<HTML dir=ltr><HEAD>
<META http-equiv=Content-Type content="text/html; charset=unicode">
<META content="MSHTML 6.00.6000.16788" name=GENERATOR></HEAD>
<BODY>
<DIV id=idOWAReplyText50868 dir=ltr>
<DIV dir=ltr><FONT face=Arial color=#000000 size=2>I compiled Nagios 3 from source on CentOS 5.2 with SELinux set to Enforcing. I installed Nagios following the Fedora Quickstart guide. SELinux will prevent just about everything in Nagios' web page from running. It was an iterative process to get everything allowed, since I kept finding things I'd missed the previous time through these steps. CentOS 5.2 (and RHEL, I assume) had some SELinux tuning tools installed, but I don't know if they're available on other distros.</FONT></DIV>
<DIV dir=ltr><FONT face=Arial color=#000000 size=2></FONT> </DIV>
<DIV dir=ltr><FONT face=Arial color=#000000 size=2>1. Click on the links in Nagios' side bar, try to send acknowlegements, etc.</FONT></DIV>
<DIV dir=ltr><FONT face=Arial color=#000000 size=2>2. Use the SE Troubleshoot Browser to take a look at the audit.log file and clean out anything not caused by Nagios.</FONT></DIV>
<DIV dir=ltr><FONT face=Arial size=2>3. If this isn't the first time through the steps, make a backup copy of your type enforcement settings (.te) file.</FONT></DIV>
<DIV dir=ltr><FONT face=Arial size=2>4. Run: #audit2allow -m mynagios -l -i audit.log > mynagios.te </FONT></DIV>
<DIV dir=ltr><FONT face=Arial size=2>5. If this isn't the first time through the steps, use a text editor to merge the contents of your current and previous .te files.</FONT></DIV>
<DIV dir=ltr><FONT face=Arial size=2>6. Run: #checkmodule -M -m -o mynagios.mod mynagios.te</FONT></DIV>
<DIV dir=ltr><FONT face=Arial size=2>7. Run: #semodule_package -o mynagios.pp -m mynagios.mod</FONT></DIV>
<DIV dir=ltr><FONT face=Arial size=2>8. Run: #semodule -i mynagios.pp</FONT></DIV>
<DIV dir=ltr><FONT face=Arial size=2>9. Verify your policy package has been installed by running #semodule -i</FONT></DIV>
<DIV dir=ltr><FONT face=Arial size=2>10. Return to step 1 until SELinux lets Nagios do everything Nagios needs to do.</FONT></DIV>
<DIV dir=ltr><FONT face=Arial size=2></FONT> </DIV>
<DIV dir=ltr><FONT face=Arial size=2>Keeping a backup of your type enforcement file is necessary because if Nagios is allowed to do some things, they won't continue creating entries in audit.log, and audit2allow won't pick them up the next time around. You want your .te file to accumulate all the necessary settings.</FONT></DIV>
<DIV dir=ltr><FONT face=Arial size=2></FONT> </DIV>
<DIV dir=ltr><FONT face=Arial size=2>There was a Nagios policy package installed in CentOS already, but it didn't work for me. When you create your own SELinux policy packages, give your package a unique name. I think that will prevent it from being clobbered if the stock package gets updated by your distribution's maintainer.</FONT></DIV>
<DIV dir=ltr><FONT face=Arial size=2></FONT> </DIV></DIV>
<DIV dir=ltr><BR>
<HR tabIndex=-1>
<FONT face=Tahoma size=2><B>From:</B> Stephen H. Dawson [mailto:service@shdawson.com]<BR><B>Sent:</B> Sun 2/1/2009 8:36 AM<BR><B>To:</B> nagios-users@lists.sourceforge.net<BR><B>Subject:</B> [Nagios-users] Nagios & SELinux<BR></FONT><BR></DIV>
<DIV>
<DIV><SPAN class=990142913-01022009>Good Morning,</SPAN></DIV>
<DIV><SPAN class=990142913-01022009></SPAN> </DIV><SPAN class=990142913-01022009>
<DIV><BR>We are going with SELinux on some of our servers. We are looking for anyone that uses SELinux on their Nagios machines. Preferably, best practices & what not. Any guidance would be most appreciated.</DIV>
<DIV> </DIV>
<DIV> </DIV>
<DIV><SPAN class=990142913-01022009>Thank You,<BR>Stephen H. Dawson</SPAN></SPAN></DIV></DIV><html>
<head>
<meta http-equiv="Content-Language" content="en-us">
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
<meta name="ProgId" content="FrontPage.Editor.Document">
<meta http-equiv="Content-Type" content="text/html; charset=windows-1252">
<title>New Page 1</title>
</head>
<body>
<p><font face="Arial" size="1">This message (including any attachments) is
intended only for<br>
the use of the individual or entity to which it is addressed and<br>
may contain information that is non-public, proprietary,<br>
privileged, confidential, and exempt from disclosure under<br>
applicable law or may constitute as attorney work product.<br>
If you are not the intended recipient, you are hereby notified<br>
that any use, dissemination, distribution, or copying of this<br>
communication is strictly prohibited. If you have received this<br>
communication in error, notify us immediately by telephone and<br>
(i) destroy this message if a facsimile or (ii) delete this message<br>
immediately if this is an electronic communication.</font></p>
<p><font face="Arial"><font size="1">Thank you.</font><br>
</font></p>
</body>
</html>
</BODY></HTML>