I am writing a script that uses the sendmail command to send email but I am running into some issues.
When I execute the script from the shell with the icinga user it executes fine but when I try to send a notification from the web interface it returns the following:
Notification command for object 'agent1' (PID: 7467, arguments: '/usr/bin/sudo' '/usr/lib64/nagios/plugins/send-email-notification.sh') terminated with exit code 126,
output: /usr/lib64/nagios/plugins/send-email-notification.sh: line 90: /usr/sbin/sendmail: Permission denied
The SELinux flags are set as bellow:
httpd_can_connect_icinga2_api --> on
httpd_can_manage_icingaweb2_config --> on
httpd_can_write_icinga2_command --> on
icinga2_can_connect_all --> off
icinga2_run_sudo --> on
icinga2adm_exec_content --> on
The sendmail file persmissions are by default set to:
icinga2 - The Icinga 2 network monitoring daemon (version: 2.12.3)
Copyright (c) 2012-2021 Icinga GmbH (https://icinga.com/)
License GPLv2+: GNU GPL version 2 or later <http://gnu.org/licenses/gpl2.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
System information:
Platform: CentOS Linux
Platform version: 7 (Core)
Kernel: Linux
Kernel version: 3.10.0-1160.24.1.el7.x86_64
Architecture: x86_64
Build information:
Compiler: GNU 4.8.5
Build host: runner-hh8q3bz2-project-322-concurrent-0
OpenSSL version: OpenSSL 1.0.2k-fips 26 Jan 2017
Application information:
General paths:
Config directory: /etc/icinga2
Data directory: /var/lib/icinga2
Log directory: /var/log/icinga2
Cache directory: /var/cache/icinga2
Spool directory: /var/spool/icinga2
Run directory: /run/icinga2
Old paths (deprecated):
Installation root: /usr
Sysconf directory: /etc
Run directory (base): /run
Local state directory: /var
Internal paths:
Package data directory: /usr/share/icinga2
State path: /var/lib/icinga2/icinga2.state
Modified attributes path: /var/lib/icinga2/modified-attributes.conf
Objects path: /var/cache/icinga2/icinga2.debug
Vars path: /var/cache/icinga2/icinga2.vars
PID path: /run/icinga2/icinga2.pid
What is the context of /usr/lib64/nagios/plugins/send-email-notification.sh (output of ls -lZ)? Are there any entries in /var/log/audit/audit.log or what is the output of audit2allow?
I think this is the problem. Can you change the context of the file to via chcon -t nagios_notification_plugin_exec_t /usr/lib64/nagios/plugins/send-email-notification.sh and verify if this works?
If yes, you should also add it to your local policy with semanage fcontext -a -t nagios_notification_plugin_exec_t /usr/lib64/nagios/plugins/send-email-notification.sh so it can not be overwritten.
Some background: With lib_t there will happen no transition and icinga2 will try to directly executed it in its context icinga2_t what is not allowed. With nagios_notification_plugin_exec_t it will transition to nagios_notification_plugin_t which I created for the sample notification script and adjusted later on for other plugins which had problems so it should be allowed.
I change the context of the file as you said and it seems to be executing it, but I don’t receive anything.
I guess that is not related to this topic, another problem for me to solve then!
When notifications are executed successfully and Icinga shows that, next debugging step would be your local mail log. I also try to use a valid sender address so I get any bounce or similar errors in one mailbox for easier debugging.
Ok, this one is not trivial. I am not sure why it wants permissions dac_override and dac_read_search, this would be overriding and ignoring the normal linux permissions for some reason. This is something I will not include in the default policy as it is “very risky”. So I would look into the normal permissions if I can fix it. If not add a local policy allowing it or set the context to nagios_unconfined_plugin_exec_t which should allow eveerything (but not sure for these permissions). And as work-around you can tell the context to run permissive semanage permissive -a nagios_notification_plugin_t.
Ok, so in order not to push more permissions for this script, could I do something similar with the default script?
I have tried to send html with the mail or mailx commands but doesn’t seem to work. Is it possible to do so?
(It’s a different topic I know)