Hide Forgot
Description of problem: SE Linux silently denies the nagios check_disk plugin to check /boot when executed via the NRPE daemon. Version-Release number of selected component (if applicable): How reproducible: Always Steps to Reproduce: 1. Set up nrpe to execute the following check: command[check_boot]=/usr/lib64/nagios/plugins/check_disk -w 10% -c 5% -p /boot 2. Activate the NRPE check from other host: /usr/lib64/nagios/plugins/check_nrpe -H TESTHOST.redhat.com -c check_boot Actual results: DISK CRITICAL - /boot is not accessible: Permission denied Expected results: DISK OK - free space: /boot 167 MB (77% inode=99%);| /boot=47MB;203;214;0;226 Additional info: I had to run 'semodule -DB' to actually get any output about this in audit.log Once I did, and turned off enforcing, the following is a dump of the relevant entries: type=AVC msg=audit(1323966375.648:38669): avc: denied { getattr } for pid=27971 comm="sh" path="/root" dev=vda3 ino=372417 scontext=unconfined_u:system_r:nrpe_t:s0 tcontext=system_u:object_r:admin_home_t:s0 tclass=dir type=SYSCALL msg=audit(1323966375.648:38669): arch=c000003e syscall=4 success=yes exit=0 a0=cd4430 a1=7fff5c081440 a2=7fff5c081440 a3=3d04d250e0 items=0 ppid=27970 pid=27971 auid=0 uid=99 gid=99 euid=99 suid=99 fsuid=99 egid=99 sgid=99 fsgid=99 tty=(none) ses=20 comm="sh" exe="/bin/bash" subj=unconfined_u:system_r:nrpe_t:s0 key=(null) type=AVC msg=audit(1323966375.648:38670): avc: denied { read write } for pid=27971 comm="check_disk" path="socket:[1026787]" dev=sockfs ino=1026787 scontext=unconfined_u:system_r:nagios_checkdisk_plugin_t:s0 tcontext=unconfined_u:system_r:nrpe_t:s0 tclass=tcp_socket type=AVC msg=audit(1323966375.648:38670): avc: denied { rlimitinh } for pid=27971 comm="check_disk" scontext=unconfined_u:system_r:nrpe_t:s0 tcontext=unconfined_u:system_r:nagios_checkdisk_plugin_t:s0 tclass=process type=AVC msg=audit(1323966375.648:38670): avc: denied { siginh } for pid=27971 comm="check_disk" scontext=unconfined_u:system_r:nrpe_t:s0 tcontext=unconfined_u:system_r:nagios_checkdisk_plugin_t:s0 tclass=process type=AVC msg=audit(1323966375.648:38670): avc: denied { noatsecure } for pid=27971 comm="check_disk" scontext=unconfined_u:system_r:nrpe_t:s0 tcontext=unconfined_u:system_r:nagios_checkdisk_plugin_t:s0 tclass=process type=SYSCALL msg=audit(1323966375.648:38670): arch=c000003e syscall=59 success=yes exit=0 a0=cd9580 a1=cd95e0 a2=cd7690 a3=40 items=0 ppid=27970 pid=27971 auid=0 uid=99 gid=99 euid=99 suid=99 fsuid=99 egid=99 sgid=99 fsgid=99 tty=(none) ses=20 comm="check_disk" exe="/usr/lib64/nagios/plugins/check_disk" subj=unconfined_u:system_r:nagios_checkdisk_plugin_t:s0 key=(null) type=AVC msg=audit(1323966375.650:38671): avc: denied { getattr } for pid=27971 comm="check_disk" path="/boot" dev=vda1 ino=2 scontext=unconfined_u:system_r:nagios_checkdisk_plugin_t:s0 tcontext=system_u:object_r:boot_t:s0 tclass=dir type=SYSCALL msg=audit(1323966375.650:38671): arch=c000003e syscall=4 success=yes exit=0 a0=7fffcb59c782 a1=10c0090 a2=10c0090 a3=10 items=0 ppid=27970 pid=27971 auid=0 uid=99 gid=99 euid=99 suid=99 fsuid=99 egid=99 sgid=99 fsgid=99 tty=(none) ses=20 comm="check_disk" exe="/usr/lib64/nagios/plugins/check_disk" subj=unconfined_u:system_r:nagios_checkdisk_plugin_t:s0 key=(null)
I'm seeing similar behavior with both the Nagios check_disk and check_nagios plugins when confined by selinux-policy-targeted-3.7.19-126.el6_2.4.noarch. These plugins worked fine with RHEL6.1, and haven't changed in EPEL between 6.1 and 6.2. With the following in nrpe.cfg: command[check_nagios]=/usr/lib64/nagios/plugins/check_nagios -e 10 -F /var/log/nagios/status.dat -C /usr/sbin/nagios command[check_alldisks]=/usr/lib64/nagios/plugins/check_disk --stat-remote-fs -e -x gvfs-fuse-daemon -x nfsd -x nodev -x sysfs -x devpts -x tmpfs -x none -x sunrpc We can try the checks with something like /usr/lib64/nagios/plugins/check_nrpe -H localhost -c check_nagios /usr/lib64/nagios/plugins/check_nrpe -H localhost -c check_alldisks The check_nagios check gives the following avcs: Jan 1 11:24:17 triangle kernel: type=1400 audit(1325445857.766:443): avc: denied { search } for pid=9051 comm="check_nagios" name="log" dev=cciss!c0d0p3 ino=307 scontext=system_u:system_r:nagios_system_plugin_t:s0 tcontext=system_u:object_r:var_log_t:s0 tclass=dir Jan 1 11:24:17 triangle kernel: type=1400 audit(1325445857.848:444): avc: denied { search } for pid=9051 comm="check_nagios" name="nagios" dev=cciss!c0d0p3 ino=1136 scontext=system_u:system_r:nagios_system_plugin_t:s0 tcontext=system_u:object_r:nagios_log_t:s0 tclass=dir Jan 1 11:24:18 triangle kernel: type=1400 audit(1325445857.930:445): avc: denied { read } for pid=9051 comm="check_nagios" name="status.dat" dev=cciss!c0d0p3 ino=104 scontext=system_u:system_r:nagios_system_plugin_t:s0 tcontext=system_u:object_r:nagios_log_t:s0 tclass=file While check_disk gives the following: Jan 1 11:20:38 triangle kernel: type=1400 audit(1325445638.539:6): avc: denied { getattr } for pid=7525 comm="check_disk" name="/" dev=cciss!c0d0p1 ino=2 scontext=system_u:system_r:nagios_system_plugin_t:s0 tcontext=system_u:object_r:fs_t:s0 tclass=filesystem Jan 1 11:20:38 triangle kernel: type=1400 audit(1325445638.618:7): avc: denied { getattr } for pid=7525 comm="check_disk" name="/" dev=proc ino=1 scontext=system_u:system_r:nagios_system_plugin_t:s0 tcontext=system_u:object_r:proc_t:s0 tclass=filesystem The checks both succeed if SELinux is put into permissive mode. I have worked around these problems for the time being with chcon -t nagios_unconfined_plugin_exec_t check_nagios check_disk but it would be preferable if SELinux policy were fixed so these plugins continued to work as in 6.1.
I added fixes to Fedora and will backport.
Is there a workaround available? When is the fix expected to be included?
Yes, you can download the latest policy from http://people.redhat.com/dwalsh/SELinux/RHEL6/noarch/
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHBA-2012-0780.html