SELinux and Nagios

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hi,

I observe two related AVC in Fedora 20 (although to be fair, Fedora 19 also had this issue):

----
time->Tue Jan  7 02:17:09 2014
type=SYSCALL msg=audit(1389061029.116:92): arch=c000003e syscall=59 success=yes exit=0 a0=2623760 a1=26237c0 a2=261fa10 a3=7fff3197ecb0 items=0 ppid=1580 pid=1581 auid=4294967295 uid=997 gid=996 euid=997 suid=997 fsuid=997 egid=996 sgid=996 fsgid=996 ses=4294967295 tty=(none) comm="check_ping" exe="/usr/lib64/nagios/plugins/check_ping" subj=system_u:system_r:nagios_services_plugin_t:s0 key=(null)
type=AVC msg=audit(1389061029.116:92): avc:  denied  { read write } for  pid=1581 comm="check_ping" path="/var/spool/nagios/checkresults/checkMLYIdJ" dev="dm-1" ino=643 scontext=system_u:system_r:nagios_services_plugin_t:s0 tcontext=system_u:object_r:nagios_spool_t:s0 tclass=file
----
time->Tue Jan  7 02:17:09 2014
type=SYSCALL msg=audit(1389061029.132:93): arch=c000003e syscall=59 success=yes exit=0 a0=7f59269e4320 a1=7f59269e4360 a2=7fff689f3020 a3=7f5924a98a10 items=0 ppid=1581 pid=1582 auid=4294967295 uid=997 gid=996 euid=997 suid=997 fsuid=997 egid=996 sgid=996 fsgid=996 ses=4294967295 tty=(none) comm="ping" exe="/usr/bin/ping" subj=system_u:system_r:ping_t:s0 key=(null)
type=AVC msg=audit(1389061029.132:93): avc:  denied  { read write } for  pid=1582 comm="ping" path="/var/spool/nagios/checkresults/checkMLYIdJ" dev="dm-1" ino=643 scontext=system_u:system_r:ping_t:s0 tcontext=system_u:object_r:nagios_spool_t:s0 tclass=file


I assume first one is deficiency of the selinux policy - plugin check_ping should be able to create work files somewhere.
If /var/spool/nagios is not a proper place, then some other location should be used, but the choice is limited:

# semanage fcontext -l|grep nagios|grep /var
/var/log/nagios(/.*)?                              all files          system_u:object_r:nagios_log_t:s0 
/var/log/netsaint(/.*)?                            all files          system_u:object_r:nagios_log_t:s0 
/var/run/nagios.*                                  all files          system_u:object_r:nagios_var_run_t:s0 
/var/spool/nagios(/.*)?                            all files          system_u:object_r:nagios_spool_t:s0 


The send one is probably some file decriptor leak, because ping utility doesn’t actually supply output to the temporary file.

Does anybody use nagios in SELinux environment? check_ping seems like a very basic plugin.

Thanks,
Vadym

Attachment: smime.p7s
Description: S/MIME cryptographic signature

--
selinux mailing list
selinux@xxxxxxxxxxxxxxxxxxxxxxx
https://admin.fedoraproject.org/mailman/listinfo/selinux

[Index of Archives]     [Fedora Users]     [Fedora Desktop]     [Big List of Linux Books]     [Yosemite News]     [Yosemite Campsites]     [KDE Users]     [Gnome Users]

  Powered by Linux