This issue was not selected to be included in Red Hat Enterprise Linux 7 because it is seen either as low or moderate impact to a small number of use-cases. Current minor release will be in Maintenance Support 1 Phase, which means that qualified Critical and Important Security errata advisories (RHSAs) and Urgent Priority Bug Fix errata advisories (RHBAs) may be released as they become available.

We will now close this issue, but if you believe that it qualifies for the Maintenance Support 1 Phase, please re-open; otherwise, we recommend moving the request to Red Hat Enterprise Linux 8 if applicable.

(In reply to Lukas Vrabec from comment #2)
> 
> We will now close this issue, but if you believe that it qualifies for the
> Maintenance Support 1 Phase, please re-open; otherwise, we recommend moving
> the request to Red Hat Enterprise Linux 8 if applicable.

I do. This is a regression. It's also a recent one. And it affects a popular software. If RHEL 7 is in maintenance phase then it should be extra stable and we shouldn't expect existing systems to just break when updated.

Pierre, 

Please open customer case for this issue or let's move this bugzilla ticket to RHEL-8 and I'll provide workaround for this issue. 

1. 
$ cat > nagios_execute_bin.cil << EOF
(allow nagios_mail_plugin_t bin_t (file (execute execute_no_trans getattr ioctl lock map open read)))
EOF

2. 
# semodule -i nagios_execute_bin.cil

Thanks,
Lukas.

Alright, I'll open a case. Moving to RHEL 8 for our systems isn't quite in the cards yet. Unfortunately the surrounding ecosystem hasn't shown up as quickly for RHEL 8 as it did for RHEL 7.

*** Bug 1827444 has been marked as a duplicate of this bug. ***

I just hit this issue updating to nagios-plugins-mailq-2.3.3-2.el7.x86_64

Lukas Vrabec's fix worked for me

I too ran into this issue.

I agree with Pierre Ossman. Please, don't provide updates to EL7 that break something, and then say, sorry what we broke doesn't seem important enough to fix.

*** Bug 1840367 has been marked as a duplicate of this bug. ***

An alternative fix I found in bugzilla 1210380 is to specify the MTA in the command with '-M' switch e.g.

command[check_mailq]=/usr/lib64/nagios/plugins/check_mailq -w 5 -c 10 -M postfix

(In reply to IanB from comment #28)
> An alternative fix I found in bugzilla 1210380 is to specify the MTA in the
> command with '-M' switch e.g.
> 
> command[check_mailq]=/usr/lib64/nagios/plugins/check_mailq -w 5 -c 10 -M
> postfix

No, I don't think that fixes it. That's exactly how i have my check_mailq plugin setup, and I still had the problem. Changing the SELinux policy was the only fix that worked.

What's the fix to rollback besides the semodule install?  Downgrading selinux-policy and selinux-policy-targeted to the previous versions that were working and rebooting does not seem to get rid of the problem.  I was hoping that skipping this version of the pkgs on the rest of my systems would avoid this issue.  BTW, I'm also seeing the same problem with the check_file_age nagios plugin.

Hi, 
Being affected by the problem and considering the "verified" status, I would like to know if we can hope for a release in the next few days/weeks or if we have to implement the WA on our servers? 

Dorian.

Dorian,

RHEL 7.9 is expected to go GA later this quarter.

For a custom selinux policy, see c#4 or use

corecmd_exec_bin(nagios_plugin_domain)

(In reply to J Man from comment #30)
> What's the fix to rollback besides the semodule install?  Downgrading
> selinux-policy and selinux-policy-targeted to the previous versions that
> were working and rebooting does not seem to get rid of the problem.  I was
> hoping that skipping this version of the pkgs on the rest of my systems
> would avoid this issue.  BTW, I'm also seeing the same problem with the
> check_file_age nagios plugin.
Justin,

This problem is a result of a fix in kernel for https://access.redhat.com/security/cve/CVE-2019-11190

With the updated selinux-policy package, the permission will be granted for all domains in the nagios_plugin_domain attribute:

# seinfo -xanagios_plugin_domain
   nagios_plugin_domain
      nagios_admin_plugin_t
      nagios_checkdisk_plugin_t
      nagios_mail_plugin_t
      nagios_services_plugin_t
      nagios_system_plugin_t
      nagios_unconfined_plugin_t
      nagios_eventhandler_plugin_t
      nagios_openshift_plugin_t

which should cover check_file_age, too:

# matchpathcon /usr/lib/nagios/plugins/check_file_age
/usr/lib/nagios/plugins/check_file_age  system_u:object_r:nagios_admin_plugin_exec_t:s0

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (selinux-policy bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2020:3925