fedora-infrastructure

#3061 Fix check_raid nrpe check on selinux enforcing hosts
Closed: Fixed Opened by kevin.

Closed: Fixed
Reopen Issue

Recently, some of our hosts that are selinux enforcing are not able to run the check_raid nrpe check.

For example:

[kevin@noc01 ~]$ /usr/lib/nagios/plugins/check_nrpe -H virthost02.phx2.fedoraproject.org -c check_raid
NRPE: Unable to read output

This may require changes to our selinux nrpe policy or the like. You can view selinux audit messages for the hosts on log02 and then adjust the nrpe selinux module in puppet.

Selinux issue fixed, but we still need to check why nrpe is unable to read the command output.

check_raid seems working as npre user

There is still a selinux issue it seems...

type=1400 audit(1323539541.859:879999): avc: denied { search } for pid=2066 comm="sh" name="home" dev=dm-1 ino=392456 scontext=unconfined_u:system_r:nrpe_t:s0 tcontext=system_u:object_r:home_root_t:s0 tclass=dir
type=1400 audit(1323539541.892:880000): avc: denied { read } for pid=2066 comm="python" name="mdstat" dev=proc ino=4026531961 scontext=unconfined_u:system_r:nrpe_t:s0 tcontext=system_u:object_r:proc_mdstat_t:s0 tclass=file

Not sure why it's looking at home. ;(

Looking at this again, I think it is solved. it's showing the unable, but thats ok on those hosts because there's no /proc/mdstat (they are virtuals).

Closing this out now.

Metadata
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.