Description of problem:

NRPE runs commands using sudo to monitor our server health. After upgrading to 7.6, the following error is logged and the nrpe commands time out:

Nov 19 14:39:34 tamar sudo: pam_systemd(sudo:session): Failed to create session: Connection timed out

This seems to be caused by a missing selinux permission.


Version-Release number of selected component (if applicable):
selinux-policy-targeted-3.13.1-229.el7.noarch
selinux-policy-3.13.1-229.el7.noarch

How reproducible:
always

Steps to Reproduce:
1. Configure nrpe to run a command under sudo, and trigger the check
2.
3.

Actual results:
nrpe check times out and the following message is logged:

Nov 19 14:49:44 tamar.esat.kuleuven.be sudo[323848]:     nrpe : TTY=unknown ; PWD=/ ; USER=root ; COMMAND=/usr/bin/ipmitool sdr type Power Supply
Nov 19 14:50:09 tamar.esat.kuleuven.be sudo[323848]: pam_systemd(sudo:session): Failed to create session: Connection timed out
Nov 19 14:50:09 tamar.esat.kuleuven.be sudo[323848]: pam_unix(sudo:session): session opened for user root by (uid=0)
Nov 19 14:50:10 tamar.esat.kuleuven.be sudo[323848]: pam_unix(sudo:session): session closed for user root


Expected results:
No error and no timeout.

Additional info:

I was able to fix this issue by create an selinux policy module with the following settings:

module dbus2nrpe 1.0;

require {
        type systemd_logind_t;
        type nagios_unconfined_plugin_t;
        class dbus send_msg;
}

#============= systemd_logind_t ==============
allow systemd_logind_t nagios_unconfined_plugin_t:dbus send_msg;