Bug 636305
| Summary: | SELinux prevents Nagios from killing long-running plugins | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Ben Webb <benmwebb> |
| Component: | selinux-policy-targeted | Assignee: | Miroslav Grepl <mgrepl> |
| Status: | CLOSED ERRATA | QA Contact: | Ben Levenson <benl> |
| Severity: | medium | Docs Contact: | |
| Priority: | low | ||
| Version: | 13 | ||
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | selinux-policy-3.7.19-62.fc13 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2010-10-05 09:35:39 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Actually there are two AVCs each time - forgot the second one (sigkill) in my initial posting:
Sep 21 01:46:27 HOST kernel: type=1400 audit(1285058787.199:24456): avc: denied { signal } for pid=5110 comm="nrpe" scontext=system_u:system_r:nrpe_t:s0 tcontext=system_u:system_r:nagios_checkdisk_plugin_t:s0 tclass=process
Sep 21 01:46:27 HOST kernel: type=1400 audit(1285058787.199:24457): avc: denied { sigkill } for pid=5110 comm="nrpe" scontext=system_u:system_r:nrpe_t:s0 tcontext=system_u:system_r:nagios_checkdisk_plugin_t:s0 tclass=process
Add
allow nrpe_t, nagios_$1_plugin_t:process { signal sigkill };
to nagios_plugin_template.
Fixed in selinux-policy-3.7.19-61.fc13 selinux-policy-3.7.19-62.fc13 has been submitted as an update for Fedora 13. https://admin.fedoraproject.org/updates/selinux-policy-3.7.19-62.fc13 selinux-policy-3.7.19-62.fc13 has been pushed to the Fedora 13 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with su -c 'yum --enablerepo=updates-testing update selinux-policy'. You can provide feedback for this update here: https://admin.fedoraproject.org/updates/selinux-policy-3.7.19-62.fc13 selinux-policy-3.7.19-62.fc13 has been pushed to the Fedora 13 stable repository. If problems still persist, please make note of it in this bug report. |
Description of problem: Nagios and its companion NRPE daemon run various plugins (external binaries) to check system state. If the plugins hang or take too long to finish, Nagios or NRPE sends a SIGKILL to the plugin and notes that that particular check failed. SELinux seems to be preventing this timeout from working correctly, by preventing the SIGKILL signal from being delivered. On my system, I have NRPE set up to check mounted disks using the nagios-plugins-disk package. But if an NFS server goes down, the check of the corresponding mount hangs, and I see the following avc: Sep 21 01:46:27 HOST kernel: type=1400 audit(1285058787.246:125): avc: denied { signal } for pid=15330 comm="nrpe" scontext=system_u:system_r:nrpe_t:s0 tcontext=system_u:system_r:nagios_checkdisk_plugin_t:s0 tclass=process Since in principle the plugins can be executed by either Nagios or NRPE, and any plugin can fail, presumably policy needs to allow both nagios_t and nrpe_t to send the SIGKILL signal to all nagios_*_plugin_t. Maybe you already have suitable policy for Nagios and/or other plugins (I don't check disks via Nagios so haven't seen a similar avc here), but it does not appear to be in place for NRPE and the check_disk plugin at least. Version-Release number of selected component (if applicable): selinux-policy-targeted-3.7.19-54.fc13.noarch nrpe-2.12-13.fc13.x86_64 nagios-plugins-disk-1.4.15-1.fc13.x86_64 How reproducible: Always. Steps to Reproduce: 1. Install nrpe and nagios-plugins-disk and set up a check for disk mounts. This would involve an /etc/nagios/nrpe.cfg that contains something like the following: allowed_hosts=127.0.0.1 command_timeout=5 command[check_alldisks]=/usr/lib64/nagios/plugins/check_disk --stat-remote-fs -e -x gvfs-fuse-daemon -x nfsd 2. Start the NRPE daemon. 3. Arrange for an NFS mount to hang (e.g. mount it with 'hard' and pull the network cable). 4. Execute the check, e.g. by installing nagios-plugins-nrpe and running something like /usr/lib64/nagios/plugins/check_nrpe -H localhost -c check_alldisks Actual results: After the 5 second timeout is reached, the following AVC is seen: Sep 21 01:46:27 HOST kernel: type=1400 audit(1285058787.246:125): avc: denied { signal } for pid=15330 comm="nrpe" scontext=system_u:system_r:nrpe_t:s0 tcontext=system_u:system_r:nagios_checkdisk_plugin_t:s0 tclass=process Expected results: No AVC.