--- nsaserefpolicy/policy/modules/services/nagios.fc	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/nagios.fc	2008-08-14 13:53:54.000000000 -0400
@@ -4,13 +4,17 @@
 /usr/bin/nagios			--	gen_context(system_u:object_r:nagios_exec_t,s0)
 /usr/bin/nrpe			--	gen_context(system_u:object_r:nrpe_exec_t,s0)
 
-/usr/lib(64)?/cgi-bin/netsaint/.+ --	gen_context(system_u:object_r:nagios_cgi_exec_t,s0)
-/usr/lib(64)?/nagios/cgi/.+	--	gen_context(system_u:object_r:nagios_cgi_exec_t,s0)
+/usr/lib(64)?/nagios/cgi-bin(/.*)?		gen_context(system_u:object_r:httpd_nagios_script_exec_t,s0)
 
 /var/log/nagios(/.*)?			gen_context(system_u:object_r:nagios_log_t,s0)
-/var/log/netsaint(/.*)?			gen_context(system_u:object_r:nagios_log_t,s0)
+
+/var/spool/nagios(/.*)?			gen_context(system_u:object_r:nagios_spool_t,s0)
 
 ifdef(`distro_debian',`
 /usr/sbin/nagios		--	gen_context(system_u:object_r:nagios_exec_t,s0)
-/usr/lib/cgi-bin/nagios/.+	--	gen_context(system_u:object_r:nagios_cgi_exec_t,s0)
 ')
+/usr/lib(64)?/cgi-bin/nagios(/.+)?	gen_context(system_u:object_r:httpd_nagios_script_exec_t,s0)
+
+/etc/rc.d/init.d/nagios	--	gen_context(system_u:object_r:nagios_script_exec_t,s0)
+/etc/rc.d/init.d/nrpe	--	gen_context(system_u:object_r:nagios_script_exec_t,s0)
+
--- nsaserefpolicy/policy/modules/services/nagios.if	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/nagios.if	2008-08-14 13:53:54.000000000 -0400
@@ -44,7 +44,7 @@
 
 ########################################
 ## <summary>
-##	Execute the nagios CGI with
+##	Execute the nagios NRPE with
 ##	a domain transition.
 ## </summary>
 ## <param name="domain">
@@ -53,29 +53,87 @@
 ##	</summary>
 ## </param>
 #
-interface(`nagios_domtrans_cgi',`
+interface(`nagios_domtrans_nrpe',`
 	gen_require(`
-		type nagios_cgi_t, nagios_cgi_exec_t;
+		type nrpe_t, nrpe_exec_t;
 	')
 
-	domtrans_pattern($1, nagios_cgi_exec_t, nagios_cgi_t)
+	domtrans_pattern($1, nrpe_exec_t, nrpe_t)
 ')
 
 ########################################
 ## <summary>
-##	Execute the nagios NRPE with
-##	a domain transition.
+##	Execute nagios server in the nagios domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	The type of the process performing this action.
+##	</summary>
+## </param>
+#
+#
+interface(`nagios_script_domtrans',`
+	gen_require(`
+		type nagios_script_exec_t;
+	')
+
+	init_script_domtrans_spec($1, nagios_script_exec_t)
+')
+
+########################################
+## <summary>
+##	All of the rules required to administrate 
+##	an nagios environment
 ## </summary>
 ## <param name="domain">
 ##	<summary>
 ##	Domain allowed access.
 ##	</summary>
 ## </param>
+## <param name="role">
+##	<summary>
+##	The role to be allowed to manage the nagios domain.
+##	</summary>
+## </param>
+## <param name="terminal">
+##	<summary>
+##	The type of the user terminal.
+##	</summary>
+## </param>
+## <rolecap/>
 #
-interface(`nagios_domtrans_nrpe',`
+interface(`nagios_admin',`
 	gen_require(`
-		type nrpe_t, nrpe_exec_t;
+		type nagios_t, nrpe_t;
+		type nagios_tmp_t, nagios_log_t;
+		type nagios_etc_t, nrpe_etc_t;
+		type nagios_spool_t, nagios_var_run_t;
+		type nagios_script_exec_t;
 	')
 
-	domtrans_pattern($1, nrpe_exec_t, nrpe_t)
+	allow $1 nagios_t:process { ptrace signal_perms };
+	ps_process_pattern($1, nagios_t)
+
+	# Allow nagios_t to restart the apache service
+	nagios_script_domtrans($1)
+	domain_system_change_exemption($1)
+	role_transition $2 nagios_script_exec_t system_r;
+	allow $2 system_r;
+
+	files_list_tmp($1)
+        admin_pattern($1, nagios_tmp_t)
+
+	logging_list_logs($1)
+        admin_pattern($1, nagios_log_t)
+
+	files_list_etc($1)
+	admin_pattern($1, nagios_etc_t)
+
+	files_list_spool($1)
+        admin_pattern($1, nagios_spool_t)
+
+	files_list_pids($1)
+        admin_pattern($1, nagios_var_run_t)
+
+	admin_pattern($1, nrpe_etc_t)
 ')
--- nsaserefpolicy/policy/modules/services/nagios.te	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/services/nagios.te	2008-08-14 13:53:54.000000000 -0400
@@ -10,10 +10,6 @@
 type nagios_exec_t;
 init_daemon_domain(nagios_t, nagios_exec_t)
 
-type nagios_cgi_t;
-type nagios_cgi_exec_t;
-init_system_domain(nagios_cgi_t, nagios_cgi_exec_t)
-
 type nagios_etc_t;
 files_config_file(nagios_etc_t)
 
@@ -26,6 +22,9 @@
 type nagios_var_run_t;
 files_pid_file(nagios_var_run_t)
 
+type nagios_spool_t;
+files_type(nagios_spool_t)
+
 type nrpe_t;
 type nrpe_exec_t;
 init_daemon_domain(nrpe_t, nrpe_exec_t)
@@ -33,6 +32,9 @@
 type nrpe_etc_t;
 files_config_file(nrpe_etc_t)
 
+type nagios_script_exec_t;
+init_script_type(nagios_script_exec_t)
+
 ########################################
 #
 # Nagios local policy
@@ -60,6 +62,8 @@
 manage_files_pattern(nagios_t, nagios_var_run_t, nagios_var_run_t)
 files_pid_filetrans(nagios_t, nagios_var_run_t, file)
 
+rw_fifo_files_pattern(nagios_t, nagios_spool_t, nagios_spool_t)
+
 kernel_read_system_state(nagios_t)
 kernel_read_kernel_sysctls(nagios_t)
 
@@ -131,42 +135,34 @@
 #
 # Nagios CGI local policy
 #
+apache_content_template(nagios)
+typealias httpd_nagios_script_t alias nagios_cgi_t;
+typealias httpd_nagios_script_exec_t alias nagios_cgi_exec_t;
 
-allow nagios_cgi_t self:process signal_perms;
-allow nagios_cgi_t self:fifo_file rw_fifo_file_perms;
-
-read_files_pattern(nagios_cgi_t, nagios_t, nagios_t)
-read_lnk_files_pattern(nagios_cgi_t, nagios_t, nagios_t)
+allow httpd_nagios_script_t self:process signal_perms;
 
-allow nagios_cgi_t nagios_etc_t:dir list_dir_perms;
-read_files_pattern(nagios_cgi_t, nagios_etc_t, nagios_etc_t)
-read_lnk_files_pattern(nagios_cgi_t, nagios_etc_t, nagios_etc_t)
+read_files_pattern(httpd_nagios_script_t, nagios_t, nagios_t)
+read_lnk_files_pattern(httpd_nagios_script_t, nagios_t, nagios_t)
 
-allow nagios_cgi_t nagios_log_t:dir list_dir_perms;
-read_files_pattern(nagios_cgi_t, nagios_etc_t, nagios_log_t)
-read_lnk_files_pattern(nagios_cgi_t, nagios_etc_t, nagios_log_t)
+files_search_spool(httpd_nagios_script_t)
+rw_fifo_files_pattern(httpd_nagios_script_t, nagios_spool_t, nagios_spool_t)
 
-kernel_read_system_state(nagios_cgi_t)
+allow httpd_nagios_script_t nagios_etc_t:dir list_dir_perms;
+read_files_pattern(httpd_nagios_script_t, nagios_etc_t, nagios_etc_t)
+read_lnk_files_pattern(httpd_nagios_script_t, nagios_etc_t, nagios_etc_t)
 
-corecmd_exec_bin(nagios_cgi_t)
+allow httpd_nagios_script_t nagios_log_t:dir list_dir_perms;
+read_files_pattern(httpd_nagios_script_t, nagios_etc_t, nagios_log_t)
+read_lnk_files_pattern(httpd_nagios_script_t, nagios_etc_t, nagios_log_t)
 
-domain_dontaudit_read_all_domains_state(nagios_cgi_t)
+kernel_read_system_state(httpd_nagios_script_t)
 
-files_read_etc_files(nagios_cgi_t)
-files_read_etc_runtime_files(nagios_cgi_t)
-files_read_kernel_symbol_table(nagios_cgi_t)
+domain_dontaudit_read_all_domains_state(httpd_nagios_script_t)
 
-libs_use_ld_so(nagios_cgi_t)
-libs_use_shared_libs(nagios_cgi_t)
+files_read_etc_runtime_files(httpd_nagios_script_t)
+files_read_kernel_symbol_table(httpd_nagios_script_t)
 
-logging_send_syslog_msg(nagios_cgi_t)
-logging_search_logs(nagios_cgi_t)
-
-miscfiles_read_localization(nagios_cgi_t)
-
-optional_policy(`
-	apache_append_log(nagios_cgi_t)
-')
+logging_send_syslog_msg(httpd_nagios_script_t)
 
 ########################################
 #
