Bug 749311
| Summary: | targeted selinux policy breaks nagios checks and event handlers | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 6 | Reporter: | Thomas Wiest <twiest> | ||||
| Component: | selinux-policy | Assignee: | Miroslav Grepl <mgrepl> | ||||
| Status: | CLOSED ERRATA | QA Contact: | Michal Trunecka <mtruneck> | ||||
| Severity: | high | Docs Contact: | |||||
| Priority: | unspecified | ||||||
| Version: | 6.1 | CC: | dwalsh, ebenes, ksrot, mmalik, mmcgrath, mtruneck | ||||
| Target Milestone: | rc | ||||||
| Target Release: | --- | ||||||
| Hardware: | All | ||||||
| OS: | Linux | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | selinux-policy-3.7.19-138.el6 | Doc Type: | Bug Fix | ||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2012-06-20 12:28:20 UTC | Type: | --- | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Attachments: |
|
||||||
Ok, the problem is event handlers are not supported. Where are your handlers located? In the /usr/lib64/nagios/plugins/eventhandlers/ directory? I will need to add a support for this and create a new domain for event handlers which could do everything. Probaly add a boolean as we have it for ABRT. We've temporarily worked around the above denials, but we're now also getting this:
type=AVC msg=audit(1320087999.042:1062601): avc: denied { getattr } for pid=18245 comm="handle_hard_eve" path="/us
r/lib64/nagios/plugins/check_by_ssh" dev=xvde1 ino=271688 scontext=unconfined_u:system_r:nagios_services_plugin_t:s0
tcontext=system_u:object_r:nagios_unconfined_plugin_exec_t:s0 tclass=file
(In reply to comment #2) > Where are your handlers located? We put them in /usr/lib64/nagios/plugins/ however, the proper directory is /usr/lib64/nagios/plugins/eventhandlers/ (we just screwed up awhile ago and haven't bothered fixing it). If we need to, I will put our event handlers in the proper dir. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHBA-2012-0780.html |
Created attachment 530339 [details] Log of selinux denied errors for nagios Description of problem: Since we updated selinux-policy and selinux-policy-targetd, our nagios event handlers haven't be able to execute to fix problems. We rely heavily on our event handlers to fix problems when they arise, so this has impacted our team significantly. Looking into the problem further, it seems that a lot of our nagios checks were being denied as well. Attached is a grep of the selinux denied errors that we're seeing from just today. Version-Release number of selected component (if applicable): selinux-policy-3.7.19-113.el6.noarch selinux-policy-targeted-3.7.19-113.el6.noarch How reproducible: Very. Steps to Reproduce: 1. Setup nagios 2. Setup a service with an event handler 3. Make the service fail and notice that nagios says it's running the event handler, but notice that the event handler never actually executes. Actual results: Event handlers don't execute Expected results: Event handlers should be able to execute.