SELinux – Zabbix server can’t read conf file

I have installed zabbix server on red Hat 7.4 server with SELinux policy in Enforcing mode.

If I launch Zabbix-server (3.4.11), I have theses errors :

/var/log/zabbix/zabbix_server.log
Jul 25 16:51:38 master-01 systemd: zabbix-server.service never wrote its PID file. Failing.
Jul 25 16:51:38 master-01 systemd: Failed to start Zabbix Server.
Jul 25 16:51:38 master-01 systemd: Unit zabbix-server.service entered failed state.
Jul 25 16:51:38 master-01 systemd: zabbix-server.service failed.

==> /var/log/messages <==
Jul 25 16:57:47 master-01 systemd: PID file /run/zabbix/zabbix_server.pid not readable (yet?) after start.
Jul 25 16:57:57 master-01 systemd: zabbix-server.service never wrote its PID file. Failing.
Jul 25 16:57:57 master-01 systemd: Failed to start Zabbix Server.
Jul 25 16:57:57 master-01 systemd: Unit zabbix-server.service entered failed state.
Jul 25 16:57:57 master-01 systemd: zabbix-server.service failed.
Jul 25 16:58:08 master-01 systemd: zabbix-server.service holdoff time over, scheduling restart.

==> /var/log/audit/audit.log <==
type=AVC msg=audit(1532530831.592:161220): avc:  denied  { setrlimit } for  pid=11475 comm="zabbix_server" scontext=system_u:system_r:zabbix_t:s0 tcontext=system_u:system_r:zabbix_t:s0 tclass=process
type=SYSCALL msg=audit(1532530831.592:161220): arch=c000003e syscall=160 success=no exit=-13 a0=4 a1=7ffd64898360 a2=0 a3=8 items=0 ppid=1 pid=11475 auid=4294967295 uid=997 gid=995 euid=997 suid=997 fsuid=997 egid=995 sgid=995 fsgid=995 tty=(none) ses=4294967295 comm="zabbix_server" exe="/usr/sbin/zabbix_server_mysql" subj=system_u:system_r:zabbix_t:s0 key=(null)
type=PROCTITLE msg=audit(1532530831.592:161220): proctitle=2F7573722F7362696E2F7A61626269785F736572766572002D63002F6574632F7A61626269782F7A61626269785F7365727665722E636F6E66

After severals retry, without modification theses errors occured :

==> /var/log/zabbix/zabbix_server.log <==
zabbix_server [11390]: cannot open log: cannot create semaphore set: [28] No space left on device

In this case, I launch theses commands :

[root@master-01 ~]# ipcs | grep zabbix | wc -l
93
[root@master-01 ~]# ipcrm -a

==> /var/log/zabbix/zabbix_server.log <==
 11577:20180725:170244.842 Starting Zabbix Server. Zabbix 3.4.11 (revision 82160).
 11577:20180725:170244.842 ****** Enabled features ******
 11577:20180725:170244.842 SNMP monitoring:           YES
 11577:20180725:170244.842 IPMI monitoring:           YES
 11577:20180725:170244.842 Web monitoring:            YES
 11577:20180725:170244.842 VMware monitoring:         YES
 11577:20180725:170244.843 SMTP authentication:       YES
 11577:20180725:170244.843 Jabber notifications:      YES
 11577:20180725:170244.843 Ez Texting notifications:  YES
 11577:20180725:170244.843 ODBC:                      YES
 11577:20180725:170244.843 SSH2 support:              YES
 11577:20180725:170244.843 IPv6 support:              YES
 11577:20180725:170244.843 TLS support:               YES
 11577:20180725:170244.843 ******************************
 11577:20180725:170244.843 using configuration file: /etc/zabbix/zabbix_server.conf
 11577:20180725:170244.843 cannot set resource limit: [13] Permission denied
 11577:20180725:170244.843 cannot disable core dump, exiting...

In the original configuration, the permission denied error with solve with restorecon -v /etc/zabbix/zabbix_server.conf, in fact, the SELinux type set with "etc_t" instead "zabbix_exec_t" but appear again…

For the test (that is my first SELinux configuration), I have disable SELinux and service properly work.

I try to configure setsebool httpd_can_network_connect on (In this post), without success.

I check SELinux context :

[root@master-01 ~]# grep Pid /etc/zabbix/zabbix_server.conf | grep -v '#'
PidFile=/var/run/zabbix/zabbix_server.pid

[root@master-01 ~]# ls -Z /var/run/zabbix/
    srwx------. zabbix zabbix system_u:object_r:zabbix_var_run_t:s0 zabbix_server_alerter.sock
    srwx------. zabbix zabbix system_u:object_r:zabbix_var_run_t:s0 zabbix_server_preprocessing.sock

[root@master-01 ~]# ls -Z /etc/zabbix/zabbix_server.conf
    -rw-r-----. root zabbix system_u:object_r:zabbix_exec_t:s0 /etc/zabbix/zabbix_server.conf

[root@master-01 ~]# sesearch -s zabbix_t -t zabbix_exec_t --allow
Found 1 semantic av rules:
   allow zabbix_t zabbix_exec_t : file { ioctl read getattr lock execute execute_no_trans entrypoint open } ;

[root@master-01 ~]# sesearch -s zabbix_t -t zabbix_var_run_t --allow
Found 6 semantic av rules:
   allow zabbix_t zabbix_var_run_t : dir { ioctl read write create getattr setattr lock unlink link rename add_name remove_name reparent search rmdir open } ;
   allow nsswitch_domain pidfile : dir { getattr search open } ;
   allow domain pidfile : sock_file { write getattr append open } ;
   allow zabbix_t zabbix_var_run_t : file { ioctl read write create getattr setattr lock append unlink link rename open } ;
   allow nsswitch_domain pidfile : dir { getattr search open } ;
   allow nsswitch_domain pidfile : dir { getattr search open } ;

[root@master-01 ~]# sesearch -s zabbix_t --allow | grep mysql
   allow zabbix_t mysqld_t : unix_stream_socket connectto ;
   allow zabbix_t mysqld_var_run_t : sock_file { write getattr append open } ;
   allow zabbix_t mysqld_db_t : dir { getattr search open } ;
   allow zabbix_t mysqld_var_run_t : dir { getattr search open } ;

[root@master-01 ~]# sesearch -s zabbix_t -t zabbix_exec_t --allow
Found 1 semantic av rules:
   allow zabbix_t zabbix_exec_t : file { ioctl read getattr lock execute execute_no_trans entrypoint open } ;

I try add entry with audit2allow :

[root@master-01 ~]# audit2allow -a -m zabbix
[root@master-01 ~]# cat zabbix.te

module zabbix 1.0;

require {
        type httpd_t;
        type zabbix_t;
        type zabbix_port_t;
        class process setrlimit;
        class tcp_socket name_connect;
}

#============= httpd_t ==============

#!!!! This avc is allowed in the current policy
allow httpd_t zabbix_port_t:tcp_socket name_connect;

#============= zabbix_t ==============
allow zabbix_t self:process setrlimit;

[root@master-01 ~]# semodule -i zabbix.pp
libsemanage.semanage_direct_install_info: Overriding zabbix module at lower priority 100 with module at priority 400.
Failed to resolve typeattributeset statement at /etc/selinux/targeted/tmp/modules/400/zabbix/cil:2
semodule:  Failed!

Any idea ?

Thank you 🙂