I have a custom user parameter for Zabbix that calls a hardware RAID CLI tool (arcconf / megacli) and checks if any arrays are degraded. Since these tools are root-only, I have configured sudoers to allow the zabbix user access without password:
Defaults:zabbix !requiretty
Cmnd_Alias ZABBIX_MEGACLI_CMDS = /opt/MegaRAID/MegaCli/MegaCli64 -LDInfo -Lall -aALL
zabbix ALL = (ALL) NOPASSWD: ZABBIX_MEGACLI_CMDS
On CentOS 5 the zabbix_agentd ran unconfined and all was well. On CentOS 6 the agent now runs in a separate zabbix_agent_t domain. This caused problems. Initially the sudo binary itself could not be executed but I have added this policy:
sudo_exec(zabbix_agent_t)
Now it dies in a different way:
type=AVC msg=audit(1407137597.193:157): avc: denied { create } for pid=3145 comm="sudo" scontext=unconfined_u:system_r:zabbix_agent_t:s0 tcontext=unconfined_u:system_r:zabbix_agent_t:s0 tclass=unix_dgram_socket
type=SYSCALL msg=audit(1407137597.193:157): arch=c000003e syscall=41 success=no exit=-13 a0=1 a1=80002 a2=0 a3=1 items=0 ppid=3121 pid=3145 auid=0 uid=496 gid=495 euid=0 suid=0 fsuid=0 egid=495 sgid=495 fsgid=495 tty=(none) ses=3 comm="sudo" exe="/usr/bin/sudo" subj=unconfined_u:system_r:zabbix_agent_t:s0 key=(null)
type=AVC msg=audit(1407137597.193:158): avc: denied { create } for pid=3145 comm="sudo" scontext=unconfined_u:system_r:zabbix_agent_t:s0 tcontext=unconfined_u:system_r:zabbix_agent_t:s0 tclass=netlink_audit_socket
type=SYSCALL msg=audit(1407137597.193:158): arch=c000003e syscall=41 success=no exit=-13 a0=10 a1=3 a2=9 a3=7fffce049a20 items=0 ppid=3121 pid=3145 auid=0 uid=496 gid=495 euid=0 suid=0 fsuid=0 egid=495 sgid=495 fsgid=495 tty=(none) ses=3 comm="sudo" exe="/usr/bin/sudo" subj=unconfined_u:system_r:zabbix_agent_t:s0 key=(null)
Is this the right approach to do things? What other policies can I add so zabbix_agent_t can run sudo? If sudo works will it still be confined within zabbix_agent_t domain or should I add e.g. TYPE=unconfined_t
to the sudoers line? Should I adopt https://bugzilla.redhat.com/show_bug.cgi?id=917157 and s/nrpe_t/zabbix_agent_t/?
EDIT:
Not sure if this is the best idea but...
sudo_exec(zabbix_agent_t)
domtrans_pattern(zabbix_agent_t, sudo_exec_t, unconfined_t)
seems to work. I suppose the worst case is it falls back on the security of sudo and the sudoers files.