Bug 1121235
| Summary: | SELinux is preventing /usr/sbin/zabbix_agentd from 'getattr' accesses on the file . | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Paulo Fessel <pfessel> |
| Component: | selinux-policy | Assignee: | Miroslav Grepl <mgrepl> |
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 20 | CC: | dominick.grift, dwalsh, lvrabec, mgrepl |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Unspecified | ||
| Whiteboard: | abrt_hash:7af64c43b246bfe8e4bd73ef9a0a4126d96f9c12a576e8fe0c446ab70962f977 | ||
| Fixed In Version: | selinux-policy-3.12.1-179.fc20 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2014-07-26 16:00:02 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
https://github.com/selinux-policy/selinux-policy/commit/4b5a7d34e18eaf5491769787023e38bdf9b6248c commit 4b5a7d34e18eaf5491769787023e38bdf9b6248c Author: Miroslav Grepl <mgrepl> Date: Mon Jul 21 12:00:31 2014 +0200 Allow zabbix domains to access /proc//net/dev. selinux-policy-3.12.1-179.fc20 has been submitted as an update for Fedora 20. https://admin.fedoraproject.org/updates/selinux-policy-3.12.1-179.fc20 Package selinux-policy-3.12.1-179.fc20: * should fix your issue, * was pushed to the Fedora 20 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing selinux-policy-3.12.1-179.fc20' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2014-8830/selinux-policy-3.12.1-179.fc20 then log in and leave karma (feedback). selinux-policy-3.12.1-179.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report. |
Description of problem: After setting up zabbix-agent from fc20 repositories I've got this error message. SELinux is preventing /usr/sbin/zabbix_agentd from 'getattr' accesses on the file . ***** Plugin catchall (100. confidence) suggests ************************** If você acredita que o zabbix_agentd deva ser permitido acesso de getattr em file por default. Then você precisa reportar este como um erro. Você pode gerar um módulo de política local para permitir este acesso. Do permitir este acesso agora executando: # grep zabbix_agentd /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context system_u:system_r:zabbix_agent_t:s0 Target Context system_u:object_r:proc_net_t:s0 Target Objects [ file ] Source zabbix_agentd Source Path /usr/sbin/zabbix_agentd Port <Unknown> Host (removed) Source RPM Packages zabbix-agent-2.0.12-3.fc20.x86_64 Target RPM Packages Policy RPM selinux-policy-3.12.1-176.fc20.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Permissive Host Name (removed) Platform Linux (removed) 3.15.5-200.fc20.x86_64 #1 SMP Mon Jul 14 15:40:08 UTC 2014 x86_64 x86_64 Alert Count 21 First Seen 2014-07-18 13:38:27 BRT Last Seen 2014-07-18 14:27:13 BRT Local ID 27a0ec44-12c7-4d7f-a484-b3b872644af3 Raw Audit Messages type=AVC msg=audit(1405704433.641:4863): avc: denied { getattr } for pid=17924 comm="zabbix_agentd" path="/proc/17924/net/dev" dev="proc" ino=4026531975 scontext=system_u:system_r:zabbix_agent_t:s0 tcontext=system_u:object_r:proc_net_t:s0 tclass=file type=SYSCALL msg=audit(1405704433.641:4863): arch=x86_64 syscall=fstat success=yes exit=0 a0=7 a1=7fffc3892060 a2=7fffc3892060 a3=0 items=0 ppid=17920 pid=17924 auid=4294967295 uid=977 gid=972 euid=977 suid=977 fsuid=977 egid=972 sgid=972 fsgid=972 tty=(none) ses=4294967295 comm=zabbix_agentd exe=/usr/sbin/zabbix_agentd subj=system_u:system_r:zabbix_agent_t:s0 key=(null) Hash: zabbix_agentd,zabbix_agent_t,proc_net_t,file,getattr Additional info: reporter: libreport-2.2.2 hashmarkername: setroubleshoot kernel: 3.15.5-200.fc20.x86_64 type: libreport