Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a custom user parameter for Zabbix that calls a hardware RAID CLI tool (arcconf / megacli) and checks if any arrays are degraded. Since these tools are root-only, I have configured sudoers to allow the zabbix user access without password:

Defaults:zabbix !requiretty
Cmnd_Alias ZABBIX_MEGACLI_CMDS = /opt/MegaRAID/MegaCli/MegaCli64 -LDInfo -Lall -aALL
zabbix  ALL     = (ALL) NOPASSWD: ZABBIX_MEGACLI_CMDS

On CentOS 5 the zabbix_agentd ran unconfined and all was well. On CentOS 6 the agent now runs in a separate zabbix_agent_t domain. This caused problems. Initially the sudo binary itself could not be executed but I have added this policy:

sudo_exec(zabbix_agent_t)

Now it dies in a different way:

type=AVC msg=audit(1407137597.193:157): avc:  denied  { create } for  pid=3145 comm="sudo" scontext=unconfined_u:system_r:zabbix_agent_t:s0 tcontext=unconfined_u:system_r:zabbix_agent_t:s0 tclass=unix_dgram_socket
type=SYSCALL msg=audit(1407137597.193:157): arch=c000003e syscall=41 success=no exit=-13 a0=1 a1=80002 a2=0 a3=1 items=0 ppid=3121 pid=3145 auid=0 uid=496 gid=495 euid=0 suid=0 fsuid=0 egid=495 sgid=495 fsgid=495 tty=(none) ses=3 comm="sudo" exe="/usr/bin/sudo" subj=unconfined_u:system_r:zabbix_agent_t:s0 key=(null)
type=AVC msg=audit(1407137597.193:158): avc:  denied  { create } for  pid=3145 comm="sudo" scontext=unconfined_u:system_r:zabbix_agent_t:s0 tcontext=unconfined_u:system_r:zabbix_agent_t:s0 tclass=netlink_audit_socket
type=SYSCALL msg=audit(1407137597.193:158): arch=c000003e syscall=41 success=no exit=-13 a0=10 a1=3 a2=9 a3=7fffce049a20 items=0 ppid=3121 pid=3145 auid=0 uid=496 gid=495 euid=0 suid=0 fsuid=0 egid=495 sgid=495 fsgid=495 tty=(none) ses=3 comm="sudo" exe="/usr/bin/sudo" subj=unconfined_u:system_r:zabbix_agent_t:s0 key=(null)

Is this the right approach to do things? What other policies can I add so zabbix_agent_t can run sudo? If sudo works will it still be confined within zabbix_agent_t domain or should I add e.g. TYPE=unconfined_t to the sudoers line? Should I adopt https://bugzilla.redhat.com/show_bug.cgi?id=917157 and s/nrpe_t/zabbix_agent_t/?

EDIT:

Not sure if this is the best idea but...

sudo_exec(zabbix_agent_t)
domtrans_pattern(zabbix_agent_t, sudo_exec_t, unconfined_t)

seems to work. I suppose the worst case is it falls back on the security of sudo and the sudoers files.

share|improve this question

1 Answer 1

up vote 3 down vote accepted

The way to handle this is to collect all the information about what access the program needs, and then explicitly allow only that access in a custom policy module.

This is fairly easy to do.

First, you set the domain permissive, so that SELinux temporarily does not enforce its rules. It will still log the denials, and later you will use these logs.

semanage permissive -a zabbix_agent_t

Next, let the program run and let it do whatever it needs to do. The audit log will fill up with what would have been denied, and these logs also show what permissions will need to be granted. Then view these logs with ausearch.

ausearch -r -m avc -ts today

We'll generate a local policy module containing the necessary permissions. (You need to use the -r option with ausearch here so that the output can be processed by other scripts.)

If you saw clearly irrelevant entries, redirect the output to a file, and then edit it to remove them. Then use the file here instead.

ausearch -r -m avc -ts today | audit2allow -M zabbix_megacli

Finally, we install our new local policy module and re-enable SELinux enforcement.

semodule -i zabbix_megacli.pp
semanage permissive -d zabbix_agent_t
share|improve this answer
    
This is the correct answer. However the permissions required are write and ioctl to disk device nodes. I'm not sure this improves security meaningfully over just using sudo. As a compromise would it be better to have another executable in the middle, labeled appropriately like e.g. nagios_unconfined_plugin_exec_t here: mgrepl.fedorapeople.org/Blog/nagios.html ? –  lmz Aug 4 at 17:21
    
Yeah, that's probably a better solution. But nothing of the sort has yet been implemented in the policy, as far as I know. Better have a chat with Dan Walsh, or perhaps your Red Hat rep. –  Michael Hampton Aug 4 at 17:23

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.