confining daemons
As i manage a small vps i wrote a simple daemon in python to read the
journal and email me anytime a service fails. The source code is located
at https://github.com/gkarakou/systemd-mailify.
As i currently have too many problems with selinux enforcing in my
desktop and i wouldn't make tests on the live system i kindly request
someone to review my selinux policy module. All the app is doing is
reading systemd-journal and name connects on smtp ports. It reads its
configuration from a file in etc (/etc/systemd-mailify.conf) and has a
dedicated service file. The executable is located in /usr/bin and a pid
file is written under /run.
Here are the relevant parts.
systemd-mailify.te
#############################
policy_module(systemd_mailify, 1.0)
type systemd_mailify_t;
type systemd_mailify_exec_t;
type systemd_unit_file_t;
type systemd_mailify_conf_t;
type systemd_mailify_var_run_t;
class tcp_socket name_connect;
init_daemon_domain(systemd_mailify_t, systemd_mailify_exec_t)
allow systemd_mailify_t systemd_mailify_conf_t : file rw_file_perms;
allow systemd_mailify_t systemd_mailify_conf_t : lnk_file { getattr read };
manage_files_pattern(systemd_mailify_t, systemd_mailify_var_run_t,
systemd_mailify_var_run_t)
files_config_file(systemd_mailify_conf_t);
files_pid_file(systemd_mailify_var_run_t);
files_read_etc_files(systemd_mailify_conf_t);
files_search_etc(systemd_mailify_conf_t);
files_pid_filetrans(systemd_mailify_t,systemd_mailify_var_run_t, { file });
auth_use_nsswitch(systemd_mailify_t);
logging_send_syslog_msg(systemd_mailify_t);
miscfiles_read_localization(systemd_mailify_t);
sysnet_dns_name_resolve(systemd_mailify_t);
allow systemd_mailify_exec_t smtp_port_t:tcp_socket name_connect;
corenet_tcp_sendrecv_all_if(systemd_mailify_exec_t);
corenet_tcp_sendrecv_all_nodes(systemd_mailify_exec_t);
corenet_tcp_sendrecv_all_ports(systemd_mailify_exec_t);
corenet_all_recvfrom_unlabeled(systemd_mailify_exec_t);
domain_use_interactive_fds(systemd_mailify_exec_t);
#######################
systemd-mailify.fc
#######################
/usr/bin/systemd-mailify.py --
gen_context(system_u:object_r:systemd_mailify_exec_t,s0)
/etc/systemd-mailify.conf
gen_context(system_u:object_r:systemd_mailify_conf_t,s0)
/usr/lib/systemd/system/systemd-mailify.service
gen_context(system_u:object_r:systemd_unit_file_t,s0)
/run/systemd-mailify.pid
gen_context(system_u:object_r:systemd_mailify_var_run_t,s0)