Bug 720572

I have just installed zabbix-server-pgsql, with the server configured to access PostgreSQL on the unix socket, which happens to be in /tmp

srwxrwxrwx. 1 postgres postgres 0 Jul 12 00:55 .s.PGSQL.5432

Running in permissive mode: I am flooded with the following AVCs (which may not have anything to do with the PostgreSQL socket--I just mention it as many people may not have it configg'd that way.):


#============= zabbix_t ==============
#!!!! The source type 'zabbix_t' can write to a 'dir' of the following types:
# zabbix_log_t, var_run_t, var_log_t, zabbix_var_run_t, root_t

allow zabbix_t tmp_t:dir { write add_name };
#!!!! The source type 'zabbix_t' can write to a 'file' of the following types:
# zabbix_log_t, zabbix_var_run_t, root_t

allow zabbix_t tmp_t:file { write create open };

audit2allow -R

#============= zabbix_t ==============
#!!!! The source type 'zabbix_t' can write to a 'dir' of the following types:
# zabbix_log_t, var_run_t, var_log_t, zabbix_var_run_t, root_t


This takes quite the custom audit2allow policy to work:

[root@chicago ~]# cat fixzabbix.te

module fixzabbix 1.0;

require {
        type snmpd_var_lib_t;
        type tmp_t;
        type ping_exec_t;
        type zabbix_t;
        type usr_t;
        type shell_exec_t;
        type proc_t;
        type tmpfs_t;
        type bin_t;
        class process signal;
        class capability net_raw;
        class file { execute read create execute_no_trans write getattr unlink open };
        class rawip_socket { write read create setopt };
        class lnk_file read;
        class shm { write unix_read unix_write read destroy create };
        class dir { write remove_name getattr search add_name };
}

#============= zabbix_t ==============
allow zabbix_t bin_t:lnk_file read;
allow zabbix_t ping_exec_t:file { read execute open execute_no_trans };
allow zabbix_t proc_t:file { read getattr open };
allow zabbix_t self:capability net_raw;
allow zabbix_t self:process signal;
allow zabbix_t self:rawip_socket { write read create setopt };
allow zabbix_t self:shm { write unix_read unix_write read destroy create };
allow zabbix_t shell_exec_t:file { read execute open getattr execute_no_trans };
allow zabbix_t snmpd_var_lib_t:dir { getattr search };
#!!!! The source type 'zabbix_t' can write to a 'dir' of the following types:
# zabbix_log_t, var_run_t, var_log_t, zabbix_var_run_t, root_t

allow zabbix_t tmp_t:dir { write remove_name add_name };
#!!!! The source type 'zabbix_t' can write to a 'file' of the following types:
# zabbix_log_t, zabbix_var_run_t, root_t

allow zabbix_t tmp_t:file { write getattr read create unlink open };
allow zabbix_t tmpfs_t:file { read write };
allow zabbix_t usr_t:file { read getattr open };

allow zabbix_t tmp_t:dir { write add_name };
#!!!! The source type 'zabbix_t' can write to a 'file' of the following types:
# zabbix_log_t, zabbix_var_run_t, root_t

allow zabbix_t tmp_t:file { write create open };