Summary:

SELinux is preventing /usr/lib64/nagios/plugins/check_procs access to a leaked
/var/log/nagios/spool/checkresults/check7H9vpZ file descriptor.

Detailed Description:

[check_procs has a permissive type (nagios_system_plugin_t). This access was not
denied.]

SELinux denied access requested by the check_procs command. It looks like this
is either a leaked descriptor or check_procs output was redirected to a file it
is not allowed to access. Leaks usually can be ignored since SELinux is just
closing the leak and reporting the error. The application does not use the
descriptor, so it will run properly. If this is a redirection, you will not get
output in the /var/log/nagios/spool/checkresults/check7H9vpZ. You should
generate a bugzilla on selinux-policy, and it will get routed to the appropriate
package. You can safely ignore this avc.

Allowing Access:

You can generate a local policy module to allow this access - see FAQ
(http://docs.fedoraproject.org/selinux-faq-fc5/#id2961385)

Additional Information:

Source Context                system_u:system_r:nagios_system_plugin_t:s0
Target Context                system_u:object_r:nagios_log_t:s0
Target Objects                /var/log/nagios/spool/checkresults/check7H9vpZ [
                              file ]
Source                        check_procs
Source Path                   /usr/lib64/nagios/plugins/check_procs
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           nagios-plugins-procs-1.4.13-17.fc12
Target RPM Packages           
Policy RPM                    selinux-policy-3.6.32-89.fc12
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Plugin Name                   leaks
Host Name                     (removed)
Platform                      Linux pikake.getsu.com
                              2.6.31.12-174.2.19.fc12.x86_64 #1 SMP Thu Feb 11
                              07:07:16 UTC 2010 x86_64 x86_64
Alert Count                   0
First Seen                    Fri 19 Feb 2010 11:16:37 PM HST
Last Seen                     Fri 19 Feb 2010 11:16:37 PM HST
Local ID                      43859640-56d9-4448-9cf9-7271fe082982
Line Numbers                  

Raw Audit Messages            

node=pikake.getsu.com type=AVC msg=audit(1266657397.268:26341): avc:  denied  { read write } for  pid=3040 comm="check_procs" path="/var/log/nagios/spool/checkresults/check7H9vpZ" dev=md2 ino=917755 scontext=system_u:system_r:nagios_system_plugin_t:s0 tcontext=system_u:object_r:nagios_log_t:s0 tclass=file

node=pikake.getsu.com type=SYSCALL msg=audit(1266657397.268:26341): arch=c000003e syscall=59 success=yes exit=0 a0=b2bc70 a1=b2bcd0 a2=b28050 a3=40 items=0 ppid=3039 pid=3040 auid=4294967295 uid=490 gid=472 euid=490 suid=490 fsuid=490 egid=472 sgid=472 fsgid=472 tty=(none) ses=4294967295 comm="check_procs" exe="/usr/lib64/nagios/plugins/check_procs" subj=system_u:system_r:nagios_system_plugin_t:s0 key=(null)



Hash String generated from  leaks,check_procs,nagios_system_plugin_t,nagios_log_t,file,read,write
audit2allow suggests:

#============= nagios_system_plugin_t ==============
allow nagios_system_plugin_t nagios_log_t:file { read write };