Red Hat Bugzilla – Bug 1504826
SELinux is preventing nrpe_t from accessing nfs_t
Last modified: 2018-04-10 08:45:39 EDT
Description of problem: ================= Commands running with a context of nrpe_t are unable to access nfs shares: SELinux is preventing df from read access on the directory <customer directory>. ***** Plugin catchall (100. confidence) suggests ************************** If you believe that df should be allowed read access on the <customer directory> directory by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'df' --raw | audit2allow -M my-df # semodule -i my-df.pp Additional Information: Source Context system_u:system_r:nrpe_t:s0 Target Context system_u:object_r:nfs_t:s0 Target Objects <customer directory> [ dir ] Source df Source Path df Port <Unknown> Host <Unknown> Source RPM Packages Target RPM Packages Policy RPM selinux-policy-3.13.1-166.el7_4.4.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name r74.example.com Platform Linux r74.example.com 3.10.0-693.el7.x86_64 #1 SMP Thu Jul 6 19:56:57 EDT 2017 x86_64 x86_64 Alert Count 1 First Seen 2017-10-09 10:34:54 EDT Last Seen 2017-10-09 10:34:54 EDT Local ID 408d59ba-9a37-4d56-90bd-3374e76fb12e Raw Audit Messages type=AVC msg=audit(1507559694.203:28842): avc: denied { read } for pid=16514 comm=df name=<customer directory> dev=0:53 ino=10133099161602582 scontext=system_u:system_r:nrpe_t:s0 tcontext=system_u:object_r:nfs_t:s0 tclass=dir Hash: df,nrpe_t,nfs_t,dir,read -------------------------------------------------------------------------------- SELinux is preventing bash from getattr access on the directory <customer directory>. ***** Plugin catchall (100. confidence) suggests ************************** If you believe that bash should be allowed getattr access on the <customer directory> directory by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'bash' --raw | audit2allow -M my-bash # semodule -i my-bash.pp Additional Information: Source Context system_u:system_r:nrpe_t:s0 Target Context system_u:object_r:nfs_t:s0 Target Objects <customer directory> [ dir ] Source bash Source Path bash Port <Unknown> Host <Unknown> Source RPM Packages Target RPM Packages Policy RPM selinux-policy-3.13.1-166.el7_4.4.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name r74.example.com Platform Linux r74.example.com 3.10.0-693.el7.x86_64 #1 SMP Thu Jul 6 19:56:57 EDT 2017 x86_64 x86_64 Alert Count 1 First Seen 2017-10-09 10:44:54 EDT Last Seen 2017-10-09 10:44:54 EDT Local ID 75358116-3732-4c64-8a9f-1fb514ffda96 Raw Audit Messages type=AVC msg=audit(1507560294.515:28866): avc: denied { getattr } for pid=18076 comm=bash path=<customer directory> dev=0:53 ino=83879543059790439 scontext=system_u:system_r:nrpe_t:s0 tcontext=system_u:object_r:nfs_t:s0 tclass=dir Hash: bash,nrpe_t,nfs_t,dir,getattr ================= Version-Release number of selected component (if applicable): selinux-policy-3.13.1-166.el7_4.4.noarch
Looks like we need new boolean here, where nrpe domain could access nfs.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2018:0763