Description of problem:

The RHDS SNMP agent fails to start with selinux SELinux errors
There are several SELinux definitions that are missing

Version-Release number of selected component (if applicable):
RHDS-11.5 on RHEL-8.6

How reproducible:
on demand

Steps to Reproduce:

1. Have RHDS-11.5 installed and an instance running with some data

2. for the admin guide to start the SNMP configuration
https://access.redhat.com/documentation/en-us/red_hat_directory_server/11/html/administration_guide/monitoring_ds_using_snmp#doc-wrapper
21.10. Monitoring Directory Server Using SNMP
21.10.4. Setting up an SNMP Agent for Directory Server

An RHDS instance is running:
dsctl m1 status
Instance "m1" is running

SNMP is configured:
systemctl start snmpd
ps ax | egrep "snmp|agent"
35799 ? Ss 0:00 /usr/sbin/snmpd -LS0-6d -f

3. 21.10.4. Setting up an SNMP Agent for Directory Server
Start the dirsrv-snmp service:

Actual results:

Job for dirsrv-snmp.service failed because the control process exited with error code.
See "systemctl status dirsrv-snmp.service" and "journalctl -xe" for details.
[root@m1 ~]#

Expected results:
yes
see "solution" at the end of "Additional Information"

Additional info:

RHDS-11.5 RHEL-8.6

cat /etc/redhat-release ; uname -a ; rpm -q nss nspr 389-ds-base redhat-ds sssd
Red Hat Enterprise Linux release 8.6 (Ootpa)
Linux m1.example.test 4.18.0-372.9.1.el8.x86_64 #1 SMP Fri Apr 15 22:12:19 EDT 2022 x86_64 x86_64 x86_64 GNU/Linux
nss-3.67.0-7.el8_5.x86_64
nspr-4.32.0-1.el8_4.x86_64
389-ds-base-1.4.3.29-3.module+el8dsrv+14615+a86efbbf.x86_64
package redhat-ds is not installed
sssd-2.6.2-3.el8.x86_64
[root@m1 ~]#

yum module info redhat-ds:11 | less
...
Name : redhat-ds
Stream : 11 [d][e][a]
Version : 8060020220328133644
Context : fd2afb17
Architecture : x86_64
Profiles : default [d] [i], legacy, minimal
Default profiles : default
Repo : dirsrv-11-for-rhel-8-x86_64-rpms
Summary : Red Hat Directory Server 11.5
Description : The Red Hat Directory Server is an LDAPv3 compliant server.
Requires : platform:[el8]
Artifacts : 389-ds-base-0:1.4.3.29-3.module+el8dsrv+14615+a86efbbf.src
: 389-ds-base-0:1.4.3.29-3.module+el8dsrv+14615+a86efbbf.x86_64
: 389-ds-base-debuginfo-0:1.4.3.29-3.module+el8dsrv+14615+a86efbbf.x86_64
: 389-ds-base-debugsource-0:1.4.3.29-3.module+el8dsrv+14615+a86efbbf.x86_64
: 389-ds-base-devel-0:1.4.3.29-3.module+el8dsrv+14615+a86efbbf.x86_64
: 389-ds-base-legacy-tools-0:1.4.3.29-3.module+el8dsrv+14615+a86efbbf.x86_64
: 389-ds-base-legacy-tools-debuginfo-0:1.4.3.29-3.module+el8dsrv+14615+a86efbbf.x86_64
: 389-ds-base-libs-0:1.4.3.29-3.module+el8dsrv+14615+a86efbbf.x86_64
: 389-ds-base-libs-debuginfo-0:1.4.3.29-3.module+el8dsrv+14615+a86efbbf.x86_64
: 389-ds-base-snmp-0:1.4.3.29-3.module+el8dsrv+14615+a86efbbf.x86_64
: 389-ds-base-snmp-debuginfo-0:1.4.3.29-3.module+el8dsrv+14615+a86efbbf.x86_64
: cockpit-389-ds-0:1.4.3.29-3.module+el8dsrv+14615+a86efbbf.noarch
: python3-lib389-0:1.4.3.29-3.module+el8dsrv+14615+a86efbbf.noarch

Hint: [d]efault, [e]nabled, [x]disabled, [i]nstalled, [a]ctive
(END)

...

systemctl start dirsrv-snmp
Job for dirsrv-snmp.service failed because the control process exited with error code.
See "systemctl status dirsrv-snmp.service" and "journalctl -xe" for details.
[root@m1 ~]#

ps ax | egrep "snmp|agent"
35799 ? Ss 0:00 /usr/sbin/snmpd -LS0-6d -f
[root@m1 ~]#

snmpwalk -v3 localhost -l AuthPriv -u snmpuser -A password -a SHA -X password -x AES -M /usr/share/snmp/mibs:/usr/share/dirsrv/mibs/ -m +RHDS-MIB | grep -i rhds
->
nothing

less /var/log/messages
...
Oct 3 19:04:36 m1 setroubleshoot[57601]: SELinux is preventing /usr/sbin/snmpd from sys_ptrace access on the cap_userns labeled snmpd_t. For complete SELinux messages run: sealert -l d5ce697b-7ad1-41e8-8c69-0320ed90c703
Oct 3 19:04:36 m1 setroubleshoot[57601]: SELinux is preventing /usr/sbin/snmpd from sys_ptrace access on the cap_userns labeled snmpd_t.#012#012***** Plugin catchall (100. confidence) suggests **************************#012#012If you believe that snmpd should be allowed sys_ptrace access on cap_userns labeled snmpd_t by default.#012Then you should report this as a bug.#012You can generate a local policy module to allow this access.#012Do#012allow this access for now by executing:#012# ausearch -c 'snmpd' --raw | audit2allow -M my-snmpd#012# semodule -X 300 -i my-snmpd.pp#012
(END)

sealert -l d5ce697b-7ad1-41e8-8c69-0320ed90c703
SELinux is preventing /usr/sbin/snmpd from sys_ptrace access on the cap_userns labeled snmpd_t.

• • • • • Plugin catchall (100. confidence) suggests **************************

If you believe that snmpd should be allowed sys_ptrace access on cap_userns labeled snmpd_t by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:

1. ausearch -c 'snmpd' --raw | audit2allow -M my-snmpd
   MPORTANT ***********************
   To make this policy package active, execute:

semodule -i my-snmpd.pp

[root@m1 ~]#

semodule -X 300 -i my-snmpd.pp

Source Context system_u:system_r:snmpd_t:s0
Target Context system_u:system_r:snmpd_t:s0
Target Objects Unknown [ cap_userns ]
Source snmpd
Source Path /usr/sbin/snmpd
Port <Unknown>
Host m1.example.test
Source RPM Packages
Target RPM Packages
SELinux Policy RPM selinux-policy-targeted-3.14.3-95.el8.noarch
Local Policy RPM selinux-policy-targeted-3.14.3-95.el8.noarch
Selinux Enabled True
Policy Type targeted
Enforcing Mode Enforcing
Host Name m1.example.test
Platform Linux m1.example.test 4.18.0-372.9.1.el8.x86_64 #1
SMP Fri Apr 15 22:12:19 EDT 2022 x86_64 x86_64
Alert Count 745
First Seen 2022-10-03 18:58:32 GMT
Last Seen 2022-10-03 19:03:40 GMT
Local ID d5ce697b-7ad1-41e8-8c69-0320ed90c703

Raw Audit Messages
type=AVC msg=audit(1664823820.832:970): avc: denied

{ sys_ptrace }

for pid=35799 comm="snmpd" capability=19 scontext=system_u:system_r:snmpd_t:s0 tcontext=system_u:system_r:snmpd_t:s0 tclass=cap_userns permissive=0

Hash: snmpd,snmpd_t,snmpd_t,cap_userns,sys_ptrace

[root@m1 ~]#

->

ausearch -c 'snmpd' --raw | audit2allow -M my-snmpd

• • • • • • • • • • • • • • • • • • • • IMPORTANT ***********************
                                        To make this policy package active, execute:
                                        semodule -i my-snmpd.pp
                                        [root@m1 ~]#

semodule -X 300 -i my-snmpd.pp

systemctl start dirsrv-snmp
Job for dirsrv-snmp.service failed because the control process exited with error code.
See "systemctl status dirsrv-snmp.service" and "journalctl -xe" for details.
[root@m1 ~]#

journalctl -xe
Oct 03 19:14:11 m1.example.test systemd[1]: Starting 389 Directory Server SNMP Subagent....
– Subject: Unit dirsrv-snmp.service has begun start-up
– Defined-By: systemd
– Support: https://access.redhat.com/support
–
-- Unit dirsrv-snmp.service has begun starting up.
Oct 03 19:14:11 m1.example.test dbus-daemon[893]: [system] Activating service name='org.fedoraproject.Setroubleshootd' requested by ':1.211' (uid=0 pid=851 comm="/usr/sbin/sedispatch " label="system_u:system_r:auditd_t:s0") (using service>
Oct 03 19:14:11 m1.example.test dbus-daemon[893]: [system] Successfully activated service 'org.fedoraproject.Setroubleshootd'
Oct 03 19:14:13 m1.example.test setroubleshoot[60443]: Deleting alert d5ce697b-7ad1-41e8-8c69-0320ed90c703, it is allowed in current policy
Oct 03 19:14:13 m1.example.test setroubleshoot[60443]: AnalyzeThread.run(): Cancel pending alarm
Oct 03 19:14:13 m1.example.test dbus-daemon[893]: [system] Activating service name='org.fedoraproject.SetroubleshootPrivileged' requested by ':1.543' (uid=991 pid=60443 comm="/usr/libexec/platform-python -Es /usr/sbin/setroub" label="syst>
Oct 03 19:14:13 m1.example.test dbus-daemon[893]: [system] Successfully activated service 'org.fedoraproject.SetroubleshootPrivileged'
Oct 03 19:14:14 m1.example.test setroubleshoot[60443]: SELinux is preventing /usr/sbin/ldap-agent from using the dac_override capability. For complete SELinux messages run: sealert -l de96bd1a-58ba-47a9-b2a6-8afe1dd995fb
Oct 03 19:14:14 m1.example.test setroubleshoot[60443]: SELinux is preventing /usr/sbin/ldap-agent from using the dac_override capability.

• • • • • Plugin dac_override (91.4 confidence) suggests **********************

If you want to help identify if domain needs this access or you have a file with the wrong permissions on your system
Then turn on full auditing to get path information about the offending file and generate the error again.
Do

Turn on full auditing

1. auditctl -w /etc/shadow -p w
   Try to recreate AVC. Then execute
2. ausearch -m avc -ts recent
   If you see PATH record check ownership/permissions on file, and fix it,
   otherwise report as a bugzilla.

• • • • • Plugin catchall (9.59 confidence) suggests **************************

If you believe that ldap-agent should have the dac_override capability by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:

1. ausearch -c 'ldap-agent' --raw | audit2allow -M my-ldapagent
2. semodule -X 300 -i my-ldapagent.pp

Oct 03 19:14:14 m1.example.test setroubleshoot[60443]: AnalyzeThread.run(): Set alarm timeout to 10
Oct 03 19:14:16 m1.example.test setroubleshoot[60443]: AnalyzeThread.run(): Cancel pending alarm
...
– Unit dirsrv-snmp.service has failed.
–
-- The result is failed.
lines 3659-3684/3684 (END)

ausearch -c 'ldap-agent' --raw | audit2allow -M my-ldapagent

• • • • • • • • • • • • • • • • • • • • IMPORTANT ***********************
                                        To make this policy package active, execute:

semodule -i my-ldapagent.pp

[root@m1 ~]#

semodule -X 300 -i my-ldapagent.pp

systemctl start dirsrv-snmp
Job for dirsrv-snmp.service failed because the control process exited with error code.
See "systemctl status dirsrv-snmp.service" and "journalctl -xe" for details.
[root@m1 ~]#

Oct 03 19:20:11 m1.example.test systemd[1]: Starting 389 Directory Server SNMP Subagent....
– Subject: Unit dirsrv-snmp.service has begun start-up
– Defined-By: systemd
– Support: https://access.redhat.com/support
–
-- Unit dirsrv-snmp.service has begun starting up.
Oct 03 19:20:14 m1.example.test dbus-daemon[893]: [system] Activating service name='org.fedoraproject.Setroubleshootd' requested by ':1.211' (uid=0 pid=851 comm="/usr/sbin/sedispatch " label="system_u:system_r:auditd_t:s0") (using service>
Oct 03 19:20:14 m1.example.test dbus-daemon[893]: [system] Successfully activated service 'org.fedoraproject.Setroubleshootd'
Oct 03 19:20:15 m1.example.test setroubleshoot[62262]: AnalyzeThread.run(): Cancel pending alarm
Oct 03 19:20:16 m1.example.test dbus-daemon[893]: [system] Activating service name='org.fedoraproject.SetroubleshootPrivileged' requested by ':1.551' (uid=991 pid=62262 comm="/usr/libexec/platform-python -Es /usr/sbin/setroub" label="syst>
Oct 03 19:20:16 m1.example.test dbus-daemon[893]: [system] Successfully activated service 'org.fedoraproject.SetroubleshootPrivileged'
Oct 03 19:20:16 m1.example.test setroubleshoot[62262]: SELinux is preventing /usr/sbin/ldap-agent from using the dac_override capability. For complete SELinux messages run: sealert -l de96bd1a-58ba-47a9-b2a6-8afe1dd995fb
Oct 03 19:20:16 m1.example.test setroubleshoot[62262]: SELinux is preventing /usr/sbin/ldap-agent from using the dac_override capability.

• • • • • Plugin dac_override (91.4 confidence) suggests **********************

If you want to help identify if domain needs this access or you have a file with the wrong permissions on your system
Then turn on full auditing to get path information about the offending file and generate the error again.
Do

Turn on full auditing

1. auditctl -w /etc/shadow -p w
   Try to recreate AVC. Then execute
2. ausearch -m avc -ts recent
   If you see PATH record check ownership/permissions on file, and fix it,
   otherwise report as a bugzilla.

• • • • • Plugin catchall (9.59 confidence) suggests **************************

If you believe that ldap-agent should have the dac_override capability by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:

1. ausearch -c 'ldap-agent' --raw | audit2allow -M my-ldapagent
2. semodule -X 300 -i my-ldapagent.pp

Oct 03 19:20:16 m1.example.test setroubleshoot[62262]: AnalyzeThread.run(): Set alarm timeout to 10
Oct 03 19:20:25 m1.example.test setroubleshoot[62262]: AnalyzeThread.run(): Cancel pending alarm

ausearch -c 'ldap-agent' --raw | audit2allow -M my-ldapagent

• • • • • • • • • • • • • • • • • • • • IMPORTANT ***********************
                                        To make this policy package active, execute:

semodule -i my-ldapagent.pp

[root@m1 ~]#

semodule -X 300 -i my-ldapagent.pp

systemctl start dirsrv-snmp
FAILs

snmpwalk -v3 localhost -l AuthPriv -u snmpuser -A password -a SHA -X password -x AES -M /usr/share/snmp/mibs:/usr/share/dirsrv/mibs/ -m +RHDS-MIB | grep -i rhds
nothing

solution:

add some missing SELinux configuration:

cat << EOF > ~/rhds_snmp_selinux.te
module rhds_snmp_selinux 1.0;

require {
type dirsrv_t;
type kernel_t;
type dirsrv_tmpfs_t;
type dirsrv_var_run_t;
type dirsrv_snmp_t;
class file map;
class dir write;
class file

{ create map write }

;
class dir add_name;
class capability dac_override;
class system module_request;
}

#============= dirsrv_snmp_t ==============

allow dirsrv_snmp_t dirsrv_var_run_t:dir write;
allow dirsrv_snmp_t dirsrv_var_run_t:dir add_name;
allow dirsrv_snmp_t dirsrv_var_run_t:file map;
allow dirsrv_snmp_t dirsrv_var_run_t:file create;
allow dirsrv_snmp_t dirsrv_var_run_t:file

{ create map }

;
allow dirsrv_snmp_t dirsrv_var_run_t:file write;
allow dirsrv_snmp_t self:capability dac_override;
allow dirsrv_t kernel_t:system module_request;

EOF

checkmodule -M -m -o ~/rhds_snmp_selinux.mod ~/rhds_snmp_selinux.te
semodule_package -o ~/rhds_snmp_selinux.pp -m ~/rhds_snmp_selinux.mod
semodule -i ~/rhds_snmp_selinux.pp

systemctl start dirsrv-snmp
[root@m1 ~]#

ps ax | egrep "snmp|agent|dirsrv"
1351 ? Ssl 0:19 /usr/sbin/ns-slapd -D /etc/dirsrv/slapd-m1 -i /run/dirsrv/slapd-m1.pid
35799 ? Ss 0:04 /usr/sbin/snmpd -LS0-6d -f
65752 ? S 0:00 /usr/sbin/ldap-agent /etc/dirsrv/config/ldap-agent.conf
[root@m1 ~]#

snmpwalk -v3 localhost -l AuthPriv -u snmpuser -A password -a SHA -X password -x AES -M /usr/share/snmp/mibs:/usr/share/dirsrv/mibs/ -m +RHDS-MIB | grep -i rhds
HOST-RESOURCES-MIB::hrSWRunParameters.66350 = STRING: "--color=auto -i rhds"

snmpwalk -v3 localhost -l AuthPriv -u snmpuser -A password -a SHA -X password -x AES -M /usr/share/snmp/mibs:/usr/share/dirsrv/mibs/ -m +RHDS-MIB .1.3.6.1.4.1.2312.6 | less
RHDS-MIB::dsAnonymousBinds.389 = Counter64: 0
RHDS-MIB::dsUnAuthBinds.389 = Counter64: 0
...snip...