I have a Centos 7 server running Nagios Core 4.3.4 with Apache 2.4.6 in our UAT environment. I have a second server in PROD that was set up with the same Ansible playbook. Nagios was built from source. The UAT server gives the message Error: Could not stat() command file '/usr/local/nagios/var/rw/nagios.cmd'!
when trying to use Nagios commands, but the PROD server does not. All of the config listings I give below are identical between the UAT and PROD servers.
I've confirmed the error is caused by SELinux: here is the output from my audit log:
type=AVC msg=audit(1525250190.011:1114376): avc: denied { getattr } for pid=12182 comm="cmd.cgi" path="/usr/local/nagios/var/rw/nagios.cmd" dev="dm-0" ino=201456984 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:httpd_sys_rw_content_t:s0 tclass=fifo_file
And here are some relevant directory listings:
$ ls -Z /usr/local/nagios/var
drwxrwxr-x. nagios nagios unconfined_u:object_r:usr_t:s0 archives
-rw-r--r--. nagios users system_u:object_r:usr_t:s0 nagios.configtest
-rw-r--r--. nagios nagios system_u:object_r:usr_t:s0 nagios.log
-rw-r--r--. nagios nagios system_u:object_r:usr_t:s0 objects.cache
-rw-r--r--. nagios nagios system_u:object_r:usr_t:s0 objects.precache
-rw-------. nagios nagios system_u:object_r:usr_t:s0 retention.dat
drwxrwsr-x. nagios nagcmd unconfined_u:object_r:httpd_sys_rw_content_t:s0 rw
drwxr-xr-x. root root unconfined_u:object_r:usr_t:s0 spool
-rw-rw-r--. nagios nagios system_u:object_r:usr_t:s0 status.dat
$ ls -Z /usr/local/nagios/var/rw
prw-rw----. nagios nagcmd system_u:object_r:httpd_sys_rw_content_t:s0 nagios.cmd
srw-rw----. nagios nagcmd system_u:object_r:httpd_sys_rw_content_t:s0 nagios.qh
The contents of the rw
directory get deleted and recreated when the Nagios service is stopped and started. All the info I've seen says to apply the httpd_sys_rw_content_t
type to the directory and that should work. It does on the PROD server but not the UAT server. From what I understand this next command should confirm that it should work:
$ sudo sesearch --allow --source httpd_t --target httpd_sys_rw_content_t --class file
Found 6 semantic av rules:
allow httpd_t httpd_content_type : file { ioctl read getattr lock open } ;
allow httpd_t httpd_sys_rw_content_t : file { ioctl read write create getattr setattr lock append unlink link rename open } ;
allow httpd_t httpd_sys_rw_content_t : file { ioctl read write create getattr setattr lock append unlink link rename open } ;
allow httpd_t httpdcontent : file { ioctl read write create getattr setattr lock append unlink link rename open } ;
allow httpd_t httpdcontent : file { read getattr execute open } ;
allow httpd_t httpd_content_type : file { ioctl read getattr lock open } ;