Bug 1367890 - Nagios check_ping SELinux context issue
Summary: Nagios check_ping SELinux context issue
Keywords:
Status: CLOSED EOL
Alias: None
Product: Fedora EPEL
Classification: Fedora
Component: nagios-plugins
Version: el6
Hardware: Unspecified
OS: Linux
unspecified
low
Target Milestone: ---
Assignee: Stephen John Smoogen
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-08-17 17:41 UTC by John Oliver
Modified: 2017-01-23 15:15 UTC (History)
6 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2017-01-23 15:15:08 UTC
Type: Bug


Attachments (Terms of Use)

Description John Oliver 2016-08-17 17:41:16 UTC
This is on a system that isn't connected to the Internet, so i have to type all this junk, so any weirdness is probably me and not a bizarre system issue!

SELinux is preventing /usr/lib64/nagios/plugins/check_procs from getattr access on the file /usr/lib64/nagios/plugins/check_ping

Additional Information:
Source Context          unconfined_u:system_r:nagios_system_plugin_t:s0
Target Context          system_u:object_r:nagios_services_plugin_exec_t:s0
Target Objects          /usr/lib64/nagios/plugins/check_ping [file]
Source                  check_procs
Source Path             /usr/lib64/nagios/plugins/check_procs
Port                    <Unknown>
Source RPM Packages     nagios-plugins-procs-2.0.3-3.el6.x86_64
Target RPM Packages     nagios-plugins-ping-2.0.3-3.el6.x86_64
Policy RPM              selinux-policy-3.7.19-279.el6_7.9.noarch
Selinux Enabled         True
Policy Type             targeted
Enforcing Mode          Enforcing
Platform                Linux 2.6.32-504.30.3.el6.x86_64

Raw Audit Messages
type=AVC msg=audit(...): avc: denied { getattr } for pid=11594 comm="check_procs" path="/usr/lib64/nagios/plugins/check_ping" dev=dm-0 ino=1056486 scontext=unconfined_u:system_r:nagios_system_plugin_t:s0 tcontext=system_u:object_r:nagios_services_plugin_exec_t:s0 tclass=file

Comment 1 Richard D Alloway 2016-09-15 20:04:52 UTC
Hi John!

Do you have any additional details on how to replicate the bug?

I have EL6.6 installed along with the kernel and package versions that you included in the bug report:

kernel-2.6.32-504.30.3.el6.x86_64
nagios-plugins-ping-2.0.3-3.el6.x86_64
nagios-plugins-procs-2.0.3-3.el6.x86_64
selinux-policy-3.7.19-279.el6_7.9.noarch

SELinux is also configured for ‘enforcing’.

But, I am unable to duplicate the selinux issue.

Any additional info that you could provide on how to replicate this bug would be much appreciated.

Thanks!

-Rich Alloway (RogueWave)


Note You need to log in before you can comment on or make changes to this bug.