Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Anyone have experience using 3ware's SNMP library under SELINUX? I get the following error:

snmpget -v 2c -c pub hostname TW-RAID-MIB::twRaidUnitStatus.1
Error in packet
Reason: noCreation (That table does not support row creation or that object can not ever be created)
Failed object: TW-RAID-MIB::twRaidUnitStatus.1

If disable selinux and restart snmpd, the snmpget works fine.

I've taken the following steps, none of which fixes the problem:

  • yum update net-snmp
  • yum update selinux-policy
  • /sbin/restorecon -R -v /etc/snmp /var/net-snmp /usr/share/snmp /dev/twa*
share|improve this question
    
What's in /var/log/audit/audit.log? –  Mark Wagner Apr 4 '11 at 23:20

1 Answer 1

The following policy allows net-snmp + 3ware snmp to work with selinux. Not an ideal solution as it allows snmpd access to all files of type device_t and var_t. It really just needs access to /dev/twa*, /var/net-snmp, /usr/share/snmp and some misc. libraries and config files. If anyone can make a better policy I'd like to see it.

policy_module(snmp, 1.0)

require {
  type snmpd_exec_t;
  type snmpd_t;
  type device_t;
  type var_t;
}

allow snmpd_t device_t : file rw_file_perms;
allow snmpd_t device_t : chr_file rw_file_perms;
allow snmpd_t device_t : dir rw_dir_perms;
allow snmpd_t var_t : file rw_file_perms;
allow snmpd_t var_t : file create_file_perms;
allow snmpd_t var_t : dir rw_dir_perms;
allow snmpd_t var_t : lnk_file { getattr read write create };
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.