Zabbix on Centos/RHEL 6.5 : Fixing SELinux Errors

One of my Openshift Origin servers have lots of these messages in the /var/log/messages :

Sep 28 22:15:20 broker setroubleshoot: SELinux is preventing /usr/sbin/zabbix_agentd from read access on the file cmdline. For complete SELinux messages. run sealert -l 4dbe6e60-5c4e-47cb-9b7d-040260fc38e0
Sep 28 22:15:20 broker setroubleshoot: SELinux is preventing /usr/sbin/zabbix_agentd from read access on the file cmdline. For complete SELinux messages. run sealert -l 2d781069-0e24-45b6-a949-e978e6671c1a
Sep 28 22:15:20 broker setroubleshoot: SELinux is preventing /usr/sbin/zabbix_agentd from read access on the file cmdline. For complete SELinux messages. run sealert -l 2d781069-0e24-45b6-a949-e978e6671c1a
Sep 28 22:15:20 broker setroubleshoot: SELinux is preventing /usr/sbin/zabbix_agentd from read access on the file cmdline. For complete SELinux messages. run sealert -l 2d781069-0e24-45b6-a949-e978e6671c1a
Sep 28 22:15:20 broker setroubleshoot: SELinux is preventing /usr/sbin/zabbix_agentd from read access on the file cmdline. For complete SELinux messages. run sealert -l 2d781069-0e24-45b6-a949-e978e6671c1a

The errors are somewhat related to ZBX-7537 bug report. Anyway, following the links there takes us to Red Hat BZ 1032691 - [selinux policy] Zabbix agent monitoring access denied. The cure is to create a selinux module fixing these errors, lets call it zabbix-fix. You may call it something else but beware that the module name inside the TE file must match with the TE filename and PP filename.
zabbix-fix.te 

policy_module(zabbix-fix, 1.0)

require{
 type zabbix_agent_t;
 type zabbix_t;
 type ping_t;
 type zabbix_tmp_t;
}

allow ping_t zabbix_tmp_t:file read_file_perms;
allow ping_t zabbix_t:tcp_socket { read write };

kernel_read_network_state(zabbix_agent_t)
domain_read_all_domains_state(zabbix_agent_t)
dev_read_sysfs(zabbix_agent_t)
corenet_tcp_connect_all_ports(zabbix_agent_t)

Create the file zabbix-fix.te with above contents, compile the module and install it. 
make -f /usr/share/selinux/devel/Makefile zabbix-fix.pp
semodule -i zabbix-fix.pp
After the module was installed, the errors no longer shows in /var/log/messages.

Summary

We need to install a custom SELinux policy module to enable Zabbix on RHEL/CentOS 6.5 servers.

Comments

Post a Comment

Popular posts from this blog

Long running process in Linux using PHP

Background To do stuff, I usually create web-based applications written in PHP. Sometimes we need to run something that takes a long time, far longer than the 10 second psychological limit for web pages. A bit of googling in stack overflow found us this  http://stackoverflow.com/questions/2212635/best-way-to-manage-long-running-php-script , but I will tell the similar story with a different solution. One of the long running tasks that need to be run is a Pentaho data integration transformation. Difficulties in long running PHP scripts I encountered some problems when trying to make PHP do long running tasks : PHP script timeout. This could be solved by running set_time_limit(0); before the long running tasks. Memory leaks. The framework I normally use have a bit of memory issues, this can be solved either by patching the framework (ok, it is a bit difficult to do, but I did something similar in the past ) or splitting the data to process into several batches. And if ...
Read more

Copying Big Oracle tables Using Apache Spark

Background Sometimes we need to copy table data from one database to another. Logically the best way to do this is to do database specific export (expdp in oracle lingo) and import in the destination database (impdp in oracle). But sometimes there are deficiencies in this method such as unable to do parallel process for single table, and requirements of DBA access in the database. This post shows how to do table copy using Apache Spark and Apache Zeppelin. Preparations In order to allow Apache Spark access to oracle jdbc connections, we need to add dependency to ojdbc6.jar. To do this, write this paragraph in Zeppelin : %dep z.reset() z.load("/path/to/ojdbc6.jar") Basic Approach The most basic approach to copy table data is to retrieve data in one query and save the  resulting records in the target database. val tableNameSrc = "TABLENAME" val tableNameTrg = "TABLENAME" import java.util.Properties Class.forName("ora...
Read more

Repair Your Windows Store and Metro Apps After Windows Update

Background Sometimes after updating  Windows 10, the Windows Modern UI / Metro Apps no longer works.  You could try starting any of them, such as Calculator, Photo, or Microsoft Store - and after opening a  blank window it will just close. This has happened several times, twice in my wife's laptop, and once in our home Desktop PC. This post will try to give few options to solve this problem. But I still don't know what caused it. Step 1. Assess condition of installed VCLib Packages Open up Powershell by pressing Windows Key and typing Powershell. Click Run as administrator if it is shown (if not, right click on the Powershell icon first). Type : Get-AppxPackage Microsoft*VC* | Select InstallLocation The result will be the location where VCLibs packages were installed. We concern only the VCLibs 140 version without UWPDesktop in the package names.  Try to check the files of the installed VCLibs packages (we need to do this twice, once for the x86 a...
Read more