Bug 1824625 - Nagios/nrpe no longer allowed to check mail queue
Summary: Nagios/nrpe no longer allowed to check mail queue
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: selinux-policy
Version: 7.8
Hardware: Unspecified
OS: Linux
high
urgent
Target Milestone: rc
: ---
Assignee: Zdenek Pytela
QA Contact: Milos Malik
URL:
Whiteboard:
: 1827444 1840367 (view as bug list)
Depends On:
Blocks: 1832219
TreeView+ depends on / blocked
 
Reported: 2020-04-16 11:20 UTC by Pierre Ossman
Modified: 2020-09-29 19:55 UTC (History)
19 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
: 1832219 (view as bug list)
Environment:
Last Closed: 2020-09-29 19:55:23 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Knowledge Base (Solution) 5030621 0 None None None 2020-04-29 09:39:53 UTC
Red Hat Product Errata RHBA-2020:3925 0 None None None 2020-09-29 19:55:44 UTC

Description Pierre Ossman 2020-04-16 11:20:24 UTC
Description of problem:
Nagios can no longer monitor the mail queue on RHEL 7 systems.

Version-Release number of selected component (if applicable):
selinux-policy-3.13.1-266.el7.noarch
nrpe-3.2.1-8.el7.x86_64

How reproducible:
100% (seen on both mail servers here)

Steps to Reproduce:
1. Set up Nagios'/nrpe's check_mailq
2. Attempt to call it

Actual results:
NRPE: Unable to read output

Expected results:
OK: postfix mailq (87) is below threshold (500/1000)|unsent=87;500;1000;0

Additional info:
From audit.log:

> type=AVC msg=audit(1587035820.733:86046): avc:  denied  { execute } for  pid=25017 comm="check_mailq" path="/usr/bin/perl" dev="dm-1" ino=67592641 scontext=system_u:system_r:nagios_mail_plugin_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=file permissive=0

Started on last system update/reboot. Previous version of selinux-policy was 3.13.1-252.el7_7.6.

Comment 2 Lukas Vrabec 2020-04-16 17:14:27 UTC
This issue was not selected to be included in Red Hat Enterprise Linux 7 because it is seen either as low or moderate impact to a small number of use-cases. Current minor release will be in Maintenance Support 1 Phase, which means that qualified Critical and Important Security errata advisories (RHSAs) and Urgent Priority Bug Fix errata advisories (RHBAs) may be released as they become available.

We will now close this issue, but if you believe that it qualifies for the Maintenance Support 1 Phase, please re-open; otherwise, we recommend moving the request to Red Hat Enterprise Linux 8 if applicable.

Comment 3 Pierre Ossman 2020-04-17 06:21:08 UTC
(In reply to Lukas Vrabec from comment #2)
> 
> We will now close this issue, but if you believe that it qualifies for the
> Maintenance Support 1 Phase, please re-open; otherwise, we recommend moving
> the request to Red Hat Enterprise Linux 8 if applicable.

I do. This is a regression. It's also a recent one. And it affects a popular software. If RHEL 7 is in maintenance phase then it should be extra stable and we shouldn't expect existing systems to just break when updated.

Comment 4 Lukas Vrabec 2020-04-17 12:02:52 UTC
Pierre, 

Please open customer case for this issue or let's move this bugzilla ticket to RHEL-8 and I'll provide workaround for this issue. 

1. 
$ cat > nagios_execute_bin.cil << EOF
(allow nagios_mail_plugin_t bin_t (file (execute execute_no_trans getattr ioctl lock map open read)))
EOF

2. 
# semodule -i nagios_execute_bin.cil

Thanks,
Lukas.

Comment 5 Pierre Ossman 2020-04-17 13:53:27 UTC
Alright, I'll open a case. Moving to RHEL 8 for our systems isn't quite in the cards yet. Unfortunately the surrounding ecosystem hasn't shown up as quickly for RHEL 8 as it did for RHEL 7.

Comment 6 Lukas Vrabec 2020-04-24 10:41:17 UTC
*** Bug 1827444 has been marked as a duplicate of this bug. ***

Comment 22 IanB 2020-05-19 22:07:41 UTC
I just hit this issue updating to nagios-plugins-mailq-2.3.3-2.el7.x86_64

Lukas Vrabec's fix worked for me

Comment 25 Bond Masuda 2020-05-26 20:26:50 UTC
I too ran into this issue.

I agree with Pierre Ossman. Please, don't provide updates to EL7 that break something, and then say, sorry what we broke doesn't seem important enough to fix.

Comment 26 Zdenek Pytela 2020-05-26 21:33:14 UTC
*** Bug 1840367 has been marked as a duplicate of this bug. ***

Comment 28 IanB 2020-05-27 21:43:35 UTC
An alternative fix I found in bugzilla 1210380 is to specify the MTA in the command with '-M' switch e.g.

command[check_mailq]=/usr/lib64/nagios/plugins/check_mailq -w 5 -c 10 -M postfix

Comment 29 Bond Masuda 2020-05-27 21:45:33 UTC
(In reply to IanB from comment #28)
> An alternative fix I found in bugzilla 1210380 is to specify the MTA in the
> command with '-M' switch e.g.
> 
> command[check_mailq]=/usr/lib64/nagios/plugins/check_mailq -w 5 -c 10 -M
> postfix

No, I don't think that fixes it. That's exactly how i have my check_mailq plugin setup, and I still had the problem. Changing the SELinux policy was the only fix that worked.

Comment 30 J Man 2020-06-26 19:25:19 UTC
What's the fix to rollback besides the semodule install?  Downgrading selinux-policy and selinux-policy-targeted to the previous versions that were working and rebooting does not seem to get rid of the problem.  I was hoping that skipping this version of the pkgs on the rest of my systems would avoid this issue.  BTW, I'm also seeing the same problem with the check_file_age nagios plugin.

Comment 31 Dorian Renard 2020-08-07 09:23:52 UTC
Hi, 
Being affected by the problem and considering the "verified" status, I would like to know if we can hope for a release in the next few days/weeks or if we have to implement the WA on our servers? 

Dorian.

Comment 32 Zdenek Pytela 2020-08-07 12:22:41 UTC
Dorian,

RHEL 7.9 is expected to go GA later this quarter.

For a custom selinux policy, see c#4 or use

corecmd_exec_bin(nagios_plugin_domain)

Comment 33 Zdenek Pytela 2020-08-07 12:27:41 UTC
(In reply to J Man from comment #30)
> What's the fix to rollback besides the semodule install?  Downgrading
> selinux-policy and selinux-policy-targeted to the previous versions that
> were working and rebooting does not seem to get rid of the problem.  I was
> hoping that skipping this version of the pkgs on the rest of my systems
> would avoid this issue.  BTW, I'm also seeing the same problem with the
> check_file_age nagios plugin.
Justin,

This problem is a result of a fix in kernel for https://access.redhat.com/security/cve/CVE-2019-11190

With the updated selinux-policy package, the permission will be granted for all domains in the nagios_plugin_domain attribute:

# seinfo -xanagios_plugin_domain
   nagios_plugin_domain
      nagios_admin_plugin_t
      nagios_checkdisk_plugin_t
      nagios_mail_plugin_t
      nagios_services_plugin_t
      nagios_system_plugin_t
      nagios_unconfined_plugin_t
      nagios_eventhandler_plugin_t
      nagios_openshift_plugin_t

which should cover check_file_age, too:

# matchpathcon /usr/lib/nagios/plugins/check_file_age
/usr/lib/nagios/plugins/check_file_age  system_u:object_r:nagios_admin_plugin_exec_t:s0

Comment 35 errata-xmlrpc 2020-09-29 19:55:23 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (selinux-policy bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2020:3925


Note You need to log in before you can comment on or make changes to this bug.