Description of problem:
Updated to 7.8, which includes selinux-policy-targeted-3.13.1-266.el7.noarch. this new selinux policy package breaks the "check_mailq" plugin for nagios/nrpe from package nagios-plugins-mailq-2.3.3-2.el7. When executing this plugin remotely via nrpe, this AVC is found in logs:


--------------------------------------------------------------------------------

SELinux is preventing /usr/bin/perl from execute access on the file /usr/bin/perl.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that perl should be allowed execute access on the perl file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'check_mailq' --raw | audit2allow -M my-checkmailq
# semodule -i my-checkmailq.pp


Additional Information:
Source Context                system_u:system_r:nagios_mail_plugin_t:s0
Target Context                system_u:object_r:bin_t:s0
Target Objects                /usr/bin/perl [ file ]
Source                        check_mailq
Source Path                   /usr/bin/perl
Port                          <Unknown>
Host                          mail1.bbky.org
Source RPM Packages           perl-5.16.3-295.el7.x86_64
Target RPM Packages           perl-5.16.3-295.el7.x86_64
Policy RPM                    selinux-policy-3.13.1-266.el7.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     mail1.bbky.org
Platform                      Linux mail1.bbky.org 3.10.0-1127.8.2.el7.x86_64 #1
                              SMP Tue May 12 16:57:42 UTC 2020 x86_64 x86_64
Alert Count                   2
First Seen                    2020-05-26 12:12:04 PDT
Last Seen                     2020-05-26 12:14:35 PDT
Local ID                      85993dba-5a4f-49e2-a10e-d03be13c3bf3

Raw Audit Messages
type=AVC msg=audit(1590520475.176:990): avc:  denied  { execute } for  pid=1832 comm="check_mailq" path="/usr/bin/perl" dev="dm-1" ino=8440107 scontext=system_u:system_r:nagios_mail_plugin_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=file permissive=0


type=SYSCALL msg=audit(1590520475.176:990): arch=x86_64 syscall=execve success=no exit=EACCES a0=9a0170 a1=9a01d0 a2=99ea80 a3=7fff005376a0 items=3 ppid=1831 pid=1832 auid=4294967295 uid=990 gid=986 euid=990 suid=990 fsuid=990 egid=986 sgid=986 fsgid=986 tty=(none) ses=4294967295 comm=check_mailq exe=/usr/bin/perl subj=system_u:system_r:nagios_mail_plugin_t:s0 key=hexadiam

type=CWD msg=audit(1590520475.176:990): cwd=/

type=PATH msg=audit(1590520475.176:990): item=0 name=/usr/lib64/nagios/plugins/check_mailq inode=8926605 dev=fd:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:nagios_mail_plugin_exec_t:s0 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0

type=PATH msg=audit(1590520475.176:990): item=1 name=/usr/bin/perl inode=8440107 dev=fd:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:bin_t:s0 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0

type=PATH msg=audit(1590520475.176:990): item=2 name=/lib64/ld-linux-x86-64.so.2 inode=12600004 dev=fd:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0

Hash: check_mailq,nagios_mail_plugin_t,bin_t,file,execute

--------------------------------------------------------------------------------


Version-Release number of selected component (if applicable):
selinux-policy-targeted-3.13.1-266.el7.noarch
nagios-plugins-mailq 2.3.3-2.el7

How reproducible: always

Steps to Reproduce:
1. update to selinux-policy-targeted-3.13.1-266.el7.noarch
2. execute check_mailq plugin via nrpe
3. check audit.log for above AVC

Actual results:
When SELinux prevents the plugin from executing, it returns:

"NRPE: Unable to read output"

Expected results:
When SELinux enforcement is disabled, the plugin returns:

"OK: postfix mailq reports queue is empty|unsent=0;10;20;0"

Additional info: