Revert "Merge pull request #470 from rkoster/remove-monit-permit-access"

This reverts commit 61e0da3, reversing
changes made to 1639545.

Author: selzoc

stemcell_builder/stages/bosh_go_agent/assets/runit/agent/run

@@ -4,6 +4,10 @@ set -e
 export PATH=/var/vcap/bosh/bin:$PATH
 exec 2>&1
 
+source /var/vcap/bosh/etc/monit-access-helper.sh
+
+permit_monit_access
+
 cd /var/vcap/bosh
 
 exec nice -n -15 /var/vcap/bosh/bin/bosh-agent -P $(cat /var/vcap/bosh/etc/operating_system) -C /var/vcap/bosh/agent.json

stemcell_builder/stages/bosh_monit/apply.sh

@@ -30,4 +30,12 @@ chmod 0700 $chroot/$bosh_dir/etc/monitrc
 mkdir -p $chroot/$bosh_app_dir/monit
 touch $chroot/$bosh_app_dir/monit/empty.monitrc
 
-cp $dir/assets/monit-access-helper.sh $chroot/$bosh_dir/etc/
+# Monit wrapper script:
+mv $chroot/$bosh_dir/bin/monit $chroot/$bosh_dir/bin/monit-actual
+
+cp $dir/assets/monit-access-helper.sh $chroot/$bosh_dir/etc/
+cp $dir/assets/monit $chroot/$bosh_dir/bin/monit
+chmod +x $chroot/$bosh_dir/bin/monit
+
+cp $dir/assets/restrict-monit-api-access $chroot/etc/network/if-up.d/restrict-monit-api-access
+chmod +x $chroot/etc/network/if-up.d/restrict-monit-api-access

stemcell_builder/stages/bosh_monit/assets/monit

@@ -0,0 +1,9 @@
+#!/bin/bash
+
+set -e
+
+source /var/vcap/bosh/etc/monit-access-helper.sh
+
+permit_monit_access
+
+exec /var/vcap/bosh/bin/monit-actual "$@"

stemcell_builder/stages/bosh_monit/assets/monit-access-helper.sh

@@ -1,3 +1,24 @@
+# This is the integer value of the argument "0xb0540001", which is
+# b054:0001 . The major number (the left-hand side) is "BOSH", leet-ified.
+# The minor number (the right-hand side) is 1, indicating that this is the
+# first thing in our "BOSH" classid namespace.
+#
+# _Hopefully_ noone uses a major number of "b054", and we avoid collisions _forever_!
+# If you need to select new classids for firewall rules or traffic control rules, keep
+# the major number "b054" for bosh stuff, unless there's a good reason to not.
+#
+# The net_cls.classid structure is described in more detail here:
+# https://www.kernel.org/doc/Documentation/cgroup-v1/net_cls.txt
+
+monit_isolation_classid=2958295041
+
 permit_monit_access() {
-  /usr/local/sbin/bosh-enable-monit-access
-}
+    net_cls_location="$(cat /proc/self/mounts | grep ^cgroup | grep net_cls | awk '{ print $2 }' )"
+    net_cls_subproc="$(grep net_cls /proc/self/cgroup | awk -F ":" '{ print $3 }' )"
+    monit_access_cgroup="${net_cls_location}/${net_cls_subproc}/monit-api-access"
+
+    mkdir -p "${monit_access_cgroup}"
+    echo "${monit_isolation_classid}" > "${monit_access_cgroup}/net_cls.classid"
+
+    echo $$ > "${monit_access_cgroup}/tasks"
+}

stemcell_builder/stages/bosh_monit/assets/restrict-monit-api-access

@@ -0,0 +1,14 @@
+#!/bin/bash
+
+source /var/vcap/bosh/etc/monit-access-helper.sh
+
+if iptables -t mangle -C POSTROUTING -d 127.0.0.1 -p tcp --dport 2822 \
+	    -m cgroup \! --cgroup "${monit_isolation_classid}" -j DROP
+then
+  /bin/true
+else
+    iptables -t mangle -I POSTROUTING -d 127.0.0.1 -p tcp --dport 2822 \
+	     -m cgroup \! --cgroup "${monit_isolation_classid}" -j DROP
+    iptables -t mangle -I POSTROUTING -d 127.0.0.1 -p tcp --dport 2822 \
+	     -m state --state ESTABLISHED,RELATED -j ACCEPT
+fi