Bug 1121235 - SELinux is preventing /usr/sbin/zabbix_agentd from 'getattr' accesses on the file .
Summary: SELinux is preventing /usr/sbin/zabbix_agentd from 'getattr' accesses on the ...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 20
Hardware: x86_64
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Miroslav Grepl
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: abrt_hash:7af64c43b246bfe8e4bd73ef9a0...
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2014-07-18 17:29 UTC by Paulo Fessel
Modified: 2014-07-26 16:00 UTC (History)
4 users (show)

Fixed In Version: selinux-policy-3.12.1-179.fc20
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2014-07-26 16:00:02 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Paulo Fessel 2014-07-18 17:29:27 UTC
Description of problem:
After setting up zabbix-agent from fc20 repositories I've got this error message.
SELinux is preventing /usr/sbin/zabbix_agentd from 'getattr' accesses on the file .

*****  Plugin catchall (100. confidence) suggests   **************************

If você acredita que o zabbix_agentd deva ser permitido acesso de getattr em  file  por default.
Then você precisa reportar este como um erro.
Você pode gerar um módulo de política local para permitir este acesso.
Do
permitir este acesso agora executando:
# grep zabbix_agentd /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                system_u:system_r:zabbix_agent_t:s0
Target Context                system_u:object_r:proc_net_t:s0
Target Objects                 [ file ]
Source                        zabbix_agentd
Source Path                   /usr/sbin/zabbix_agentd
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           zabbix-agent-2.0.12-3.fc20.x86_64
Target RPM Packages           
Policy RPM                    selinux-policy-3.12.1-176.fc20.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Permissive
Host Name                     (removed)
Platform                      Linux (removed) 3.15.5-200.fc20.x86_64 #1 SMP Mon
                              Jul 14 15:40:08 UTC 2014 x86_64 x86_64
Alert Count                   21
First Seen                    2014-07-18 13:38:27 BRT
Last Seen                     2014-07-18 14:27:13 BRT
Local ID                      27a0ec44-12c7-4d7f-a484-b3b872644af3

Raw Audit Messages
type=AVC msg=audit(1405704433.641:4863): avc:  denied  { getattr } for  pid=17924 comm="zabbix_agentd" path="/proc/17924/net/dev" dev="proc" ino=4026531975 scontext=system_u:system_r:zabbix_agent_t:s0 tcontext=system_u:object_r:proc_net_t:s0 tclass=file


type=SYSCALL msg=audit(1405704433.641:4863): arch=x86_64 syscall=fstat success=yes exit=0 a0=7 a1=7fffc3892060 a2=7fffc3892060 a3=0 items=0 ppid=17920 pid=17924 auid=4294967295 uid=977 gid=972 euid=977 suid=977 fsuid=977 egid=972 sgid=972 fsgid=972 tty=(none) ses=4294967295 comm=zabbix_agentd exe=/usr/sbin/zabbix_agentd subj=system_u:system_r:zabbix_agent_t:s0 key=(null)

Hash: zabbix_agentd,zabbix_agent_t,proc_net_t,file,getattr

Additional info:
reporter:       libreport-2.2.2
hashmarkername: setroubleshoot
kernel:         3.15.5-200.fc20.x86_64
type:           libreport

Comment 1 Miroslav Grepl 2014-07-21 10:02:47 UTC
https://github.com/selinux-policy/selinux-policy/commit/4b5a7d34e18eaf5491769787023e38bdf9b6248c

commit 4b5a7d34e18eaf5491769787023e38bdf9b6248c
Author: Miroslav Grepl <mgrepl>
Date:   Mon Jul 21 12:00:31 2014 +0200

    Allow zabbix domains to access /proc//net/dev.

Comment 2 Fedora Update System 2014-07-24 08:47:43 UTC
selinux-policy-3.12.1-179.fc20 has been submitted as an update for Fedora 20.
https://admin.fedoraproject.org/updates/selinux-policy-3.12.1-179.fc20

Comment 3 Fedora Update System 2014-07-25 10:06:37 UTC
Package selinux-policy-3.12.1-179.fc20:
* should fix your issue,
* was pushed to the Fedora 20 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing selinux-policy-3.12.1-179.fc20'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2014-8830/selinux-policy-3.12.1-179.fc20
then log in and leave karma (feedback).

Comment 4 Fedora Update System 2014-07-26 16:00:02 UTC
selinux-policy-3.12.1-179.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.