From f64c4b1c44feb02a0facf3daab9a44fb8b834cce Mon Sep 17 00:00:00 2001
From: Valentin Gologuzov <vgologuz@redhat.com>
Date: Tue, 3 Feb 2015 01:53:50 +0100
Subject: [PATCH] [copr] backend: add custom selinux policy for nrpe checks

---
 roles/copr/backend/files/selinux/compile.sh   |   4 ++++
 .../copr/backend/files/selinux/nrpe_copr.mod  | Bin 0 -> 939 bytes
 roles/copr/backend/files/selinux/nrpe_copr.pp | Bin 0 -> 955 bytes
 roles/copr/backend/files/selinux/nrpe_copr.te |  11 +++++++++++
 roles/copr/backend/tasks/main.yml             |  10 +++-------
 roles/copr/backend/tasks/monitoring.yml       |  18 ++++++++++++++++++
 6 files changed, 36 insertions(+), 7 deletions(-)
 create mode 100644 roles/copr/backend/files/selinux/compile.sh
 create mode 100644 roles/copr/backend/files/selinux/nrpe_copr.mod
 create mode 100644 roles/copr/backend/files/selinux/nrpe_copr.pp
 create mode 100644 roles/copr/backend/files/selinux/nrpe_copr.te
 create mode 100644 roles/copr/backend/tasks/monitoring.yml

diff --git a/roles/copr/backend/files/selinux/compile.sh b/roles/copr/backend/files/selinux/compile.sh
new file mode 100644
index 0000000000..f37b46c00f
--- /dev/null
+++ b/roles/copr/backend/files/selinux/compile.sh
@@ -0,0 +1,4 @@
+#!/bin/sh
+
+checkmodule -M -m -o nrpe_copr.mod nrpe_copr.te
+semodule_package -o nrpe_copr.pp -m nrpe_copr.mod
diff --git a/roles/copr/backend/files/selinux/nrpe_copr.mod b/roles/copr/backend/files/selinux/nrpe_copr.mod
new file mode 100644
index 0000000000000000000000000000000000000000..5ebf1b7fa39959c5a1ee952876607f5401cd2957
GIT binary patch
literal 939
zcmb`FO-ckY5QW<jL`4v9FeebbK{m6~l?Mo#$zuFTnw|`}@CqK-mDV@Y&nXo}&<8K|
z>bDcRo?o9{j=QeAnoTbjW%W3{tn<}<o>=I_xMSQmf&*i!{SeF0=UsEoPtSsx&!7h$
zjtTi#&{7|lHQnWQWFFCS{g7j-rR3C9%~#b?Z*DCUhhQ-wNSO6nVISi)aBsBwhPfYl
zd02eE)pu1xo-dZMuS1KC2|qzI^b%?nLx+*db4w7`=k~yds*@$=q1np&TyPE=s!o=e
z5KKVj_~jt1&&}~0O+R%|vt)@0LBi~RX*cpulKZmH+ubGN$-Zh&CoYF(?>4*TJJ^1|
KOFn0*FL(pLV>qz@

literal 0
HcmV?d00001

diff --git a/roles/copr/backend/files/selinux/nrpe_copr.pp b/roles/copr/backend/files/selinux/nrpe_copr.pp
new file mode 100644
index 0000000000000000000000000000000000000000..ee51973408274b85416cda3c2fc54fe1422d7c69
GIT binary patch
literal 955
zcmb_aOG*Pl6dV%}m4JGKoIvyjZ{to^9-z@qFQTS<=ybq^R}jzZN~@A7^HdZ;3#wne
z?{qWo`StN-r|UZM2z-Kn2zzxty_o0K!}PMuR`+Ry&@sreJ&@Q3W9e(iwNGO>XD6oy
z^BEd{FeK#D5-s*&S>j!46L^f~>qQE&<eXwtHNUEka&wDJsD_we60lw?>|=ZlxjR^W
z1MY`jJ}kW7>bt6%X7gp}OKqWX!cWi)y@a)jQQJV}c}v39=k}mas!o<M56xEI=gc|O
zr0QfD6AXe>j=!9+^|?8IquI|oQnO?k6HEg3zqA|qC&~MApSQcqh$r_|dpdGCYVO@;
Pw|ob;-|v#oA@v1sInX=C

literal 0
HcmV?d00001

diff --git a/roles/copr/backend/files/selinux/nrpe_copr.te b/roles/copr/backend/files/selinux/nrpe_copr.te
new file mode 100644
index 0000000000..9eccd7a589
--- /dev/null
+++ b/roles/copr/backend/files/selinux/nrpe_copr.te
@@ -0,0 +1,11 @@
+
+module copr_nrpe 1.0;
+
+require {
+	type redis_port_t;
+	type nrpe_t;
+	class tcp_socket name_connect;
+}
+
+#============= nrpe_t ==============
+allow nrpe_t redis_port_t:tcp_socket name_connect;
diff --git a/roles/copr/backend/tasks/main.yml b/roles/copr/backend/tasks/main.yml
index 0715057e5b..64b7acf446 100644
--- a/roles/copr/backend/tasks/main.yml
+++ b/roles/copr/backend/tasks/main.yml
@@ -121,7 +121,7 @@
   tags:
   - config
 
-- name: copy signe.conf
+- name: copy sign.conf
   template: src=sign.conf dest=/etc/sign.conf  owner=root group=copr mode=640
   tags:
   - config
@@ -142,9 +142,5 @@
 - cron: name="kill VMs in error state" minute="*/15"  job="/root/instant-instance-killer.sh"
   when: not devel
 
-- name: install nrpe checks
-  template: src=copr_backend_nrpe.cfg dest=/etc/nrpe.d/copr_backend_nrpe.cfg
-  notify:
-  - restart nrpe
-  tags:
-  - nagios_client
+- name: setup monitoring
+  include: "monitoring.yml"
diff --git a/roles/copr/backend/tasks/monitoring.yml b/roles/copr/backend/tasks/monitoring.yml
new file mode 100644
index 0000000000..dd37fc282d
--- /dev/null
+++ b/roles/copr/backend/tasks/monitoring.yml
@@ -0,0 +1,18 @@
+- name: install nrpe checks
+  template: src=copr_backend_nrpe.cfg dest=/etc/nrpe.d/copr_backend_nrpe.cfg
+  notify:
+  - restart nrpe
+  tags:
+  - nagios_client
+
+# Three tasks for handling our custom selinux module
+- name: ensure a directory exists for our custom selinux module
+  file: dest=/usr/local/share/copr state=directory
+
+- name: copy over our custom selinux module
+  copy: src=selinux/nrpe_copr.pp dest=/usr/local/share/copr/fedmsg.pp
+  register: selinux_module
+
+- name: install our custom selinux module
+  command: semodule -i /usr/local/share/copr/fedmsg.pp
+  when: selinux_module|changed