Bug 1468431 - Zabbix agent fails to start due to being unable to disable coredumps
Zabbix agent fails to start due to being unable to disable coredumps
Status: ON_QA
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: selinux-policy (Show other bugs)
x86_64 Linux
unspecified Severity medium
: rc
: ---
Assigned To: Lukas Vrabec
Milos Malik
Depends On:
  Show dependency treegraph
Reported: 2017-07-07 01:11 EDT by Mark Keir
Modified: 2018-06-14 14:57 EDT (History)
6 users (show)

See Also:
Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
Last Closed:
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Bugzilla 1323518 None CLOSED Zabbix agent fails to start due to being unable to disable coredumps 2018-07-12 23:19 EDT

  None (edit)
Description Mark Keir 2017-07-07 01:11:31 EDT
Description of problem:
Zabbix agent starts, then exits.  The log captured is:

27385:20170707:011506.471 using configuration file: /etc/zabbix/zabbix_agentd.conf
 27385:20170707:011506.471 cannot set resource limit: [13] Permission denied
 27385:20170707:011506.471 cannot disable core dump, exiting...

Version-Release number of selected component (if applicable):
rpm -qa 'selinux*'

How reproducible:
Always, when selinux is enforcing.  Applicable to RHEL7.3.

Steps to Reproduce:
1. Install zabbix-agent-3.2.2-1.el7.x86_64.
2. Ensure selinux is enabled
3. systemctl start zabbix-agent

Actual results:
Fails to start

Expected results:
Service starts

Additional info:
Reported as fixed in https://bugzilla.redhat.com/show_bug.cgi?id=1323518
Workaround https://lvrabec-selinux.rhcloud.com/2016/09/19/creating-local-module-quickly-in-cil/
Comment 2 Milos Malik 2017-07-10 05:15:29 EDT
# rpm -qa selinux\*
# sesearch -s zabbix_agent_t -A -C -p setrlimit

# sesearch -s zabbix_agent_t -D -C -p setrlimit


It's neither fixed nor dontaudit-ed in the latest policy for RHEL-7.3.

Note You need to log in before you can comment on or make changes to this bug.