How to create an SELinux exception for individual files

Question

I use a monitoring tool and on one of my systems that is checked remotely, it calls up a script, which in turn runs systemctl to check the status of a service. This was not working until I put SELinux in permissive mode. However I will not be able to leave this system in permissive mode. I need to use semanage for the exception and place the system back into an enforcing state. I have used semanage before for a process but never for a file. I have been looking over the man page and googling around but I can't seem to figure out the exact command I need to use. So say I need to allow a script called "run_this_script" in the /usr/lib64/application/plugin folder, what is the command I would use with semanage?

EDIT - just to give more context around what I was seeing in the audit logs, here is a snippet.

type=AVC msg=audit(1446051455.169:3313): avc:  denied  { execute }   for  pid=15388 comm="check_init_serv" name="systemctl" dev="dm-1"  ino=2101040 scontext=system_u:system_r:nrpe_t:s0  tcontext=system_u:object_r:systemd_systemctl_exec_t:s0 tclass=file
type=SYSCALL msg=audit(1446051455.169:3313): arch=c000003e  syscall=59 success=no exit=-13 a0=2098450 a1=209ba50 a2=209c680    a3=7fff573ff5b0 items=0 ppid=15386 pid=15388 auid=4294967295 uid=997    gid=995 euid=997 suid=997 fsuid=997 egid=995 sgid=995 fsgid=995 tty=   (none) ses=4294967295 comm="check_init_serv" exe="/usr/bin/bash"   subj=system_u:system_r:nrpe_t:s0 key=(null)

type=AVC msg=audit(1446051455.169:3314): avc:  denied  { getattr }   for  pid=15388 comm="check_init_serv" path="/usr/bin/systemctl"   dev="dm-1" ino=2101040 scontext=system_u:system_r:nrpe_t:s0    tcontext=system_u:object_r:systemd_systemctl_exec_t:s0 tclass=file
type=SYSCALL msg=audit(1446051455.169:3314): arch=c000003e     syscall=4 success=no exit=-13 a0=2098450 a1=7fff573ff780     a2=7fff573ff780 a3=7fff573ff5b0 items=0 ppid=15386 pid=15388     auid=4294967295 uid=997 gid=995 euid=997 suid=997 fsuid=997 egid=995     sgid=995 fsgid=995 tty=(none) ses=4294967295 comm="check_init_serv"     exe="/usr/bin/bash" subj=system_u:system_r:nrpe_t:s0 key=(null)

type=AVC msg=audit(1446051455.169:3315): avc:  denied  { getattr }     for  pid=15388 comm="check_init_serv" path="/usr/bin/systemctl"    dev="dm-1" ino=2101040 scontext=system_u:system_r:nrpe_t:s0     tcontext=system_u:object_r:systemd_systemctl_exec_t:s0 tclass=file
type=SYSCALL msg=audit(1446051455.169:3315): arch=c000003e   syscall=4 success=no exit=-13 a0=2098450 a1=7fff573ff760   a2=7fff573ff760 a3=7fff573ff5b0 items=0 ppid=15386 pid=15388   auid=4294967295 uid=997 gid=995 euid=997 suid=997 fsuid=997 egid=995   sgid=995 fsgid=995 tty=(none) ses=4294967295 comm="check_init_serv"   exe="/usr/bin/bash" subj=system_u:system_r:nrpe_t:s0 key=(null)

type=AVC msg=audit(1446053257.457:3401): avc:  denied  { read } for     pid=15647 comm="systemctl" name="journal" dev="tmpfs" ino=11584    scontext=system_u:system_r:nrpe_t:s0   tcontext=system_u:object_r:syslogd_var_run_t:s0 tclass=dir

Answer 1

Didn't test, but..

find the name you need with audit2allow -a, and then run

• Activate the policy package: semodule -i <module_name>.pp
• verify the module loaded: semanage module -l | grep <module_name>
• then go back to enforcing: setenforce 1

Answer 2

I see you are using NRPE, the Nagios remote plugin executor. The correct way of doing this is to invoke NRPE through sudo and telling SELinux that NRPE is allowed to call sudo.

Make sure you allow the nrpe user in sudo config, e.g. by doing:

» cat /etc/sudoers.d/nrpe
Defaults:nrpe !requiretty
nrpe ALL = (root) NOPASSWD: /sbin/service <whatever> status

Define the check, replace my_service with the actual service name:

» cat /etc/nrpe.d/nrpe_custom_checks.cfg
command[check_my_service]=/usr/lib64/nagios/plugins/check_service_status_sudo my_service

This will be your check script:

0» cat /usr/lib64/nagios/plugins/check_service_status_sudo
#!/usr/bin/env bash

# Don't use -e, since we expect commands to fail
set -uo pipefail

OK=0
WARN=1
CRIT=2
UNKNOWN=3
STATE=${UNKNOWN}
MSG=""

if [[ $# -ne 1 ]]; then
    echo "UNKNOWN - $0 needs one argument. Aborting."
    exit ${UNKNOWN}
fi

SERVICENAME="$1"

OUTPUT=$(/usr/bin/sudo /sbin/service ${SERVICENAME} status 2>&1)
ES=$?

if [[ $ES -eq 0 ]]; then
    STATE=${OK}
    MSG="OK"
elif [[ $ES -eq 1 ]]; then
    # either not running or unrecognized service
    if echo "${OUTPUT}" | grep -q "unrecognized service"; then
        STATE=${WARN}
        MSG="WARNING"
    else
        STATE=${CRIT}
        MSG="CRITICAL"
    fi
fi

echo "${MSG} - ${OUTPUT}";
exit ${STATE}

You might need to set this SELinux boolean for your use-case:

» setsebool -P nagios_run_sudo on