1

I have a Centos 7 server running Nagios Core 4.3.4 with Apache 2.4.6 in our UAT environment. I have a second server in PROD that was set up with the same Ansible playbook. Nagios was built from source. The UAT server gives the message Error: Could not stat() command file '/usr/local/nagios/var/rw/nagios.cmd'! when trying to use Nagios commands, but the PROD server does not. All of the config listings I give below are identical between the UAT and PROD servers.

I've confirmed the error is caused by SELinux: here is the output from my audit log:

type=AVC msg=audit(1525250190.011:1114376): avc: denied { getattr } for pid=12182 comm="cmd.cgi" path="/usr/local/nagios/var/rw/nagios.cmd" dev="dm-0" ino=201456984 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:httpd_sys_rw_content_t:s0 tclass=fifo_file

And here are some relevant directory listings:

$ ls -Z /usr/local/nagios/var
drwxrwxr-x. nagios nagios unconfined_u:object_r:usr_t:s0   archives
-rw-r--r--. nagios users  system_u:object_r:usr_t:s0       nagios.configtest
-rw-r--r--. nagios nagios system_u:object_r:usr_t:s0       nagios.log
-rw-r--r--. nagios nagios system_u:object_r:usr_t:s0       objects.cache
-rw-r--r--. nagios nagios system_u:object_r:usr_t:s0       objects.precache
-rw-------. nagios nagios system_u:object_r:usr_t:s0       retention.dat
drwxrwsr-x. nagios nagcmd unconfined_u:object_r:httpd_sys_rw_content_t:s0 rw
drwxr-xr-x. root   root   unconfined_u:object_r:usr_t:s0   spool
-rw-rw-r--. nagios nagios system_u:object_r:usr_t:s0       status.dat

$ ls -Z /usr/local/nagios/var/rw
prw-rw----. nagios nagcmd system_u:object_r:httpd_sys_rw_content_t:s0 nagios.cmd
srw-rw----. nagios nagcmd system_u:object_r:httpd_sys_rw_content_t:s0 nagios.qh

The contents of the rw directory get deleted and recreated when the Nagios service is stopped and started. All the info I've seen says to apply the httpd_sys_rw_content_t type to the directory and that should work. It does on the PROD server but not the UAT server. From what I understand this next command should confirm that it should work:

$ sudo sesearch --allow --source httpd_t --target httpd_sys_rw_content_t --class file
Found 6 semantic av rules:
   allow httpd_t httpd_content_type : file { ioctl read getattr lock open } ; 
   allow httpd_t httpd_sys_rw_content_t : file { ioctl read write create getattr setattr lock append unlink link rename open } ; 
   allow httpd_t httpd_sys_rw_content_t : file { ioctl read write create getattr setattr lock append unlink link rename open } ; 
   allow httpd_t httpdcontent : file { ioctl read write create getattr setattr lock append unlink link rename open } ; 
   allow httpd_t httpdcontent : file { read getattr execute open } ; 
   allow httpd_t httpd_content_type : file { ioctl read getattr lock open } ; 
  • Are the directory listings exactly same on both systems (exactly same security labels)? Are the same policy modules loaded on both systems? – sebasth May 3 '18 at 8:59
  • The output of 'ls -Z' is identical for the /usr/local/nagios/var/rw directory on both servers. I think the policy modules are the same but I'm not sure how to check. The caveat here is that at one point I did try and install Nagios via yum on the UAT server but gave up on it and went back to a source build. Not sure if that made policy changes that weren't removed on uninstall. – Doughnuts May 4 '18 at 1:15
1

I got it working though I'm not totally happy with my solution. I used audit2allow to create a custom policy (had to run it three times to allow all of the right permissions).

$ sudo grep nagios.cmd /var/log/audit/audit.log | tail -3 | sudo audit2allow -M httpdnagioscmd
$ sudo semodule -i httpdnagioscmd.pp

It may have had something to do with the class of the files being fifo_file instead of file but I don't know enough about SELinux to really figure out the root cause.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.