Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

After installing Nagios NRPE & Nagios Plugins, I'm getting the following entry in my rsyslog:

May 13 14:01:30 wcmisdlin02 kernel: type=1400 audit(1305309690.482:2334): avc:  denied  { getattr } for  pid=3835 comm="sh" path="/usr/bin/sudo" dev=dm-0 ino=7355981 scontext=unconfined_u:system_r:nrpe_t:s0 tcontext=system_u:object_r:sudo_exec_t:s0 tclass=file

It seems like my Nagios plugins that I'm trying to execute through NRPE are being blocked by SELinux. What should I do?

share|improve this question
    
as serverfault suggest if you down vote at least have some decency to comment! –  alexus May 13 '11 at 18:14
    
You were probably downvoted because Title is very vague (This type of problem happens on many distros, not just Scientific Linux release 6.0). Can you clean up the title and make it more descriptive? –  Stefan Lasiewski May 20 '11 at 20:44

3 Answers 3

up vote 0 down vote accepted

This should be fixed by this errata: http://rhn.redhat.com/errata/RHBA-2012-0780.html

share|improve this answer
    
there was an update from REDHAT that addressed that issue –  alexus Aug 8 '12 at 19:48

Well, first decide if you want SELinux. All EL based ones have it installed and enabled by default, but pretty much no other distro does. It gives you a bit of security, but more than a bit of headaches, so you have to weigh one way or the other whether you want it. If you don't, you can disable it in the /etc/selinux/config. The comments in the file will tell you exactly what to do.

If you want you can also try to lower it. If its currently set to enforcing you can switch it to permissive and see if it lets you run NRPE. Also you may be able to find some more walkthroughs on setting up NRPE using SELinux. Honestly I always find it to be too much of an annoyance to be worth the security. HTH

Edit: You can find a bunch of the selinux bools for nagios here: http://wiki.centos.org/TipsAndTricks/SelinuxBooleans

share|improve this answer
    
Permissive will let you run (nearly) anything –  wzzrd Jun 1 '11 at 17:17
    
@wzzrd: Setting SELinux to Permissive will cause AVC denials to be logged but not enforced (logged in /var/log/audit/audit.log if auditd is running - at least on RH derivs). So Permissive will indeed let you run anything - SELinux will not enforce policy in this mode, only log what would be denied if it were running in Enforcing mode. –  Eli Heady Jul 16 '11 at 10:44

If the nrpe_disable_trans boolean is not an option:

  1. You can follow these instructions to create your own policy to allow NRPE. Basically, this would involve running SELinux in permissive mode long enough for your Nagios server to execute all of the scheduled NRPE checks. Then, you can pipe them from the audit.log file to audit2allow. This will build the required policies for your review and inclusion.

  2. Thomas Bleher's nrpe.te file might also serve as a useful starting point or reference for building your own policy.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.