Bug 1750821

Reproduces with 

selinux-policy-3.14.1-61.el8
nagios-plugins-nrpe-3.2.1-9.el8
device-mapper-multipath-0.7.8-7.el8_0.2
upstream nagios check-multipath 0.4.7

as well

+++ This bug was initially created as a clone of Bug #1745999 +++

Description of problem:

Even after RHBA-2019:2127 release nagios nrpe checks using sudo still fails with AVCs.


Version-Release number of selected component (if applicable):

selinux-policy-3.13.1-252.el7.1
nagios-plugins-nrpe-3.2.1-8.el7
device-mapper-multipath-0.4.9-127.el7
upstream nagios check-multipath 0.4.7

How reproducible:

Always

Steps to Reproduce:
1. Install nrpe, nagios, nagios-plugins-nrpe, device-mapper-multipath, upstream check-multipath to /usr/local/bin

2. configure

command[check_multipath]=/usr/local/bin/check_multipath -m 4 -o 8 -n ok -g "-XPMEL-,2,4:-XPECC-,2,4:-XPHA-,4,8:"

line in /etc/nagios/nrpe.cfg

3. allow sudo:

# cat /etc/sudoers.d/nagios 
Defaults:NAGIOS	!requiretty
User_Alias	NAGIOS = nagios, nrpe
NAGIOS		ALL=(root) 	NOPASSWD: /sbin/multipath -l

4. cd /lib64/nagios/plugins/

5. setsebool -NP nagios_run_sudo true

6. systemctl start nagios.service

7. systemctl start nrpe.service

8. ./check_nrpe -H 127.0.0.1 -c check_multipath

Actual results:

ERROR: Command failed, 'sudo' not configured for command: '/usr/sbin/multipath -l'? |Host: |


Expected results:

e.g.:

OK<br/>No LUN found or no multipath driver.<br/>


Additional info:

Workaround via `ausearch -c 'multipath' | audit2allow -M my-multipath`, `ausearch -c 'sudo' | audit2allow -M my-sudo` gives:

# cat my-multipath.te 

module my-multipath 1.0;

require {
	type lvm_control_t;
	type nrpe_t;
	type lvm_metadata_t;
	type sysctl_fs_t;
	class file { getattr open read };
	class dir search;
	class chr_file { getattr ioctl open read write };
}

#============= nrpe_t ==============
allow nrpe_t lvm_control_t:chr_file { getattr ioctl open read write };
allow nrpe_t lvm_metadata_t:dir search;
allow nrpe_t sysctl_fs_t:dir search;
allow nrpe_t sysctl_fs_t:file { getattr open read };

# cat my-sudo.te 

module my-sudo 1.0;

require {
	type nrpe_t;
	type initrc_var_run_t;
	class file { lock open read };
}

#============= nrpe_t ==============
allow nrpe_t initrc_var_run_t:file { lock open read };