Bug 1504074 – cannot start zabbix server because of setrlimit syscall blocked by selinux

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 1504074 - cannot start zabbix server because of setrlimit syscall blocked by selinux

Summary:	cannot start zabbix server because of setrlimit syscall blocked by selinux

Status:	CLOSED ERRATA

Aliases:	None

Product:	Red Hat Enterprise Linux 7
Classification:	Red Hat
Component:	selinux-policy (Show other bugs)
Sub Component:
Version:	7.4
Hardware:	All Linux

Priority	unspecified Severity medium
Target Milestone:	rc
Target Release:	---
Assigned To:	Lukas Vrabec
QA Contact:	Milos Malik
Docs Contact:

URL:
Whiteboard:
Keywords:

Depends On:
Blocks:
	Show dependency tree / graph

Reported:	2017-10-19 09:00 EDT by Zdenek Pytela
Modified:	2018-04-10 08:45 EDT (History)
CC List:	5 users (show)

See Also:
Fixed In Version:	selinux-policy-3.13.1-175.el7
Doc Type:	If docs needed, set a value
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:	2018-04-10 08:44:59 EDT
Type:	Bug
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Knowledge Base (Solution)	3222251	None	None	None	2017-10-23 07:58 EDT
Red Hat Product Errata	RHBA-2018:0763	None	None	None	2018-04-10 08:45 EDT

Groups: None (edit)

Description Zdenek Pytela 2017-10-19 09:00:38 EDT

Description of problem:
The zabbix server is unable to start. The setrlimit syscall is prevented by SELinux from executing.

Version-Release number of selected component (if applicable):
RHEL 7.4


How reproducible:
always

Steps to Reproduce:
1. start zabbix server

Actual results:
type=AVC msg=audit(1505788100.774:11853): avc:  denied  { setrlimit } for  pid=27418 comm="zabbix_server" scontext=system_u:system_r:zabbix_t:s0 tcontext=system_u:system_r:zabbix_t:s0 tclass=process


Expected results:
<no avc>

Additional info:
sesearch -s zabbix_t -t zabbix_t -c process -A
Found 1 semantic av rules:
   allow zabbix_t zabbix_t : process { fork sigchld sigkill sigstop signull signal getsched setsched setpgid getcap } ;

Unlike bz 1393332, this issue is regarding zabbix server and the zabbix_t domain.

Comment 11 errata-xmlrpc 2018-04-10 08:44:59 EDT

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:0763

Note You need to log in before you can comment on or make changes to this bug.