SELinux – Zabbix server can't read conf file

user5525652 asked:

I have installed zabbix server on red Hat 7.4 server with SELinux policy in Enforcing mode.

If I launch Zabbix-server (3.4.11), I have theses errors :

/var/log/zabbix/zabbix_server.log
Jul 25 16:51:38 master-01 systemd: zabbix-server.service never wrote its PID file. Failing.
Jul 25 16:51:38 master-01 systemd: Failed to start Zabbix Server.
Jul 25 16:51:38 master-01 systemd: Unit zabbix-server.service entered failed state.
Jul 25 16:51:38 master-01 systemd: zabbix-server.service failed.

==> /var/log/messages <==
Jul 25 16:57:47 master-01 systemd: PID file /run/zabbix/zabbix_server.pid not readable (yet?) after start.
Jul 25 16:57:57 master-01 systemd: zabbix-server.service never wrote its PID file. Failing.
Jul 25 16:57:57 master-01 systemd: Failed to start Zabbix Server.
Jul 25 16:57:57 master-01 systemd: Unit zabbix-server.service entered failed state.
Jul 25 16:57:57 master-01 systemd: zabbix-server.service failed.
Jul 25 16:58:08 master-01 systemd: zabbix-server.service holdoff time over, scheduling restart.

==> /var/log/audit/audit.log <==
type=AVC msg=audit(1532530831.592:161220): avc:  denied  { setrlimit } for  pid=11475 comm="zabbix_server" scontext=system_u:system_r:zabbix_t:s0 tcontext=system_u:system_r:zabbix_t:s0 tclass=process
type=SYSCALL msg=audit(1532530831.592:161220): arch=c000003e syscall=160 success=no exit=-13 a0=4 a1=7ffd64898360 a2=0 a3=8 items=0 ppid=1 pid=11475 auid=4294967295 uid=997 gid=995 euid=997 suid=997 fsuid=997 egid=995 sgid=995 fsgid=995 tty=(none) ses=4294967295 comm="zabbix_server" exe="/usr/sbin/zabbix_server_mysql" subj=system_u:system_r:zabbix_t:s0 key=(null)
type=PROCTITLE msg=audit(1532530831.592:161220): proctitle=2F7573722F7362696E2F7A61626269785F736572766572002D63002F6574632F7A61626269782F7A61626269785F7365727665722E636F6E66

After severals retry, without modification theses errors occured :

==> /var/log/zabbix/zabbix_server.log <==
zabbix_server [11390]: cannot open log: cannot create semaphore set: [28] No space left on device

In this case, I launch theses commands :

[[email protected] ~]# ipcs | grep zabbix | wc -l
93
[[email protected] ~]# ipcrm -a

==> /var/log/zabbix/zabbix_server.log <==
 11577:20180725:170244.842 Starting Zabbix Server. Zabbix 3.4.11 (revision 82160).
 11577:20180725:170244.842 ****** Enabled features ******
 11577:20180725:170244.842 SNMP monitoring:           YES
 11577:20180725:170244.842 IPMI monitoring:           YES
 11577:20180725:170244.842 Web monitoring:            YES
 11577:20180725:170244.842 VMware monitoring:         YES
 11577:20180725:170244.843 SMTP authentication:       YES
 11577:20180725:170244.843 Jabber notifications:      YES
 11577:20180725:170244.843 Ez Texting notifications:  YES
 11577:20180725:170244.843 ODBC:                      YES
 11577:20180725:170244.843 SSH2 support:              YES
 11577:20180725:170244.843 IPv6 support:              YES
 11577:20180725:170244.843 TLS support:               YES
 11577:20180725:170244.843 ******************************
 11577:20180725:170244.843 using configuration file: /etc/zabbix/zabbix_server.conf
 11577:20180725:170244.843 cannot set resource limit: [13] Permission denied
 11577:20180725:170244.843 cannot disable core dump, exiting...

In the original configuration, the permission denied error with solve with restorecon -v /etc/zabbix/zabbix_server.conf, in fact, the SELinux type set with “etc_t” instead “zabbix_exec_t” but appear again…

For the test (that is my first SELinux configuration), I have disable SELinux and service properly work.

I try to configure setsebool httpd_can_network_connect on (In this post), without success.

I check SELinux context :

[[email protected] ~]# grep Pid /etc/zabbix/zabbix_server.conf | grep -v '#'
PidFile=/var/run/zabbix/zabbix_server.pid

[[email protected] ~]# ls -Z /var/run/zabbix/
    srwx------. zabbix zabbix system_u:object_r:zabbix_var_run_t:s0 zabbix_server_alerter.sock
    srwx------. zabbix zabbix system_u:object_r:zabbix_var_run_t:s0 zabbix_server_preprocessing.sock

[[email protected] ~]# ls -Z /etc/zabbix/zabbix_server.conf
    -rw-r-----. root zabbix system_u:object_r:zabbix_exec_t:s0 /etc/zabbix/zabbix_server.conf

[[email protected] ~]# sesearch -s zabbix_t -t zabbix_exec_t --allow
Found 1 semantic av rules:
   allow zabbix_t zabbix_exec_t : file { ioctl read getattr lock execute execute_no_trans entrypoint open } ;

[[email protected] ~]# sesearch -s zabbix_t -t zabbix_var_run_t --allow
Found 6 semantic av rules:
   allow zabbix_t zabbix_var_run_t : dir { ioctl read write create getattr setattr lock unlink link rename add_name remove_name reparent search rmdir open } ;
   allow nsswitch_domain pidfile : dir { getattr search open } ;
   allow domain pidfile : sock_file { write getattr append open } ;
   allow zabbix_t zabbix_var_run_t : file { ioctl read write create getattr setattr lock append unlink link rename open } ;
   allow nsswitch_domain pidfile : dir { getattr search open } ;
   allow nsswitch_domain pidfile : dir { getattr search open } ;

[[email protected] ~]# sesearch -s zabbix_t --allow | grep mysql
   allow zabbix_t mysqld_t : unix_stream_socket connectto ;
   allow zabbix_t mysqld_var_run_t : sock_file { write getattr append open } ;
   allow zabbix_t mysqld_db_t : dir { getattr search open } ;
   allow zabbix_t mysqld_var_run_t : dir { getattr search open } ;

[[email protected] ~]# sesearch -s zabbix_t -t zabbix_exec_t --allow
Found 1 semantic av rules:
   allow zabbix_t zabbix_exec_t : file { ioctl read getattr lock execute execute_no_trans entrypoint open } ;

I try add entry with audit2allow :

[[email protected] ~]# audit2allow -a -m zabbix
[[email protected] ~]# cat zabbix.te

module zabbix 1.0;

require {
        type httpd_t;
        type zabbix_t;
        type zabbix_port_t;
        class process setrlimit;
        class tcp_socket name_connect;
}

#============= httpd_t ==============

#!!!! This avc is allowed in the current policy
allow httpd_t zabbix_port_t:tcp_socket name_connect;

#============= zabbix_t ==============
allow zabbix_t self:process setrlimit;

 

[[email protected] ~]# semodule -i zabbix.pp
libsemanage.semanage_direct_install_info: Overriding zabbix module at lower priority 100 with module at priority 400.
Failed to resolve typeattributeset statement at /etc/selinux/targeted/tmp/modules/400/zabbix/cil:2
semodule:  Failed!

Any idea ?

Thank you 🙂

My answer:


The existing SELinux policy for Zabbix isn’t well developed, and doesn’t include many things that Zabbix ought to be able to monitor.

On my existing Zabbix server, I’ve set Zabbix to permissive as a workaround.

semanage permissive -a zabbix_t

This will allow Zabbix to run, and for you to collect AVCs in the log, in case you want to create a local policy module for the things you need your Zabbix server to do.

See also a similar issue with the Zabbix agent.


View the full question and any other answers on Server Fault.

Creative Commons License
This work is licensed under a Creative Commons Attribution-ShareAlike 3.0 Unported License.