-
Type:
Problem report
-
Resolution: Unresolved
-
Priority:
Critical
-
None
-
Affects Version/s: None
-
Component/s: None
-
Environment:EL9
Hey,
We have noticed that for EL9, there is only "zabbix-selinux-policy' package,
For example "zabbix-selinux-policy-7.4.15-release1.el9.aarch64.rpm" contains just this policy:
(typeattributeset cil_gen_require zabbix_t) (typeattributeset cil_gen_require zabbix_agent_t) (typeattributeset cil_gen_require zabbix_port_t) (typeattributeset cil_gen_require zabbix_var_run_t) (typeattributeset cil_gen_require postgresql_port_t) (typeattributeset cil_gen_require httpd_t) (allow zabbix_t self (unix_stream_socket (connectto))) (allow zabbix_t zabbix_port_t (tcp_socket (name_connect))) (allow zabbix_t zabbix_var_run_t (sock_file (create))) (allow zabbix_t zabbix_var_run_t (sock_file (unlink))) (allow httpd_t zabbix_port_t (tcp_socket (name_connect))) (allow httpd_t postgresql_port_t (tcp_socket (name_connect))) (allow zabbix_agent_t zabbix_var_run_t (sock_file (create unlink))) (filecon "/usr/bin/zabbix_agent2" file (system_u object_r zabbix_agent_exec_t ((s0) (s0)))) (filecon "/usr/sbin/zabbix_agent2" file (system_u object_r zabbix_agent_exec_t ((s0) (s0))))
which is not really enough, and in case of agent2 and it can generate issues if plugins are in use.
on EL10 platform, this kind of package is avaliable:
zabbix-selinux-policy-main-7.4.15-release1.el10.aarch64.rpm
and it's policy is much more detailed, but most important is write for zabbix_agent_t:
/usr/libexec/selinux/hll/pp zabbix_policy_main.pp | grep "zabbix_agent_t var_run_t"
(allow zabbix_agent_t var_run_t (dir (ioctl read write getattr lock open add_name remove_name search)))
(typetransition zabbix_agent_t var_run_t file zabbix_var_run_t)
(allow zabbix_agent_t var_run_t (lnk_file (read getattr)))
(allow zabbix_agent_t var_run_t (dir (getattr open search)))
(allow zabbix_agent_t var_run_t (dir (ioctl read getattr lock open search)))
(allow zabbix_agent_t var_run_t (lnk_file (read getattr)))
(allow zabbix_agent_t var_run_t (dir (getattr open search)))
(allow zabbix_agent_t var_run_t (lnk_file (read getattr)))
(allow zabbix_agent_t var_run_t (dir (getattr open search)))
(allow zabbix_agent_t var_run_t (dir (getattr open search)))
(allow zabbix_agent_t var_run_t (lnk_file (read getattr)))
It would be worth having this kind of package also for EL9 and if possible EL8.
Currently, to stop SELinux from blocking agent2 and its plugins, it forces the user to create its own action, using the audit2allow tool.