Eu instalei o servidor zabbix no servidor Red Hat 7.4 com a política SELinux no modo Impingir.
Se eu iniciar o Zabbix-server (3.4.11), tenho erros de teses:
/var/log/zabbix/zabbix_server.log
Jul 25 16:51:38 master-01 systemd: zabbix-server.service never wrote its PID file. Failing.
Jul 25 16:51:38 master-01 systemd: Failed to start Zabbix Server.
Jul 25 16:51:38 master-01 systemd: Unit zabbix-server.service entered failed state.
Jul 25 16:51:38 master-01 systemd: zabbix-server.service failed.
==> /var/log/messages <==
Jul 25 16:57:47 master-01 systemd: PID file /run/zabbix/zabbix_server.pid not readable (yet?) after start.
Jul 25 16:57:57 master-01 systemd: zabbix-server.service never wrote its PID file. Failing.
Jul 25 16:57:57 master-01 systemd: Failed to start Zabbix Server.
Jul 25 16:57:57 master-01 systemd: Unit zabbix-server.service entered failed state.
Jul 25 16:57:57 master-01 systemd: zabbix-server.service failed.
Jul 25 16:58:08 master-01 systemd: zabbix-server.service holdoff time over, scheduling restart.
==> /var/log/audit/audit.log <==
type=AVC msg=audit(1532530831.592:161220): avc: denied { setrlimit } for pid=11475 comm="zabbix_server" scontext=system_u:system_r:zabbix_t:s0 tcontext=system_u:system_r:zabbix_t:s0 tclass=process
type=SYSCALL msg=audit(1532530831.592:161220): arch=c000003e syscall=160 success=no exit=-13 a0=4 a1=7ffd64898360 a2=0 a3=8 items=0 ppid=1 pid=11475 auid=4294967295 uid=997 gid=995 euid=997 suid=997 fsuid=997 egid=995 sgid=995 fsgid=995 tty=(none) ses=4294967295 comm="zabbix_server" exe="/usr/sbin/zabbix_server_mysql" subj=system_u:system_r:zabbix_t:s0 key=(null)
type=PROCTITLE msg=audit(1532530831.592:161220): proctitle=2F7573722F7362696E2F7A61626269785F736572766572002D63002F6574632F7A61626269782F7A61626269785F7365727665722E636F6E66
Após vários tentativas, sem modificação, esses erros ocorreram:
==> /var/log/zabbix/zabbix_server.log <==
zabbix_server [11390]: cannot open log: cannot create semaphore set: [28] No space left on device
Nesse caso, eu inicio esses comandos:
[root@master-01 ~]# ipcs | grep zabbix | wc -l
93
[root@master-01 ~]# ipcrm -a
==> /var/log/zabbix/zabbix_server.log <==
11577:20180725:170244.842 Starting Zabbix Server. Zabbix 3.4.11 (revision 82160).
11577:20180725:170244.842 ****** Enabled features ******
11577:20180725:170244.842 SNMP monitoring: YES
11577:20180725:170244.842 IPMI monitoring: YES
11577:20180725:170244.842 Web monitoring: YES
11577:20180725:170244.842 VMware monitoring: YES
11577:20180725:170244.843 SMTP authentication: YES
11577:20180725:170244.843 Jabber notifications: YES
11577:20180725:170244.843 Ez Texting notifications: YES
11577:20180725:170244.843 ODBC: YES
11577:20180725:170244.843 SSH2 support: YES
11577:20180725:170244.843 IPv6 support: YES
11577:20180725:170244.843 TLS support: YES
11577:20180725:170244.843 ******************************
11577:20180725:170244.843 using configuration file: /etc/zabbix/zabbix_server.conf
11577:20180725:170244.843 cannot set resource limit: [13] Permission denied
11577:20180725:170244.843 cannot disable core dump, exiting...
Na configuração original, a permissão negou o erro com solve com restorecon -v /etc/zabbix/zabbix_server.conf , na verdade, o tipo SELinux definido com "etc_t" em vez de "zabbix_exec_t" mas aparece novamente ...
Para o teste (essa é a minha primeira configuração do SELinux), desativei o SELinux e o serviço funcionou corretamente.
Eu tento configurar setsebool httpd_can_network_connect on ( Neste post ), sem sucesso.
Eu verifico o contexto do SELinux:
[root@master-01 ~]# grep Pid /etc/zabbix/zabbix_server.conf | grep -v '#'
PidFile=/var/run/zabbix/zabbix_server.pid
[root@master-01 ~]# ls -Z /var/run/zabbix/
srwx------. zabbix zabbix system_u:object_r:zabbix_var_run_t:s0 zabbix_server_alerter.sock
srwx------. zabbix zabbix system_u:object_r:zabbix_var_run_t:s0 zabbix_server_preprocessing.sock
[root@master-01 ~]# ls -Z /etc/zabbix/zabbix_server.conf
-rw-r-----. root zabbix system_u:object_r:zabbix_exec_t:s0 /etc/zabbix/zabbix_server.conf
[root@master-01 ~]# sesearch -s zabbix_t -t zabbix_exec_t --allow
Found 1 semantic av rules:
allow zabbix_t zabbix_exec_t : file { ioctl read getattr lock execute execute_no_trans entrypoint open } ;
[root@master-01 ~]# sesearch -s zabbix_t -t zabbix_var_run_t --allow
Found 6 semantic av rules:
allow zabbix_t zabbix_var_run_t : dir { ioctl read write create getattr setattr lock unlink link rename add_name remove_name reparent search rmdir open } ;
allow nsswitch_domain pidfile : dir { getattr search open } ;
allow domain pidfile : sock_file { write getattr append open } ;
allow zabbix_t zabbix_var_run_t : file { ioctl read write create getattr setattr lock append unlink link rename open } ;
allow nsswitch_domain pidfile : dir { getattr search open } ;
allow nsswitch_domain pidfile : dir { getattr search open } ;
[root@master-01 ~]# sesearch -s zabbix_t --allow | grep mysql
allow zabbix_t mysqld_t : unix_stream_socket connectto ;
allow zabbix_t mysqld_var_run_t : sock_file { write getattr append open } ;
allow zabbix_t mysqld_db_t : dir { getattr search open } ;
allow zabbix_t mysqld_var_run_t : dir { getattr search open } ;
[root@master-01 ~]# sesearch -s zabbix_t -t zabbix_exec_t --allow
Found 1 semantic av rules:
allow zabbix_t zabbix_exec_t : file { ioctl read getattr lock execute execute_no_trans entrypoint open } ;
Eu tento adicionar entrada com audit2allow:
[root@master-01 ~]# audit2allow -a -m zabbix
[root@master-01 ~]# cat zabbix.te
module zabbix 1.0;
require {
type httpd_t;
type zabbix_t;
type zabbix_port_t;
class process setrlimit;
class tcp_socket name_connect;
}
#============= httpd_t ==============
#!!!! This avc is allowed in the current policy
allow httpd_t zabbix_port_t:tcp_socket name_connect;
#============= zabbix_t ==============
allow zabbix_t self:process setrlimit;
[root@master-01 ~]# semodule -i zabbix.pp
libsemanage.semanage_direct_install_info: Overriding zabbix module at lower priority 100 with module at priority 400.
Failed to resolve typeattributeset statement at /etc/selinux/targeted/tmp/modules/400/zabbix/cil:2
semodule: Failed!
Alguma ideia?
Obrigado:)