<html><head></head><body><div style="color:#000; background-color:#fff; font-family:HelveticaNeue-Light, Helvetica Neue Light, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:16px"><div id="yui_3_16_0_1_1458100280720_3205">J.C. I really want to buy you beer. I disabled SELinux and now it's working.<br></div><div id="yui_3_16_0_1_1458100280720_3204"><br></div><div id="yui_3_16_0_1_1458100280720_3203">[root@hhsiamxymon ~]# grep snapshot.cgi /var/log/audit/audit.log</div>type=AVC msg=audit(1458047063.222:1954): avc: denied { search } for pid=17895 comm="snapshot.cgi" name="xymon" dev="sda3" ino=2894713 scontext=system_u:system_r:httpd_sys_script_t:s0 tcontext=system_u:object_r:httpd_cache_t:s0 tclass=dir<br>type=SYSCALL msg=audit(1458047063.222:1954): arch=c000003e syscall=83 success=no exit=-13 a0=7fff496ed810 a1=1ed a2=7fff496ed836 a3=7fff496ec3d0 items=0 ppid=17723 pid=17895 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm="snapshot.cgi" exe="/usr/libexec/xymon/snapshot.cgi" subj=system_u:system_r:httpd_sys_script_t:s0 key=(null)<br><div id="yui_3_16_0_1_1458100280720_3104" dir="ltr"><br></div><div dir="ltr" id="yui_3_16_0_1_1458100280720_3049"><span id="yui_3_16_0_1_1458100280720_3195">[root@hhsiamxymon ~]# semodule -l | grep xymon<br>xymon-client 4.3.26.1.el7<br></span></div><div id="yui_3_16_0_1_1458100280720_3042" class="qtdSeparateBR"><br><br></div><div style="display: block;" id="yui_3_16_0_1_1458100280720_3041" class="yahoo_quoted"> <div id="yui_3_16_0_1_1458100280720_3040" style="font-family: HelveticaNeue-Light, Helvetica Neue Light, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px;"> <div id="yui_3_16_0_1_1458100280720_3039" style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px;"> <div id="yui_3_16_0_1_1458100280720_3038" dir="ltr"> <font id="yui_3_16_0_1_1458100280720_3037" size="2" face="Arial"> <hr id="yui_3_16_0_1_1458100280720_3057" size="1"> <b id="yui_3_16_0_1_1458100280720_3370"><span id="yui_3_16_0_1_1458100280720_3369" style="font-weight:bold;">From:</span></b> J.C. Cleaver <cleaver@terabithia.org><br> <b id="yui_3_16_0_1_1458100280720_3368"><span id="yui_3_16_0_1_1458100280720_3367" style="font-weight: bold;">To:</span></b> Jason Brockdorf <apocalysque@yahoo.com> <br><b><span style="font-weight: bold;">Cc:</span></b> "xymon@xymon.com" <xymon@xymon.com><br> <b><span style="font-weight: bold;">Sent:</span></b> Tuesday, March 15, 2016 10:38 PM<br> <b><span style="font-weight: bold;">Subject:</span></b> Re: error running report.sh<br> </font> </div> <div id="yui_3_16_0_1_1458100280720_3123" class="y_msg_container"><br><br clear="none"><br clear="none">On Tue, March 15, 2016 6:09 pm, Jason Brockdorf wrote:<br clear="none">> I'm still working on setting up Xymon (from the terabithia RPMs) and my<br clear="none">> manager tells me today that there's an error message when trying to run<br clear="none">> reports, like the availability report, snapshot report, etc.<br clear="none">> I'm getting an error message: Cannot create output directory<br clear="none">> When examining the logs for more details I don't get a whole lot to go on.<br clear="none">>  I checked with both httpd and xymon logs and I didn't see anything<br clear="none">> relevant to this problem.<br clear="none">><br clear="none">> I'm really trying to help myself and not make my problems everyone else's<br clear="none">> problems, and I'd really like to contribute to the community in some way,<br clear="none">> so here's what I've done so far to try to fix it:<br clear="none">> 1. going to the /var/cache/xymon/ directory and creating a rep directory2.<br clear="none">> giving rwxrwxrwx permissions to that directory<br clear="none">> I then managed to download the srpms from terabithia, find the offending<br clear="none">> file and examine the source to see what happens.<br clear="none">> The XYMONREPDIR environment variable is used in creating the directory<br clear="none">> where the report will go, but I don't know:<br clear="none">> 1. How to check which process is running the file that's encountering the<br clear="none">> problem (httpd or some xymon process)2. How to check for the presence or<br clear="none">> value of this variable in the environment that process is using<br clear="none">> So I decided to see if I could modify the source and make xymon give me a<br clear="none">> little more information.  The resultant patch file is attached, though be<br clear="none">> forewarned, my C experience is limited to a primer class I took as a<br clear="none">> freshman in highschool and on top of not having that much knowledge in the<br clear="none">> first place, I'm very rusty.<br clear="none">><br clear="none">>>From what I understand in the source there's not much error checking or<br clear="none">>> information provided if it fails.  I do see:<br clear="none">> envcheck(reqenv);<br clear="none">> But this by itself doesn't prevent continued execution if say my<br clear="none">> $XYMONREPDIR is not found.<br clear="none">> Well, I added a line to report which directory xymon is attempting to<br clear="none">> create, and another which should report the error message if the attempt<br clear="none">> was unsuccessful.  I did manage to create the attached patch file, but I<div class="yqt3910954283" id="yqtfd92296"><br clear="none">> was unable to recompile using the srpm *sniffle* <-- I'm crying from<br clear="none">> frustration at this point<br clear="none">> So, I downloaded the source from sourceforge, replaced the report.c file<br clear="none">> with the one I made, compiled using that, copied the report.sh file to a<br clear="none">> working xymon server to try to test it... and I get internal server error<br clear="none">> :(<br clear="none">> I then went back to test it on xymon compiled from sourceforge source, and<br clear="none">> I get an error that I don't have permission to access that directory.<br clear="none">> *rips hair out*<br clear="none">> Thus, it would seem that I am unable to reproduce the problem with "stock"<br clear="none">> xymon, and I'm apparently not bright enough to fix it with terabithia</div><br clear="none">> srpms either.  At this point, I feel like I've put in enough effort to<br clear="none">> warrant asking for help.  Anyone, please help?<br clear="none"><br clear="none"><br clear="none">Hi,<br clear="none"><br clear="none">This appears, from my testing, to be an SELinux issue -- although I'm<br clear="none">still trying to debug precisely what is happening here on the EL7 side.<br clear="none"><br clear="none">A quick workaround would be to set SELinux to permissive ('setenforce 0')<br clear="none">on the main server, which should let snapshoting/reporting work. It's<br clear="none">definitely not a normal unix permissions/ownership issue.<br clear="none"><br clear="none"><br clear="none">Can you check /var/log/audit/audit.log on your system and verify that<br clear="none">snapshot.cgi is being denied? Also, can you post the output of `semodule<br clear="none">-l | grep xymon`? If 'xymon' is not listed, can you try running:<br clear="none"><br clear="none">/usr/sbin/semodule -s targeted -i /usr/share/selinux/targeted/xymon.pp<br clear="none"><br clear="none">and post the result?<br clear="none"><br clear="none"><br clear="none">Regards,<br clear="none">-jc<div class="yqt3910954283" id="yqtfd38764"><br clear="none"><br clear="none"></div><br><br></div> </div> </div> </div></div></body></html>