Description of problem: I'm using the nagios check_file_age_plugin to read the last modified time of /var/lib/puppet/state/state.yaml (our way of monitoring puppet with nagios). I'm receiving the following AVC: type=AVC msg=audit(1266096490.251:126): avc: denied { getattr } for pid=6318 comm="check_file_age" path="/var/lib/puppet/state/state.yaml" dev=xvda1 ino=75377 scontext=system_u:system_r:nagios_system_plugin_t:s0 tcontext=system_u:object_r:var_lib_t:s0 tclass=file type=SYSCALL msg=audit(1266096490.251:126): arch=c000003e syscall=4 success=yes exit=0 a0=25bf7b8 a1=2461130 a2=2461130 a3=100 items=0 ppid=6317 pid=6318 auid=4294967295 uid=499 gid=492 euid=499 suid=499 fsuid=499 egid=492 sgid=492 fsgid=492 tty=(none) ses=4294967295 comm="check_file_age" exe="/usr/bin/perl" subj=system_u:system_r:nagios_system_plugin_t:s0 key=(null)
I think you will need to add local policy module for this. If all your script is doing is getting the attributes of the file, you can just # grep nagios_system_plugin_t /var/log/audit/audit.log | audit2allow -M mynagios # semodule -i mynagios.pp nagios_system_plugin_t is a permissive domain so nothing is blocked.
Hi Dan, Ok, I can add it to my local policy. I just though, after reading Miroslav's blog post, that you guys might be interested in these AVC's. Shall I go on reporting them? In this case maybe we need a separate type for check_file_age plugin.
Yes, that sounds good, is this a standard plugin? We might want to build a type that can getattr on any file on the disk. files_getattr_all_dirs files_getattr_all_files files_getattr_all_symlinks files_getattr_all_pipes files_getattr_all_sockets files_getattr_all_file_type_fs dev_getattr_all_chr_files dev_getattr_all_blk_files
That would be great! It's a standard plugin, nagios-plugins-file_age
Fixed in selinux-policy-3.6.32-91.fc12
selinux-policy-3.6.32-92.fc12 has been submitted as an update for Fedora 12. http://admin.fedoraproject.org/updates/selinux-policy-3.6.32-92.fc12
selinux-policy-3.6.32-92.fc12 has been pushed to the Fedora 12 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with su -c 'yum --enablerepo=updates-testing update selinux-policy'. You can provide feedback for this update here: http://admin.fedoraproject.org/updates/F12/FEDORA-2010-2953
selinux-policy-3.6.32-92.fc12 has been pushed to the Fedora 12 stable repository. If problems still persist, please make note of it in this bug report.