4

I have a custom user parameter for Zabbix that calls a hardware RAID CLI tool (arcconf / megacli) and checks if any arrays are degraded. Since these tools are root-only, I have configured sudoers to allow the zabbix user access without password:

Defaults:zabbix !requiretty
Cmnd_Alias ZABBIX_MEGACLI_CMDS = /opt/MegaRAID/MegaCli/MegaCli64 -LDInfo -Lall -aALL
zabbix  ALL     = (ALL) NOPASSWD: ZABBIX_MEGACLI_CMDS

On CentOS 5 the zabbix_agentd ran unconfined and all was well. On CentOS 6 the agent now runs in a separate zabbix_agent_t domain. This caused problems. Initially the sudo binary itself could not be executed but I have added this policy:

sudo_exec(zabbix_agent_t)

Now it dies in a different way:

type=AVC msg=audit(1407137597.193:157): avc:  denied  { create } for  pid=3145 comm="sudo" scontext=unconfined_u:system_r:zabbix_agent_t:s0 tcontext=unconfined_u:system_r:zabbix_agent_t:s0 tclass=unix_dgram_socket
type=SYSCALL msg=audit(1407137597.193:157): arch=c000003e syscall=41 success=no exit=-13 a0=1 a1=80002 a2=0 a3=1 items=0 ppid=3121 pid=3145 auid=0 uid=496 gid=495 euid=0 suid=0 fsuid=0 egid=495 sgid=495 fsgid=495 tty=(none) ses=3 comm="sudo" exe="/usr/bin/sudo" subj=unconfined_u:system_r:zabbix_agent_t:s0 key=(null)
type=AVC msg=audit(1407137597.193:158): avc:  denied  { create } for  pid=3145 comm="sudo" scontext=unconfined_u:system_r:zabbix_agent_t:s0 tcontext=unconfined_u:system_r:zabbix_agent_t:s0 tclass=netlink_audit_socket
type=SYSCALL msg=audit(1407137597.193:158): arch=c000003e syscall=41 success=no exit=-13 a0=10 a1=3 a2=9 a3=7fffce049a20 items=0 ppid=3121 pid=3145 auid=0 uid=496 gid=495 euid=0 suid=0 fsuid=0 egid=495 sgid=495 fsgid=495 tty=(none) ses=3 comm="sudo" exe="/usr/bin/sudo" subj=unconfined_u:system_r:zabbix_agent_t:s0 key=(null)

Is this the right approach to do things? What other policies can I add so zabbix_agent_t can run sudo? If sudo works will it still be confined within zabbix_agent_t domain or should I add e.g. TYPE=unconfined_t to the sudoers line? Should I adopt https://bugzilla.redhat.com/show_bug.cgi?id=917157 and s/nrpe_t/zabbix_agent_t/?

EDIT:

Not sure if this is the best idea but...

sudo_exec(zabbix_agent_t)
domtrans_pattern(zabbix_agent_t, sudo_exec_t, unconfined_t)

seems to work. I suppose the worst case is it falls back on the security of sudo and the sudoers files.

2

1 Answer 1

9

The way to handle this is to collect all the information about what access the program needs, and then explicitly allow only that access in a custom policy module.

This is fairly easy to do.

First, you set the domain permissive, so that SELinux temporarily does not enforce its rules. It will still log the denials, and later you will use these logs.

semanage permissive -a zabbix_agent_t

Next, let the program run and let it do whatever it needs to do. The audit log will fill up with what would have been denied, and these logs also show what permissions will need to be granted. Then view these logs with ausearch.

ausearch -r -m avc -ts today

We'll generate a local policy module containing the necessary permissions. (You need to use the -r option with ausearch here so that the output can be processed by other scripts.)

If you saw clearly irrelevant entries, redirect the output to a file, and then edit it to remove them. Then use the file here instead.

ausearch -r -m avc -ts today | audit2allow -M zabbix_megacli

Finally, we install our new local policy module and re-enable SELinux enforcement.

semodule -i zabbix_megacli.pp
semanage permissive -d zabbix_agent_t
3
  • This is the correct answer. However the permissions required are write and ioctl to disk device nodes. I'm not sure this improves security meaningfully over just using sudo. As a compromise would it be better to have another executable in the middle, labeled appropriately like e.g. nagios_unconfined_plugin_exec_t here: mgrepl.fedorapeople.org/Blog/nagios.html ?
    – lmz
    Aug 4, 2014 at 17:21
  • Yeah, that's probably a better solution. But nothing of the sort has yet been implemented in the policy, as far as I know. Better have a chat with Dan Walsh, or perhaps your Red Hat rep. Aug 4, 2014 at 17:23
  • This worked for me. I believe Zabbix documentation need to be update to include this Jan 15, 2019 at 7:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .