SELinux - O servidor Zabbix não consegue ler o arquivo conf

1

Eu instalei o servidor zabbix no servidor Red Hat 7.4 com a política SELinux no modo Impingir.

Se eu iniciar o Zabbix-server (3.4.11), tenho erros de teses:

/var/log/zabbix/zabbix_server.log
Jul 25 16:51:38 master-01 systemd: zabbix-server.service never wrote its PID file. Failing.
Jul 25 16:51:38 master-01 systemd: Failed to start Zabbix Server.
Jul 25 16:51:38 master-01 systemd: Unit zabbix-server.service entered failed state.
Jul 25 16:51:38 master-01 systemd: zabbix-server.service failed.

==> /var/log/messages <==
Jul 25 16:57:47 master-01 systemd: PID file /run/zabbix/zabbix_server.pid not readable (yet?) after start.
Jul 25 16:57:57 master-01 systemd: zabbix-server.service never wrote its PID file. Failing.
Jul 25 16:57:57 master-01 systemd: Failed to start Zabbix Server.
Jul 25 16:57:57 master-01 systemd: Unit zabbix-server.service entered failed state.
Jul 25 16:57:57 master-01 systemd: zabbix-server.service failed.
Jul 25 16:58:08 master-01 systemd: zabbix-server.service holdoff time over, scheduling restart.

==> /var/log/audit/audit.log <==
type=AVC msg=audit(1532530831.592:161220): avc:  denied  { setrlimit } for  pid=11475 comm="zabbix_server" scontext=system_u:system_r:zabbix_t:s0 tcontext=system_u:system_r:zabbix_t:s0 tclass=process
type=SYSCALL msg=audit(1532530831.592:161220): arch=c000003e syscall=160 success=no exit=-13 a0=4 a1=7ffd64898360 a2=0 a3=8 items=0 ppid=1 pid=11475 auid=4294967295 uid=997 gid=995 euid=997 suid=997 fsuid=997 egid=995 sgid=995 fsgid=995 tty=(none) ses=4294967295 comm="zabbix_server" exe="/usr/sbin/zabbix_server_mysql" subj=system_u:system_r:zabbix_t:s0 key=(null)
type=PROCTITLE msg=audit(1532530831.592:161220): proctitle=2F7573722F7362696E2F7A61626269785F736572766572002D63002F6574632F7A61626269782F7A61626269785F7365727665722E636F6E66

Após vários tentativas, sem modificação, esses erros ocorreram:

==> /var/log/zabbix/zabbix_server.log <==
zabbix_server [11390]: cannot open log: cannot create semaphore set: [28] No space left on device

Nesse caso, eu inicio esses comandos:

[root@master-01 ~]# ipcs | grep zabbix | wc -l
93
[root@master-01 ~]# ipcrm -a

==> /var/log/zabbix/zabbix_server.log <==
 11577:20180725:170244.842 Starting Zabbix Server. Zabbix 3.4.11 (revision 82160).
 11577:20180725:170244.842 ****** Enabled features ******
 11577:20180725:170244.842 SNMP monitoring:           YES
 11577:20180725:170244.842 IPMI monitoring:           YES
 11577:20180725:170244.842 Web monitoring:            YES
 11577:20180725:170244.842 VMware monitoring:         YES
 11577:20180725:170244.843 SMTP authentication:       YES
 11577:20180725:170244.843 Jabber notifications:      YES
 11577:20180725:170244.843 Ez Texting notifications:  YES
 11577:20180725:170244.843 ODBC:                      YES
 11577:20180725:170244.843 SSH2 support:              YES
 11577:20180725:170244.843 IPv6 support:              YES
 11577:20180725:170244.843 TLS support:               YES
 11577:20180725:170244.843 ******************************
 11577:20180725:170244.843 using configuration file: /etc/zabbix/zabbix_server.conf
 11577:20180725:170244.843 cannot set resource limit: [13] Permission denied
 11577:20180725:170244.843 cannot disable core dump, exiting...

Na configuração original, a permissão negou o erro com solve com restorecon -v /etc/zabbix/zabbix_server.conf , na verdade, o tipo SELinux definido com "etc_t" em vez de "zabbix_exec_t" mas aparece novamente ...

Para o teste (essa é a minha primeira configuração do SELinux), desativei o SELinux e o serviço funcionou corretamente.

Eu tento configurar setsebool httpd_can_network_connect on ( Neste post ), sem sucesso.

Eu verifico o contexto do SELinux:

[root@master-01 ~]# grep Pid /etc/zabbix/zabbix_server.conf | grep -v '#'
PidFile=/var/run/zabbix/zabbix_server.pid

[root@master-01 ~]# ls -Z /var/run/zabbix/
    srwx------. zabbix zabbix system_u:object_r:zabbix_var_run_t:s0 zabbix_server_alerter.sock
    srwx------. zabbix zabbix system_u:object_r:zabbix_var_run_t:s0 zabbix_server_preprocessing.sock

[root@master-01 ~]# ls -Z /etc/zabbix/zabbix_server.conf
    -rw-r-----. root zabbix system_u:object_r:zabbix_exec_t:s0 /etc/zabbix/zabbix_server.conf

[root@master-01 ~]# sesearch -s zabbix_t -t zabbix_exec_t --allow
Found 1 semantic av rules:
   allow zabbix_t zabbix_exec_t : file { ioctl read getattr lock execute execute_no_trans entrypoint open } ;

[root@master-01 ~]# sesearch -s zabbix_t -t zabbix_var_run_t --allow
Found 6 semantic av rules:
   allow zabbix_t zabbix_var_run_t : dir { ioctl read write create getattr setattr lock unlink link rename add_name remove_name reparent search rmdir open } ;
   allow nsswitch_domain pidfile : dir { getattr search open } ;
   allow domain pidfile : sock_file { write getattr append open } ;
   allow zabbix_t zabbix_var_run_t : file { ioctl read write create getattr setattr lock append unlink link rename open } ;
   allow nsswitch_domain pidfile : dir { getattr search open } ;
   allow nsswitch_domain pidfile : dir { getattr search open } ;

[root@master-01 ~]# sesearch -s zabbix_t --allow | grep mysql
   allow zabbix_t mysqld_t : unix_stream_socket connectto ;
   allow zabbix_t mysqld_var_run_t : sock_file { write getattr append open } ;
   allow zabbix_t mysqld_db_t : dir { getattr search open } ;
   allow zabbix_t mysqld_var_run_t : dir { getattr search open } ;

[root@master-01 ~]# sesearch -s zabbix_t -t zabbix_exec_t --allow
Found 1 semantic av rules:
   allow zabbix_t zabbix_exec_t : file { ioctl read getattr lock execute execute_no_trans entrypoint open } ;

Eu tento adicionar entrada com audit2allow:

[root@master-01 ~]# audit2allow -a -m zabbix
[root@master-01 ~]# cat zabbix.te

module zabbix 1.0;

require {
        type httpd_t;
        type zabbix_t;
        type zabbix_port_t;
        class process setrlimit;
        class tcp_socket name_connect;
}

#============= httpd_t ==============

#!!!! This avc is allowed in the current policy
allow httpd_t zabbix_port_t:tcp_socket name_connect;

#============= zabbix_t ==============
allow zabbix_t self:process setrlimit;

[root@master-01 ~]# semodule -i zabbix.pp
libsemanage.semanage_direct_install_info: Overriding zabbix module at lower priority 100 with module at priority 400.
Failed to resolve typeattributeset statement at /etc/selinux/targeted/tmp/modules/400/zabbix/cil:2
semodule:  Failed!

Alguma ideia?

Obrigado:)

    
por user5525652 25.07.2018 / 17:35

1 resposta

0

A política existente do SELinux para o Zabbix não é bem desenvolvida e não inclui muitas coisas que o Zabbix deveria ser capaz de monitorar.

No meu servidor Zabbix existente, configurei o Zabbix como permissivo como solução alternativa.

semanage permissive -a zabbix_t

Isso permitirá que o Zabbix seja executado e que você colete os AVCs no log, caso deseje criar um módulo de política local para as coisas que você precisa que o seu servidor Zabbix faça.

Veja também um problema parecido com o agente do Zabbix .

    
por 25.07.2018 / 18:03