { execute open read };

# cf-reactor runs PHP code to evaluate alerts (as cfapache user)
allow cfengine_reactor_t cfengine_httpd_exec_t:file { execute execute_no_trans getattr open read map };
allow cfengine_reactor_t self:capability { setgid setuid };
allow cfengine_reactor_t self:process execmem;

allow cfengine_reactor_t cfengine_reactor_exec_t:file entrypoint;
allow cfengine_reactor_t cfengine_reactor_exec_t:file { ioctl read getattr lock map execute open };

Expand All @@ -764,12 +769,16 @@ allow cfengine_reactor_t sssd_public_t:dir search;
allow cfengine_reactor_t sssd_public_t:file { open read getattr map };
allow cfengine_reactor_t sssd_t:unix_stream_socket connectto;
allow cfengine_reactor_t tmp_t:sock_file write;
allow cfengine_reactor_t tmp_t:dir { add_name remove_name write };
allow cfengine_reactor_t tmp_t:file { create open setattr unlink write };
allow cfengine_reactor_t devlog_t:sock_file write;
allow cfengine_reactor_t devlog_t:lnk_file read;
allow cfengine_reactor_t syslogd_var_run_t:dir search;
allow cfengine_reactor_t kernel_t:unix_dgram_socket sendto;
allow cfengine_reactor_t kernel_t:unix_stream_socket connectto;
allow cfengine_reactor_t init_var_run_t:dir search;
allow cfengine_reactor_t init_t:unix_stream_socket getattr;
allow cfengine_reactor_t init_t:unix_stream_socket { getattr ioctl };

allow cfengine_reactor_t var_t:dir read;
allow cfengine_reactor_t bin_t:file { execute execute_no_trans map };
allow cfengine_reactor_t fs_t:filesystem getattr;
Expand All @@ -796,9 +805,9 @@ allow cfengine_reactor_t ssh_port_t:tcp_socket name_connect;

#============= cfengine_action_script_t ==============
# A special type and domain for action (notification/alert) scripts executed by
# Mission Portal. They can do anything, so they need to run in an unconstrained
# domain. At the same time we don't want our Apache and PHP to do anything so
# these scripts cannot just run in the http_t domain.
# PHP. They can do anything, so they need to run in an unconstrained domain. At
# the same time we don't want our Apache and PHP to do anything so these scripts
# cannot just run in the http_t domain.

type cfengine_action_script_t;
typeattribute cfengine_action_script_t domain;
Expand All @@ -817,10 +826,15 @@ typeattribute cfengine_action_script_exec_t exec_type;
typeattribute cfengine_action_script_exec_t file_type, non_security_file_type, non_auth_file_type;
role object_r types cfengine_action_script_exec_t;

type_transition cfengine_httpd_t cfengine_action_script_exec_t:process cfengine_action_script_t;
allow cfengine_httpd_t cfengine_action_script_t:process transition;
allow cfengine_httpd_t cfengine_action_script_exec_t:file { execute execute_no_trans getattr open read };
allow cfengine_httpd_t cfengine_action_script_t:process siginh;
# cf-apache/httpd manipulates with the action scripts
allow cfengine_httpd_t cfengine_action_script_exec_t:file { getattr open read };

# cf-reactor runs alerts periodically and these can trigger custom action scripts
type_transition cfengine_reactor_t cfengine_action_script_exec_t:process cfengine_action_script_t;
allow cfengine_reactor_t cfengine_action_script_t:process transition;
allow cfengine_reactor_t cfengine_action_script_exec_t:file { execute execute_no_trans getattr open read };
allow cfengine_reactor_t cfengine_action_script_exec_t:dir { getattr search };
allow cfengine_reactor_t cfengine_action_script_t:process siginh;

allow cfengine_action_script_t cfengine_action_script_exec_t:file entrypoint;
allow cfengine_action_script_t cfengine_action_script_exec_t:file { ioctl read getattr lock map execute open };
Expand Down
2 changes: 2 additions & 0 deletions misc/selinux/cfengine-enterprise.te.el9
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,3 +6,5 @@ require {
allow cfengine_httpd_t systemd_userdbd_runtime_t:dir { getattr open read search };
allow cfengine_httpd_t systemd_userdbd_runtime_t:sock_file write;
allow cfengine_httpd_t kernel_t:unix_stream_socket connectto;
allow cfengine_reactor_t systemd_userdbd_runtime_t:dir { getattr open read search };
allow cfengine_reactor_t systemd_userdbd_runtime_t:sock_file write;
23 changes: 0 additions & 23 deletions misc/systemd/cf-runalerts.service.in
View file
Open in desktop

This file was deleted.

2 changes: 0 additions & 2 deletions misc/systemd/cfengine3.service.in
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,6 @@ Wants=cf-execd.service
Wants=cf-monitord.service
Wants=cf-postgres.service
Wants=cf-apache.service
Wants=cf-runalerts.service
Wants=cf-hub.service
Wants=cf-reactor.service

Expand All @@ -20,7 +19,6 @@ Before=cf-execd.service
Before=cf-monitord.service
Before=cf-postgres.service
Before=cf-apache.service
Before=cf-runalerts.service
Before=cf-hub.service
Before=cf-reactor.service

Expand Down
Loading