Description of problem: With SELinux in enforcing mode, the unbound-munin plugins don't work out of the box. Version-Release number of selected component (if applicable): 1.4.16-2.el6 How reproducible: Always Steps to Reproduce: 1. Have selinux in enforcing mode 2. install unbound-munin and start munin-node 3. try to get the unbound stats Actual results: No stats Expected results: stats are collected Additional info: To fix it, one can manually change the type of /usr/share/munin/plugins/unbound to munin_system_plugin_exec_t, and allow munin_system_plugin_exec_t to read the unbound config file: allow munin_system_plugin_t named_conf_t:file { read ioctl open getattr }; It would be nice if either unbound-munin supplied this, or it would be included in the default policy.
Created attachment 620201 [details] unbound-munin.te
Created attachment 620206 [details] unbound-munin.fc
Dan, can you update selinux-policy for this?
Miroslav shouldn't the default label on /usr/share/munin/plugins be munin_plugin_exec_t?
Thanks for the patch. I added it to RHEL6/F18/F17. Basically there should not be munin_exec_t labeling. If yes then this is a bug. We could consider to add this new type/domain for plugins which don't have correct labeling.