james/ansible
1
0
Fork 0
forked from infra/ansible
Code Pull requests Activity

Selinux: allow NRPE to follow symlinks when checking files

Browse source 
Signed-off-by: Greg Sutcliffe <fedora@emeraldreverie.org>
This commit is contained in:
Greg Sutcliffe 2025-07-11 17:03:15 +01:00 • committed by kevin
commit 9f06fe9e9c
3 changed files with 6 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

BIN
roles/nagios_client/files/selinux/fi-nrpe.mod
View file

Binary file not shown.

BIN
roles/nagios_client/files/selinux/fi-nrpe.pp
View file

Binary file not shown.

7
roles/nagios_client/files/selinux/fi-nrpe.te
View file

@ -1,11 +1,13 @@
module fi-nrpe 1.1;
module fi-nrpe 1.2;
require {
type nagios_system_plugin_t;
type nagios_admin_plugin_t;
type nrpe_exec_t;
type bin_t;
type default_t;
class file { getattr map execute };
class lnk_file { read getattr };
}
#============= nagios_system_plugin_t ==============
@ -13,3 +15,6 @@ allow nagios_system_plugin_t nrpe_exec_t:file getattr;
# This is needed for e.g. check_file_age, which is a perl script
allow nagios_admin_plugin_t bin_t:file { map execute };
# Allow reading symlinks
allow nagios_admin_plugin_t default_t:lnk_file read;