On Wed, 2012-05-30 at 12:55 -0400, Daniel J Walsh wrote:
On 05/30/2012 11:58 AM, John Horne wrote:
On Wed, 2012-05-30 at 16:52 +0100, John Horne wrote:
I am trying to use SNMP on a CentOS 6.2 server, and am using the 'pass_persist' configuration command:
Sorry, I should have added that nothing appears to be logged in /var/log/audit/audit.log when snmpd fails to return any values. Nor is anything about this logged in /var/log/messages by the snmpd daemon.
Turn off dontaudit rules
#semodule -DB
Then run the command
#semdule -B
Will turn them back on.
Hello,
Many thanks for this. I understood that snmpd was under the control of SELinux, but didn't know about the 'dontaudit' rules.
The 'snmp-iostat' program, which snmpd/pass_persist calls, reads data from a temporary file. The relevant data is then output back to snmpd. The temporary file is created via a root cronjob. (I'm not happy with this, but at the moment haven't thought of another way to do it.) The file is written into '/var/run/net-snmp'.
When running snmpd again (via 'service') I got the following logged in audit.log:
================================================= type=AVC msg=audit(1338397396.982:718378): avc: denied { read } for pid=3854 comm="snmp-iostat" name="snmp-iostat" dev=dm-0 ino=524175 scontext=unconfined_u:system_r:snmpd_t:s0 tcontext=unconfined_u:object_r:var_run_t:s0 tclass=file type=SYSCALL msg=audit(1338397396.982:718378): arch=c000003e syscall=2 success=no exit=-13 a0=938ce0 a1=0 a2=1b6 a3=31bf71dba0 items=0 ppid=27824 pid=3854 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=3870 comm="snmp-iostat" exe="/usr/bin/perl" subj=unconfined_u:system_r:snmpd_t:s0 key=(null) =================================================
So it seems that the problem is that 'snmp-iostat' (with the snmpd_t context) does not have read access to the temporary file in '/var/run/net-snmp'. If I change everything to use /tmp instead of '/var/run/net-snmp', I get the same error logged. If I change it again to use '/etc/snmp' as the location for the temporary file, then it works. Since this holds the SNMP config files, snmpd would, of course, require read access to the directory.
So, using '/etc/snmp' to hold a temporary data file works, but again I'm not happy with that as a solution! :-)
Is there any (reasonably) secure location where snmpd will have read access, and that I could use for holding a temporary file?
John.