Description of problem: 

After upgrading to RHEL 7.8, the Nagios plugin check_mailq will not run from nrpe because SELinux blocks it.

type=AVC msg=audit(1587620658.856:26339): avc:  denied  { execute } for  pid=18269 comm="check_mailq" path="/usr/bin/perl" dev="dm-0" ino=16815427 scontext=system_u:system_r:nagios_mail_plugin_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=file permissive=0

check_mailq is provided by nagios-plugins-mailq-2.3.1-3.el7.x86_64. 

The script check_mailq is a Perl script.

# rpm -ql nagios-plugins-mailq
/usr/lib64/nagios/plugins/check_mailq

# file /usr/lib64/nagios/plugins/check_mailq
/usr/lib64/nagios/plugins/check_mailq: Perl script, ASCII text executable

It has the SELinux label "system_u:object_r:nagios_mail_plugin_exec_t:s0". This means it can transition to nagios_mail_plugin_t, but that type can no longer run binaries like Perl.


Version-Release number of selected component (if applicable):

selinux-policy-targeted-3.13.1-266.el7.noarch
selinux-policy-3.13.1-266.el7.noarch


How reproducible:

Always.

Steps to Reproduce:
1. On a rhel7.8 host, install nrpe daemon and nagios-plugins-mailq.
2. Define a service check like this: "command[check_mailq]=/usr/lib64/nagios/plugins/check_mailq -w 5 -c 10". Restart nrpe.
3. On a remote host allowed to connect to nrpe, run: /usr/lib64/nagios/plugins/check_nrpe -H <hostname> -c check_mailq

Actual results:

check_nrpe produces this output:
NRPE: Unable to read output

And in the audit logs on the destination host:

type=AVC msg=audit(1587683845.782:436753): avc:  denied  { execute } for  pid=36997 comm="check_mailq" path="/usr/bin/perl" dev="dm-0" ino=16815427 scontext=system_u:system_r:nagios_mail_plugin_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=file permissive=0

Expected results:
The check_nrpe command should produce output like this:

OK: sendmail mailq is empty|unsent=0;5;10;0


Additional info:

audit2allow suggests generating a module like this:

# cat mailq.te 

module mailq 1.0;

require {
	type nagios_mail_plugin_t;
	type bin_t;
	class file execute;
}

#============= nagios_mail_plugin_t ==============

#!!!! WARNING: 'bin_t' is a base type.
allow nagios_mail_plugin_t bin_t:file execute;

Installing this allows check_nrpe to run check_mailq again. But the system administrator must install this on every host.