0

When SELinux is disabled, I have no issues, but when it's Enforced then I'm facing this

[systemd] failed to get d-bus session: Failed to connect to socket /run/dbus/system_bus_socket: Permission denied

Audit.log

 sealert -a /var/log/audit/audit.log
100% done
found 2 alerts in /var/log/audit/audit.log
--------------------------------------------------------------------------------

SELinux is preventing /usr/sbin/zabbix_agentd from connectto access on the unix_stream_socket /run/dbus/system_bus_socket.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that zabbix_agentd should be allowed connectto access on the system_bus_socket unix_stream_socket by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'zabbix_agentd' --raw | audit2allow -M my-zabbixagentd
# semodule -i my-zabbixagentd.pp

i created a policy as suggested above,restarted zabbix-agent, now from zabbix agent log getting

[systemd] failed to get d-bus session: An SELinux policy prevents this sender from sending this message to this recipient, 0 matched rules; type="method_call", sender="(null)" (inactive) interface="org.freedesktop.DBus" member="Hello" error name="(unset)" requested_reply="0" destination="org.freedesktop.DBus" (bus)



 sealert -a /var/log/audit/audit.log
 39% donetype=AVC msg=audit(1534885076.573:250): avc:  denied  { connectto } for  pid=10654 comm="zabbix_agentd" path="/run/dbus/system_bus_socket" scontext=system_u:system_r:zabbix_agent_t:s0 tcontext=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 tclass=unix_stream_socket

**** Invalid AVC allowed in current policy ***
3

Well, first you have to identify the denial you are getting from SELinux. The easiest (in my opinion) way to do that is via the sealert utility.

First install the setroubleshoot-server package with:

yum install setroubleshoot-server

Then run:

sealert -a /var/log/audit/audit.log

You will probably get a lot of output, look for your specific denial, and follow the recommendations. But be sure to NOT allow things that shouldn't be allowed!

Here is an exmple of a denial, and the suggested woraround from sealert (my emphasis):

SELinux is preventing /usr/libexec/postfix/qmgr from using the rlimitinh access on a process.

*****  Plugin catchall (100. confidence) suggests   **************************

you believe that qmgr should be allowed rlimitinh access on processes labeled postfix_qmgr_t by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'qmgr' --raw | audit2allow -M my-qmgr
# semodule -i my-qmgr.pp


Additional Information:
Source Context                system_u:system_r:postfix_master_t:s0
Target Context                system_u:system_r:postfix_qmgr_t:s0
Target Objects                Unknown [ process ]
Source                        qmgr
Source Path                   /usr/libexec/postfix/qmgr
Port                          
Host                          
Source RPM Packages           postfix-2.10.1-6.el7.x86_64
Target RPM Packages           
Policy RPM                    selinux-policy-3.13.1-102.el7_3.16.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     centos
Platform                      Linux centos 3.10.0-514.26.2.el7.x86_64 #1 SMP Tue
                              Jul 4 15:04:05 UTC 2017 x86_64 x86_64
Alert Count                   5
First Seen                    2018-04-18 18:02:32 CEST
Last Seen                     2018-08-22 09:11:22 CEST
Local ID                      855f168c-1e47-4c6b-8a1e-f8fddce5d426

The example above concerns Postfix, again; look for your denial, and insert a local policy.

  • audit.log shows now Invalid AVC allowed in current policy *** 90% donetype=AVC msg=audit(1534943998.829:509): avc: denied { read } for pid=7686 comm="zabbix_agentd" name="memory.stat" dev="cgroup" ino=64157 scontext=system_u:system_r:zabbix_agent_t:s0 tcontext=system_u:object_r:cgroup_t:s0 tclass=file – Milister Aug 22 '18 at 13:46
  • Yes, the Invalid AVC messages you will have to live with, I have! – maulinglawns Aug 22 '18 at 14:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.