Cannot stop SELinux from blocking Apache accessing /usr/local/nagios/var/rw/nagios.cmd

Question

I have a Centos 7 server running Nagios Core 4.3.4 with Apache 2.4.6 in our UAT environment. I have a second server in PROD that was set up with the same Ansible playbook. Nagios was built from source. The UAT server gives the message Error: Could not stat() command file '/usr/local/nagios/var/rw/nagios.cmd'! when trying to use Nagios commands, but the PROD server does not. All of the config listings I give below are identical between the UAT and PROD servers.

I've confirmed the error is caused by SELinux: here is the output from my audit log:

type=AVC msg=audit(1525250190.011:1114376): avc: denied { getattr } for pid=12182 comm="cmd.cgi" path="/usr/local/nagios/var/rw/nagios.cmd" dev="dm-0" ino=201456984 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:httpd_sys_rw_content_t:s0 tclass=fifo_file

And here are some relevant directory listings:

$ ls -Z /usr/local/nagios/var
drwxrwxr-x. nagios nagios unconfined_u:object_r:usr_t:s0   archives
-rw-r--r--. nagios users  system_u:object_r:usr_t:s0       nagios.configtest
-rw-r--r--. nagios nagios system_u:object_r:usr_t:s0       nagios.log
-rw-r--r--. nagios nagios system_u:object_r:usr_t:s0       objects.cache
-rw-r--r--. nagios nagios system_u:object_r:usr_t:s0       objects.precache
-rw-------. nagios nagios system_u:object_r:usr_t:s0       retention.dat
drwxrwsr-x. nagios nagcmd unconfined_u:object_r:httpd_sys_rw_content_t:s0 rw
drwxr-xr-x. root   root   unconfined_u:object_r:usr_t:s0   spool
-rw-rw-r--. nagios nagios system_u:object_r:usr_t:s0       status.dat

$ ls -Z /usr/local/nagios/var/rw
prw-rw----. nagios nagcmd system_u:object_r:httpd_sys_rw_content_t:s0 nagios.cmd
srw-rw----. nagios nagcmd system_u:object_r:httpd_sys_rw_content_t:s0 nagios.qh

The contents of the rw directory get deleted and recreated when the Nagios service is stopped and started. All the info I've seen says to apply the httpd_sys_rw_content_t type to the directory and that should work. It does on the PROD server but not the UAT server. From what I understand this next command should confirm that it should work:

$ sudo sesearch --allow --source httpd_t --target httpd_sys_rw_content_t --class file
Found 6 semantic av rules:
   allow httpd_t httpd_content_type : file { ioctl read getattr lock open } ; 
   allow httpd_t httpd_sys_rw_content_t : file { ioctl read write create getattr setattr lock append unlink link rename open } ; 
   allow httpd_t httpd_sys_rw_content_t : file { ioctl read write create getattr setattr lock append unlink link rename open } ; 
   allow httpd_t httpdcontent : file { ioctl read write create getattr setattr lock append unlink link rename open } ; 
   allow httpd_t httpdcontent : file { read getattr execute open } ; 
   allow httpd_t httpd_content_type : file { ioctl read getattr lock open } ; 

Answer 1

I got it working though I'm not totally happy with my solution. I used audit2allow to create a custom policy (had to run it three times to allow all of the right permissions).

$ sudo grep nagios.cmd /var/log/audit/audit.log | tail -3 | sudo audit2allow -M httpdnagioscmd
$ sudo semodule -i httpdnagioscmd.pp

It may have had something to do with the class of the files being fifo_file instead of file but I don't know enough about SELinux to really figure out the root cause.