Bug 1032691

looks like the zabbix agent is trying to open name=/sys/devices/system/cpu/online

is this expected, probably is a simple policy fix when mgrepl gets back next week...

Basically we need to update the zabbix policy by

$ cat myzabbix.te
policy_module(myzabbix, 1.0)

require{
 type zabbix_agent_t;
}

domain_read_all_domain_state(zabbix_agent_t)
dev_read_sysfs(zabbix_agent_t))

(In reply to Miroslav Grepl from comment #3)
> Basically we need to update the zabbix policy by
> 
> $ cat myzabbix.te
> policy_module(myzabbix, 1.0)
> 
> require{
>  type zabbix_agent_t;
> }
> 
> domain_read_all_domain_state(zabbix_agent_t)
> dev_read_sysfs(zabbix_agent_t))

$ cat myzabbix.te
policy_module(myzabbix, 1.0)

require{
 type zabbix_agent_t;
}

domain_read_all_domains_state(zabbix_agent_t)
dev_read_sysfs(zabbix_agent_t)

After using this code we still have such errors:

type=AVC msg=audit(1386334625.138:81637): avc:  denied  { read } for  pid=4570 comm="zabbix_agentd" name="dev" dev=proc ino=4026531981 scontext=unconfined_u:system_r:zabbix_agent_t:s0 tcontext=system_u:object_r:proc_net_t:s0 tclass=file

type=SYSCALL msg=audit(1386334625.138:81637): arch=c000003e syscall=2 success=no exit=-13 a0=42e286 a1=0 a2=1b6 a3=0 items=0 ppid=4565 pid=4570 auid=503 uid=494 gid=496 euid=494 suid=494 fsuid=494 egid=496 sgid=496 fsgid=496 tty=(none) ses=3033 comm="zabbix_agentd" exe="/usr/sbin/zabbix_agentd" subj=unconfined_u:system_r:zabbix_agent_t:s0 key=(null)

I think it's our custom items from /proc/diskstats.

Ok, you need to update to 

$ cat myzabbix.te
policy_module(myzabbix, 1.0)

require{
 type zabbix_agent_t;
}

kernel_read_network_state(zabbix_agent_t)
domain_read_all_domains_state(zabbix_agent_t)
dev_read_sysfs(zabbix_agent_t)

We ran this on our zabbix server as it requires the use of fping in order to perform agent checks correctly.

Miroslav recommended this latest version in our conversation over IRC.  The zabbix_t, zabbix_tmp_t, and ping_t changes are specifically for the zabbix server.

$ cat /usr/share/selinux/devel/myzabbix.te
policy_module(myzabbix, 1.0)

require{
 type zabbix_agent_t;
 type zabbix_t;
 type ping_t;
 type zabbix_tmp_t;
}

allow ping_t zabbix_tmp_t:file read_file_perms;
allow ping_t zabbix_t:tcp_socket { read write };

kernel_read_network_state(zabbix_agent_t)
domain_read_all_domains_state(zabbix_agent_t)
dev_read_sysfs(zabbix_agent_t)

Just to add that zabbix_agent_t also need network access when using the 	net.tcp.service zabbix item (network port check), so I modified the previous .te like this : 

policy_module(zabbix-fix, 1.0)

require{
 type zabbix_agent_t;
 type zabbix_t;
 type ping_t;
 type zabbix_tmp_t;
}

allow ping_t zabbix_tmp_t:file read_file_perms;
allow ping_t zabbix_t:tcp_socket { read write };

kernel_read_network_state(zabbix_agent_t)
domain_read_all_domains_state(zabbix_agent_t)
dev_read_sysfs(zabbix_agent_t)
corenet_tcp_connect_all_ports(zabbix_agent_t)

I still have the below errors.
/usr/lib/zabbix/externalscripts is a default path of Zabbix's official RPM.

type=AVC msg=audit(1387044005.378:268): avc:  denied  { search } for  pid=1989 comm="zabbix_server" name="/" dev="dm-9" ino=2 scontext=unconfined_u:system_r:zabbix_t:s0 tcontext=system_u:object_r:home_root_t:s0 tclass=dir
type=AVC msg=audit(1387044119.822:292): avc:  denied  { execute } for  pid=3876 comm="sh" name="sendmail.postfix" dev="dm-0" ino=12139 scontext=unconfined_u:system_r:zabbix_agent_t:s0 tcontext=system_u:object_r:sendmail_exec_t:s0 tclass=file
type=AVC msg=audit(1387045941.87:391): avc:  denied  { execute_no_trans } for pid=6774 comm="sh" path="/usr/lib/zabbix/externalscripts/ssl-cert-check.sh" dev="dm-0" ino=24391 scontext=unconfined_u:system_r:zabbix_t:s0 tcontext=system_u:object_r:lib_t:s0 tclass=file
type=AVC msg=audit(1387045941.131:392): avc:  denied  { getattr } for  pid=6788 comm="which" path="/bin/mailx" dev="dm-0" ino=39097 scontext=unconfined_u:system_r:zabbix_t:s0 tcontext=system_u:object_r:sendmail_exec_t:s0 tclass=file

Where "official" is what zabbix.com ships. They are not following packaging guidelines.

Are all these AVC msgs caused by these scripts?

/usr/lib/zabbix/externalscripts

Note: Fedora zabbix and epel6 zabbix20 point to /var/lib/zabbix/externalscripts

I've seen the conf/zabbix_server.conf in the latest source code. There is no indicated value for ExternalScripts. I think the added value into Zabbix SIA's RPM (zabbix-server-2.2.1-1.el6.x86_64.rpm), /usr/lib/externalscripts is not good. That means this would be Zabbix SIA's RPM issue, not selinux-policy.

sendmail_exec_t:file { getattr } was called from /usr/lib/zabbix/externalscripts/ssl-cert-check.sh. Please ignore it.

home_root_t:dir { search } and sendmail_exec_t:file { execute } are not related to /usr/lib/zabbix/externalscripts. The occurrence times are different from /usr/lib/externlscripts one.

Well, they are using a pseudo-placeholder there, but it's commented out:

# ExternalScripts=${datadir}/zabbix/externalscripts

However, server and proxy use a hardcoded

CONFIG_EXTERNALSCRIPTS = zbx_strdup(CONFIG_EXTERNALSCRIPTS, DATADIR "/zabbix/externalscripts");

The Fedora/EPEL packages have the same hard-coded values, but override them in the configuration files. As you already concluded, this is not a SELinux issue.

*** Bug 1059979 has been marked as a duplicate of this bug. ***

We need to back port

https://github.com/selinux-policy/selinux-policy/commit/292def232e596b16cb239c9dcfca3b495e1a2439

https://github.com/selinux-policy/selinux-policy/commit/d67527f304a03a777cac6c226da6cd8d5ba738b4

back ported.

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2014-1568.html