SELinux - Zabbix 服务器无法读取配置文件

2024-5-31 • tag-icon

我已经在 Red Hat 7.4 服务器上安装了 zabbix 服务器，并使用强制模式下的 SELinux 策略。

如果我启动 Zabbix-server（3.4.11），我会出现这些错误：

/var/log/zabbix/zabbix_server.log
Jul 25 16:51:38 master-01 systemd: zabbix-server.service never wrote its PID file. Failing.
Jul 25 16:51:38 master-01 systemd: Failed to start Zabbix Server.
Jul 25 16:51:38 master-01 systemd: Unit zabbix-server.service entered failed state.
Jul 25 16:51:38 master-01 systemd: zabbix-server.service failed.

==> /var/log/messages <==
Jul 25 16:57:47 master-01 systemd: PID file /run/zabbix/zabbix_server.pid not readable (yet?) after start.
Jul 25 16:57:57 master-01 systemd: zabbix-server.service never wrote its PID file. Failing.
Jul 25 16:57:57 master-01 systemd: Failed to start Zabbix Server.
Jul 25 16:57:57 master-01 systemd: Unit zabbix-server.service entered failed state.
Jul 25 16:57:57 master-01 systemd: zabbix-server.service failed.
Jul 25 16:58:08 master-01 systemd: zabbix-server.service holdoff time over, scheduling restart.

==> /var/log/audit/audit.log <==
type=AVC msg=audit(1532530831.592:161220): avc:  denied  { setrlimit } for  pid=11475 comm="zabbix_server" scontext=system_u:system_r:zabbix_t:s0 tcontext=system_u:system_r:zabbix_t:s0 tclass=process
type=SYSCALL msg=audit(1532530831.592:161220): arch=c000003e syscall=160 success=no exit=-13 a0=4 a1=7ffd64898360 a2=0 a3=8 items=0 ppid=1 pid=11475 auid=4294967295 uid=997 gid=995 euid=997 suid=997 fsuid=997 egid=995 sgid=995 fsgid=995 tty=(none) ses=4294967295 comm="zabbix_server" exe="/usr/sbin/zabbix_server_mysql" subj=system_u:system_r:zabbix_t:s0 key=(null)
type=PROCTITLE msg=audit(1532530831.592:161220): proctitle=2F7573722F7362696E2F7A61626269785F736572766572002D63002F6574632F7A61626269782F7A61626269785F7365727665722E636F6E66

经过多次重试后，未经修改，出现以下错误：

==> /var/log/zabbix/zabbix_server.log <==
zabbix_server [11390]: cannot open log: cannot create semaphore set: [28] No space left on device

在这种情况下，我启动这些命令：

[root@master-01 ~]# ipcs | grep zabbix | wc -l
93
[root@master-01 ~]# ipcrm -a

==> /var/log/zabbix/zabbix_server.log <==
 11577:20180725:170244.842 Starting Zabbix Server. Zabbix 3.4.11 (revision 82160).
 11577:20180725:170244.842 ****** Enabled features ******
 11577:20180725:170244.842 SNMP monitoring:           YES
 11577:20180725:170244.842 IPMI monitoring:           YES
 11577:20180725:170244.842 Web monitoring:            YES
 11577:20180725:170244.842 VMware monitoring:         YES
 11577:20180725:170244.843 SMTP authentication:       YES
 11577:20180725:170244.843 Jabber notifications:      YES
 11577:20180725:170244.843 Ez Texting notifications:  YES
 11577:20180725:170244.843 ODBC:                      YES
 11577:20180725:170244.843 SSH2 support:              YES
 11577:20180725:170244.843 IPv6 support:              YES
 11577:20180725:170244.843 TLS support:               YES
 11577:20180725:170244.843 ******************************
 11577:20180725:170244.843 using configuration file: /etc/zabbix/zabbix_server.conf
 11577:20180725:170244.843 cannot set resource limit: [13] Permission denied
 11577:20180725:170244.843 cannot disable core dump, exiting...

原配置中，出现permission denied错误，用解决restorecon -v /etc/zabbix/zabbix_server.conf，其实就是把SELinux类型设置成“etc_t”而不是“zabbix_exec_t”但是又出现了...

为了测试（这是我的第一个 SELinux 配置），我已禁用 SELinux 并且服务正常运行。

我尝试配置setsebool httpd_can_network_connect on（在这篇文章中），没有成功。

我检查了 SELinux 上下文：

[root@master-01 ~]# grep Pid /etc/zabbix/zabbix_server.conf | grep -v '#'
PidFile=/var/run/zabbix/zabbix_server.pid

[root@master-01 ~]# ls -Z /var/run/zabbix/
    srwx------. zabbix zabbix system_u:object_r:zabbix_var_run_t:s0 zabbix_server_alerter.sock
    srwx------. zabbix zabbix system_u:object_r:zabbix_var_run_t:s0 zabbix_server_preprocessing.sock

[root@master-01 ~]# ls -Z /etc/zabbix/zabbix_server.conf
    -rw-r-----. root zabbix system_u:object_r:zabbix_exec_t:s0 /etc/zabbix/zabbix_server.conf

[root@master-01 ~]# sesearch -s zabbix_t -t zabbix_exec_t --allow
Found 1 semantic av rules:
   allow zabbix_t zabbix_exec_t : file { ioctl read getattr lock execute execute_no_trans entrypoint open } ;

[root@master-01 ~]# sesearch -s zabbix_t -t zabbix_var_run_t --allow
Found 6 semantic av rules:
   allow zabbix_t zabbix_var_run_t : dir { ioctl read write create getattr setattr lock unlink link rename add_name remove_name reparent search rmdir open } ;
   allow nsswitch_domain pidfile : dir { getattr search open } ;
   allow domain pidfile : sock_file { write getattr append open } ;
   allow zabbix_t zabbix_var_run_t : file { ioctl read write create getattr setattr lock append unlink link rename open } ;
   allow nsswitch_domain pidfile : dir { getattr search open } ;
   allow nsswitch_domain pidfile : dir { getattr search open } ;

[root@master-01 ~]# sesearch -s zabbix_t --allow | grep mysql
   allow zabbix_t mysqld_t : unix_stream_socket connectto ;
   allow zabbix_t mysqld_var_run_t : sock_file { write getattr append open } ;
   allow zabbix_t mysqld_db_t : dir { getattr search open } ;
   allow zabbix_t mysqld_var_run_t : dir { getattr search open } ;

[root@master-01 ~]# sesearch -s zabbix_t -t zabbix_exec_t --allow
Found 1 semantic av rules:
   allow zabbix_t zabbix_exec_t : file { ioctl read getattr lock execute execute_no_trans entrypoint open } ;

我尝试使用 audit2allow 添加条目：

[root@master-01 ~]# audit2allow -a -m zabbix
[root@master-01 ~]# cat zabbix.te

module zabbix 1.0;

require {
        type httpd_t;
        type zabbix_t;
        type zabbix_port_t;
        class process setrlimit;
        class tcp_socket name_connect;
}

#============= httpd_t ==============

#!!!! This avc is allowed in the current policy
allow httpd_t zabbix_port_t:tcp_socket name_connect;

#============= zabbix_t ==============
allow zabbix_t self:process setrlimit;

[root@master-01 ~]# semodule -i zabbix.pp
libsemanage.semanage_direct_install_info: Overriding zabbix module at lower priority 100 with module at priority 400.
Failed to resolve typeattributeset statement at /etc/selinux/targeted/tmp/modules/400/zabbix/cil:2
semodule:  Failed!

任何想法？

谢谢：）

答案1

Zabbix 现有的 SELinux 策略不够完善，并且没有包含 Zabbix 应该能够监控的许多内容。

在我现有的 Zabbix 服务器上，我已将 Zabbix 设置为宽容作为一种解决方法。

semanage permissive -a zabbix_t

这将允许 Zabbix 运行，并允许您在日志中收集 AVC，以防您想为需要 Zabbix 服务器执行的操作创建本地策略模块。

也可以看看Zabbix 代理存在类似问题。

答案2

您需要命名模块，不同于 zabbix.pp --> 例如 zabbix_add.pp。因为它已默认安装在 zabbix 系统中。

# semodule -l | grep zabbix
zabbix  1.6.0
zabbix_add  1.0

答案1

答案2

相关内容