Question

我在centos 7下运行nagios 4.一切正常，SELinux禁用。但是当我启用它时，我在界面中收到此错误：

Whoops!

Error: Could not open CGI config file '/etc/nagios/cgi.cfg' for reading!

Here are some things you should check in order to resolve this error:

Make sure you've installed a CGI config file in its proper location. See the error message about for details on where the CGI is expecting to find the configuration file. A sample CGI configuration file (named cgi.cfg) can be found in the sample-config/ subdirectory of the Nagios source code distribution.
Make sure the user your web server is running as has permission to read the CGI config file.
Make sure you read the documentation on installing and configuring Nagios thoroughly before continuing. If all else fails, try sending a message to one of the mailing lists. More information can be found at https://www.nagios.org.

我试过检查audit2why，看看我是否能得到如何处理这个问题的线索：

我看到了这个输出：

type=AVC msg=audit(1444272414.200:15955): avc:  denied  { read } for  pid=9090 comm="status.cgi" name="cgi.cfg" dev="xvda1" ino=19230613 scontext=system_u:system_r:httpd_sys_script_t:s0 tcontext=system_u:object_r:nagios_etc_t:s0 tclass=file

        Was caused by:
                Missing type enforcement (TE) allow rule.

                You can use audit2allow to generate a loadable module to allow this access.

    type=AVC msg=audit(1444272474.545:15956): avc:  denied  { read } for  pid=9116 comm="status.cgi" name="cgi.cfg" dev="xvda1" ino=19230613 scontext=system_u:system_r:httpd_sys_script_t:s0 tcontext=system_u:object_r:nagios_etc_t:s0 tclass=file

            Was caused by:
                    Missing type enforcement (TE) allow rule.

                    You can use audit2allow to generate a loadable module to allow this access.

如果我检查audit2allow，这就是我所看到的：

[root@monitor1:~] #grep nagios /var/log/audit/audit.log | audit2allow


#============= httpd_sys_script_t ==============
allow httpd_sys_script_t nagios_etc_t:file { read getattr open };

#============= httpd_t ==============
allow httpd_t admin_home_t:file { write getattr open };
allow httpd_t etc_t:dir write;
allow httpd_t etc_t:file write;
allow httpd_t httpd_sys_rw_content_t:fifo_file getattr;
allow httpd_t usr_t:fifo_file { write getattr open };

但我在SELinux上并不是真正的知识渊博。所以我希望我能就如何解决这个问题得到一些建议。

由于

Answer 1

grep单词audit.log的{{1}}并将其nagios标记为audit2allow

-M

这应创建2个文件：类型强制文件grep nagios /var/log/audit/audit.log | audit2allow -M nagios和策略包文件nagios.te

使用nagios.pp命令加载策略包：

semodule

你已经完成了。

来源：

selinux阻止访问nagios配置

1 个答案: