On Mon, 2020-02-10 at 21:09 -0800, Marcin Struzak wrote:
The problem turned out to be SELinux not allowing fping to write its output: type=AVC msg=audit(1581054673.192:3358): avc: denied { write } for pid=14767 comm="fping" path="/var/lib/xymon/tmp/ping-stderr.14764.00" dev="dm-9" ino=288964 scontext=system_u:system_r:ping_t:s0 tcontext=system_u:object_r:init_tmp_t:s0 tclass=file permissive=1 The rule was set as dontaudit, and I had to rebuild the policy ignoring dontaudit flags to see the denials. Before I create a local rule using audit2allow, does anyone know if it's a known issue with a fix available (from terabithia or xymon)? Thanks! --Marcin
Hi,
As far as I can see in Xymon 4.3.30 selinux is already modified by the Xymon RPM to cater for this:
=====
rpm -qf /usr/share/doc/xymon-4.3.30/xymon.te
xymon-4.3.30-1.el7.x86_64
Looking at the file shows:
===== #============= ping_t ============== allow ping_t { tmp_t initrc_tmp_t var_lib_t }:file { getattr write };
Running 4.3.30 on CentOS 7 we have had to make no changes to selinux.
John.
-- John Horne | Senior Operations Analyst | Technology and Information Services University of Plymouth | Drake Circus | Plymouth | Devon | PL4 8AA | UK
[http://www.plymouth.ac.uk/images/email_footer.gif]<http://www.plymouth.ac.uk/worldclass>
This email and any files with it are confidential and intended solely for the use of the recipient to whom it is addressed. If you are not the intended recipient then copying, distribution or other use of the information contained is strictly prohibited and you should not rely on it. If you have received this email in error please let the sender know immediately and delete it from your system(s). Internet emails are not necessarily secure. While we take every care, University of Plymouth accepts no responsibility for viruses and it is your responsibility to scan emails and their attachments. University of Plymouth does not accept responsibility for any changes made after it was sent. Nothing in this email or its attachments constitutes an order for goods or services unless accompanied by an official order form.