Bug 1651248
| Summary: | pam_systemd timeout when nrpe runs sudo | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Rik Theys <rik.theys> |
| Component: | selinux-policy | Assignee: | Lukas Vrabec <lvrabec> |
| Status: | CLOSED DUPLICATE | QA Contact: | Milos Malik <mmalik> |
| Severity: | low | Docs Contact: | |
| Priority: | low | ||
| Version: | 7.6 | CC: | lvrabec, mgrepl, mmalik, plautrba, redhat, ssekidde, vladimir-csp, vmojzis, zpytela |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2018-12-16 21:09:49 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
*** This bug has been marked as a duplicate of bug 1653309 *** |
Description of problem: NRPE runs commands using sudo to monitor our server health. After upgrading to 7.6, the following error is logged and the nrpe commands time out: Nov 19 14:39:34 tamar sudo: pam_systemd(sudo:session): Failed to create session: Connection timed out This seems to be caused by a missing selinux permission. Version-Release number of selected component (if applicable): selinux-policy-targeted-3.13.1-229.el7.noarch selinux-policy-3.13.1-229.el7.noarch How reproducible: always Steps to Reproduce: 1. Configure nrpe to run a command under sudo, and trigger the check 2. 3. Actual results: nrpe check times out and the following message is logged: Nov 19 14:49:44 tamar.esat.kuleuven.be sudo[323848]: nrpe : TTY=unknown ; PWD=/ ; USER=root ; COMMAND=/usr/bin/ipmitool sdr type Power Supply Nov 19 14:50:09 tamar.esat.kuleuven.be sudo[323848]: pam_systemd(sudo:session): Failed to create session: Connection timed out Nov 19 14:50:09 tamar.esat.kuleuven.be sudo[323848]: pam_unix(sudo:session): session opened for user root by (uid=0) Nov 19 14:50:10 tamar.esat.kuleuven.be sudo[323848]: pam_unix(sudo:session): session closed for user root Expected results: No error and no timeout. Additional info: I was able to fix this issue by create an selinux policy module with the following settings: module dbus2nrpe 1.0; require { type systemd_logind_t; type nagios_unconfined_plugin_t; class dbus send_msg; } #============= systemd_logind_t ============== allow systemd_logind_t nagios_unconfined_plugin_t:dbus send_msg;