Re: snmpd not working well with selinux?

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]



On Wed, 2012-05-30 at 12:55 -0400, Daniel J Walsh wrote:
> On 05/30/2012 11:58 AM, John Horne wrote:
> > On Wed, 2012-05-30 at 16:52 +0100, John Horne wrote:
> >> 
> >> I am trying to use SNMP on a CentOS 6.2 server, and am using the 
> >> 'pass_persist' configuration command:
> >> 
> > Sorry, I should have added that nothing appears to be logged in
> > /var/log/audit/audit.log when snmpd fails to return any values. Nor is
> > anything about this logged in /var/log/messages by the snmpd daemon.
> > 

> > 
> Turn off dontaudit rules
> 
> 
> #semodule -DB
> 
> Then run the command
> 
> #semdule -B
> 
> Will turn them back on.
>
Hello,

Many thanks for this. I understood that snmpd was under the control of
SELinux, but didn't know about the 'dontaudit' rules.

The 'snmp-iostat' program, which snmpd/pass_persist calls, reads data
from a temporary file. The relevant data is then output back to snmpd.
The temporary file is created via a root cronjob. (I'm not happy with
this, but at the moment haven't thought of another way to do it.) The
file is written into '/var/run/net-snmp'.

When running snmpd again (via 'service') I got the following logged in
audit.log:

=================================================
type=AVC msg=audit(1338397396.982:718378): avc:  denied  { read } for
pid=3854 comm="snmp-iostat" name="snmp-iostat" dev=dm-0 ino=524175
scontext=unconfined_u:system_r:snmpd_t:s0
tcontext=unconfined_u:object_r:var_run_t:s0 tclass=file
type=SYSCALL msg=audit(1338397396.982:718378): arch=c000003e syscall=2
success=no exit=-13 a0=938ce0 a1=0 a2=1b6 a3=31bf71dba0 items=0
ppid=27824 pid=3854 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0
sgid=0 fsgid=0 tty=(none) ses=3870 comm="snmp-iostat"
exe="/usr/bin/perl" subj=unconfined_u:system_r:snmpd_t:s0 key=(null)
=================================================

So it seems that the problem is that 'snmp-iostat' (with the snmpd_t
context) does not have read access to the temporary file in
'/var/run/net-snmp'.
If I change everything to use /tmp instead of '/var/run/net-snmp', I get
the same error logged.
If I change it again to use '/etc/snmp' as the location for the
temporary file, then it works. Since this holds the SNMP config files,
snmpd would, of course, require read access to the directory.

So, using '/etc/snmp' to hold a temporary data file works, but again I'm
not happy with that as a solution! :-)

Is there any (reasonably) secure location where snmpd will have read
access, and that I could use for holding a temporary file?





John.

-- 
John Horne                   Tel: +44 (0)1752 587287
Plymouth University, UK      Fax: +44 (0)1752 587001
_______________________________________________
CentOS mailing list
CentOS@xxxxxxxxxx
http://lists.centos.org/mailman/listinfo/centos


[Index of Archives]     [CentOS]     [CentOS Announce]     [CentOS Development]     [CentOS ARM Devel]     [CentOS Docs]     [CentOS Virtualization]     [Carrier Grade Linux]     [Linux Media]     [Asterisk]     [DCCP]     [Netdev]     [Xorg]     [Linux USB]
  Powered by Linux