<html><head></head><body><div style="color:#000; background-color:#fff; font-family:Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:16px"><div><span></span></div><div>Thank you Ed, I will document this! (without EOF :) </div><div class="signature" id="yui_3_16_0_ym19_1_1506605543479_10731"><div id="yui_3_16_0_ym19_1_1506605543479_10735"> </div><div id="yui_3_16_0_ym19_1_1506605543479_10734"> </div><div id="yui_3_16_0_ym19_1_1506605543479_10733"> </div><div id="yui_3_16_0_ym19_1_1506605543479_10732"><font id="yui_3_16_0_ym19_1_1506605543479_10769" color="#007f40"><b id="yui_3_16_0_ym19_1_1506605543479_10768"><var id="yui-ie-cursor"></var>Let's go <font style="background-color: rgb(255, 255, 255);">Green</font></b></font></div><div id="yui_3_16_0_ym19_1_1506605543479_10730" style="color: rgb(0, 127, 64); font-family: arial, helvetica, clean, sans-serif; font-size: 13px; font-style: normal; background-color: rgb(255, 255, 255);"><font id="yui_3_16_0_ym19_1_1506605543479_10729" color="#000000" face="garamond, new york, times, serif" size="3"><i id="yui_3_16_0_ym19_1_1506605543479_10728">This email contains 100% recycled electrons.</i></font></div></div><div class="qtdSeparateBR" id="yui_3_16_0_ym19_1_1506605543479_10727"><br><br></div><div class="yahoo_quoted" id="yui_3_16_0_ym19_1_1506605543479_10707" style="display: block;"> <div id="yui_3_16_0_ym19_1_1506605543479_10706" style="font-family: Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px;"> <div id="yui_3_16_0_ym19_1_1506605543479_10705" style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px;"> <div id="yui_3_16_0_ym19_1_1506605543479_10771" dir="ltr"> <font id="yui_3_16_0_ym19_1_1506605543479_10770" face="Arial" size="2"> <hr size="1"> <b><span style="font-weight: bold;">From:</span></b> "EDSchminke@Hormel.com" <EDSchminke@Hormel.com><br> <b><span style="font-weight: bold;">To:</span></b> xymon@xymon.com; kern_doe@yahoo.com <br> <b><span style="font-weight: bold;">Sent:</span></b> Thursday, September 28, 2017 10:00 AM<br> <b><span style="font-weight: bold;">Subject:</span></b> Re: [Xymon] First time installed, and set up xymon, failed, NEED helps please.<br> </font> </div> <div class="y_msg_container" id="yui_3_16_0_ym19_1_1506605543479_10704"><br><div id="yui_3_16_0_ym19_1_1506605543479_10703" dir="ltr"><br></div><div id="yui_3_16_0_ym19_1_1506605543479_10772" dir="ltr">*****PLEASE***** do NOT leave SELinux in permissive mode. (<br></div><div dir="ltr"><a href="http://stopdisablingselinux.com/" target="_blank">http://stopdisablingselinux.com/</a>)<br></div><div id="yui_3_16_0_ym19_1_1506605543479_10708" dir="ltr"><br></div><div dir="ltr">I have beat SELinux into submission to make Xymon work the way I need it<br></div><div dir="ltr">to. You can do the same by following my procedure below, or from watching<br></div><div id="yui_3_16_0_ym19_1_1506605543479_10773" dir="ltr">Thomas Cameron's lecture from RedHat Summit a couple years ago "SELinux For<br></div><div dir="ltr">Mere Mortals" (<a href="https://www.youtube.com/watch?v=cNoVgDqqJmM" target="_blank">https://www.youtube.com/watch?v=cNoVgDqqJmM</a>) I built mine<br></div><div dir="ltr">from the tips given in this video.<br></div><div dir="ltr"><br></div><div id="yui_3_16_0_ym19_1_1506605543479_10774" dir="ltr">As root:<br></div><div dir="ltr">#> setsebool -P httpd_enable_homedirs on<br></div><div id="yui_3_16_0_ym19_1_1506605543479_10709" dir="ltr">#> setsebool -P httpd_read_user_content on<br></div><div id="yui_3_16_0_ym19_1_1506605543479_10710" dir="ltr"><br></div><div id="yui_3_16_0_ym19_1_1506605543479_10780" dir="ltr">A few things can't be done for Xymon by simply changing SELinux booleans.<br></div><div id="yui_3_16_0_ym19_1_1506605543479_10779" dir="ltr">I've curated a number of SELinux policy exceptions over the past couple<br></div><div id="yui_3_16_0_ym19_1_1506605543479_10775" dir="ltr">years in order to make Xymon and SELinux play nice together. You can<br></div><div id="yui_3_16_0_ym19_1_1506605543479_10776" dir="ltr">create yours by doing this:<br></div><div id="yui_3_16_0_ym19_1_1506605543479_10777" dir="ltr"><br></div><div id="yui_3_16_0_ym19_1_1506605543479_10778" dir="ltr">## vvvvvv ---- copy everything below this line ---- vvvvvv ##<br></div><div id="yui_3_16_0_ym19_1_1506605543479_10781" dir="ltr">module xymon 1.0;<br></div><div id="yui_3_16_0_ym19_1_1506605543479_10711" dir="ltr"><br></div><div dir="ltr">require {<br></div><div dir="ltr"> type unconfined_t;<br></div><div id="yui_3_16_0_ym19_1_1506605543479_10712" dir="ltr"> type var_log_t;<br></div><div dir="ltr"> type initrc_t;<br></div><div dir="ltr"> type admin_home_t;<br></div><div id="yui_3_16_0_ym19_1_1506605543479_10782" dir="ltr"> type httpd_t;<br></div><div dir="ltr"> type user_home_t;<br></div><div id="yui_3_16_0_ym19_1_1506605543479_10713" dir="ltr"> type fonts_cache_t;<br></div><div dir="ltr"> type port_t;<br></div><div id="yui_3_16_0_ym19_1_1506605543479_10714" dir="ltr"> class tcp_socket name_connect;<br></div><div dir="ltr"> class file { rename execute setattr read create execute_no_trans<br></div><div dir="ltr">write getattr unlink open };<br></div><div dir="ltr"> class sock_file write;<br></div><div dir="ltr"> class lnk_file { create unlink };<br></div><div id="yui_3_16_0_ym19_1_1506605543479_10715" dir="ltr"> class unix_dgram_socket sendto;<br></div><div dir="ltr"> class dir { write rmdir setattr remove_name create add_name };<br></div><div dir="ltr">}<br></div><div id="yui_3_16_0_ym19_1_1506605543479_10716" dir="ltr"><br></div><div id="yui_3_16_0_ym19_1_1506605543479_10717" dir="ltr">#============= httpd_t ==============<br></div><div id="yui_3_16_0_ym19_1_1506605543479_10718" dir="ltr">allow httpd_t admin_home_t:file { read getattr open };<br></div><div dir="ltr">allow httpd_t fonts_cache_t:dir setattr;<br></div><div id="yui_3_16_0_ym19_1_1506605543479_10719" dir="ltr">allow httpd_t initrc_t:unix_dgram_socket sendto;<br></div><div dir="ltr">allow httpd_t port_t:tcp_socket name_connect;<br></div><div dir="ltr">allow httpd_t unconfined_t:unix_dgram_socket sendto;<br></div><div id="yui_3_16_0_ym19_1_1506605543479_10720" dir="ltr">allow httpd_t user_home_t:dir rmdir;<br></div><div dir="ltr">allow httpd_t user_home_t:dir { write remove_name create add_name };<br></div><div dir="ltr">allow httpd_t user_home_t:file setattr;<br></div><div dir="ltr">allow httpd_t user_home_t:file { rename write execute create unlink<br></div><div id="yui_3_16_0_ym19_1_1506605543479_10726" dir="ltr">execute_no_trans };<br></div><div dir="ltr">allow httpd_t user_home_t:lnk_file { create unlink };<br></div><div id="yui_3_16_0_ym19_1_1506605543479_10721" dir="ltr">allow httpd_t user_home_t:sock_file write;<br></div><div dir="ltr">allow httpd_t var_log_t:file read;<br></div><div dir="ltr">EOF<br></div><div id="yui_3_16_0_ym19_1_1506605543479_10725" dir="ltr">## ^^^^^ ---- to everything above this line ---- ^^^^^^ ##<br></div><div dir="ltr"><br></div><div dir="ltr">Paste what you've copied into a file-- doesn't matter where; I've used the<br></div><div dir="ltr">name "xymon.te"<br></div><div dir="ltr">#> vi xymon.te<br></div><div id="yui_3_16_0_ym19_1_1506605543479_10722" dir="ltr"><br></div><div id="yui_3_16_0_ym19_1_1506605543479_10724" dir="ltr">Run the following commands to build the SELinux policy module:<br></div><div dir="ltr">#> checkmodule -M -m -o xymon.mod xymon.te<br></div><div dir="ltr">#> semodule_package -m xymon.mod -o xymon.pp<br></div><div dir="ltr"><br></div><div id="yui_3_16_0_ym19_1_1506605543479_10783" dir="ltr">Run this command to install the policy module.<br></div><div id="yui_3_16_0_ym19_1_1506605543479_10784" dir="ltr">#> semodule -i xymon.pp<br></div><div id="yui_3_16_0_ym19_1_1506605543479_10785" dir="ltr"><br></div><div id="yui_3_16_0_ym19_1_1506605543479_10786" dir="ltr">Change your /etc/sysconfig/selinux back to "enforcing".<br></div><div id="yui_3_16_0_ym19_1_1506605543479_10787" dir="ltr">Reboot.<br></div><div id="yui_3_16_0_ym19_1_1506605543479_10788" dir="ltr"><br></div><div id="yui_3_16_0_ym19_1_1506605543479_10789" dir="ltr">If you see any funkiness, watch /var/log/audit/audit.log for AVC denials.<br></div><div id="yui_3_16_0_ym19_1_1506605543479_10790" dir="ltr"><br></div><div id="yui_3_16_0_ym19_1_1506605543479_10791" dir="ltr">#> grep type=AVC /var/log/audit/audit.log | grep denied<br></div><div id="yui_3_16_0_ym19_1_1506605543479_10792" dir="ltr"><br></div><div dir="ltr">If you see anything in there, it means it's time to "build a policy<br></div><div dir="ltr">exception" not "disable SELinux".<br></div><div id="yui_3_16_0_ym19_1_1506605543479_10723" dir="ltr"><br></div><div dir="ltr"><br></div><div dir="ltr">--------------------------------------------------------------------------------<br></div><div dir="ltr"><br></div><div dir="ltr"><br></div><div dir="ltr">Everyone was right on followings:<br></div><div dir="ltr"> added this line at the bottom of file /etc/httpd/conf/httpd.conf:<br></div><div dir="ltr"> include /home/xymon/server/etc/xymon-apache.conf<br></div><div dir="ltr"><br></div><div dir="ltr">and Paul Root was right about Selinux, so I did:<br></div><div dir="ltr"><br></div><div dir="ltr"> modified file /etc/sysconfig/selinux<br></div><div dir="ltr"> #SELINUX=enforcing KERN testing ....<br></div><div dir="ltr"> SELINUX=permissive<br></div><div dir="ltr"> rebooted.<br></div><div dir="ltr"><br></div><div dir="ltr">it works now!!!<br></div><div dir="ltr">Thank you!!!I can go home and feel good, will do more learning tomorrow :)<br></div><div dir="ltr"> Let's go GreenThis email contains 100% recycled electrons.<br></div><div dir="ltr"><br></div><div dir="ltr"><br></div><div dir="ltr"><br></div><div dir="ltr">Erik D. Schminke | Associate Systems Programmer<br></div><div dir="ltr">Hormel Foods Corporation | One Hormel Place | Austin, MN 55912<br></div><div dir="ltr">Phone: <span class="baec5a81-e4d6-4674-97f3-e9220f0136c1" style="white-space: nowrap;">(507) 434-6817<a title="Call: (507) 434-6817" style="margin: 0px; border: currentColor; border-image: none; left: 0px; top: 0px; width: 16px; height: 16px; right: 0px; bottom: 0px; overflow: hidden; vertical-align: middle; float: none; display: inline; white-space: nowrap; position: static !important;" href="https://mg.mail.yahoo.com/?.src=neo&reason=bkt_myc#"><img class="ymail-preserve-class rte-inline-unsaved-image inline-image-guid-41065a85-8c9c-5acd-f831-76b8f75c13f6" style="width: 100%; max-height: 16px; max-width: 16px;" alt="Inline image" src="blob:C9C407A0-22ED-4E65-AC1D-EB51AFD92CC3" data-id="inline-image-guid-41065a85-8c9c-5acd-f831-76b8f75c13f6"><br></a></span><br></div><div dir="ltr"><a href="mailto:edschminke@hormel.com" ymailto="mailto:edschminke@hormel.com">edschminke@hormel.com</a> | www.hormelfoods.com<br></div><div dir="ltr"><br></div><br><br></div> </div> </div> </div></div></body></html>