Bug 1398721 - Selinux policy update block zabbix agent
Selinux policy update block zabbix agent
Status: CLOSED DUPLICATE of bug 1393332
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: selinux-policy (Show other bugs)
7.3
Unspecified Unspecified
unspecified Severity unspecified
: rc
: ---
Assigned To: Lukas Vrabec
BaseOS QE Security Team
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2016-11-25 11:46 EST by Fabian Arrotin
Modified: 2016-12-09 10:06 EST (History)
7 users (show)

See Also:
Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2016-11-28 04:24:04 EST
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Fabian Arrotin 2016-11-25 11:46:47 EST
Description of problem:

Since the update to selinux-policy-3.13.1-102.el7.noarch, trying to restart zabbix-agent fails as it's blocked by selinux : 

type=AVC msg=audit(1480001303.440:2626): avc:  denied  { setrlimit } for  pid=22682 comm="zabbix_agentd" scontext=system_u:system_r:zabbix_agent_t:s0 tcontext=system_u:system_r:zabbix_agent_t:s0 tclass=process

Version-Release number of selected component (if applicable):
selinux-policy-3.13.1-102.el7.noarch


Steps to Reproduce:
1. have a system running el7.2 and running zabbix-agent
2. update to el7.3 and reboot
3. zabbix-agent doesn't start

Actual results:
zabbix-agent fails to start

Expected results:
zabbix-agent able to start as before

Additional info:

Following .te (to build a custom .pp) allows zabbix-agent to start as before, while keeping selinux in enforcing mode  

require {
	type zabbix_agent_t;
	class process setrlimit;
}

#============= zabbix_agent_t ==============
allow zabbix_agent_t self:process setrlimit;

More information about a similar bug that happened for zabbix-server and reported to zabbix bug report (by someone else) : https://support.zabbix.com/browse/ZBX-10542
Comment 2 Milos Malik 2016-11-27 08:11:24 EST
I believe that this bug is duplicate of BZ#1393332.
Comment 3 Lukas Vrabec 2016-11-28 04:24:04 EST

*** This bug has been marked as a duplicate of bug 1393332 ***

Note You need to log in before you can comment on or make changes to this bug.