selinux policy about libzbxpgsql HOT 9 OPEN

module zabbix_agent_pg 1.0;
 
require {
type postgresql_var_run_t;
type zabbix_agent_t;
class sock_file write;
}
 
#============= zabbix_agent_t ==============
allow zabbix_agent_t postgresql_var_run_t:sock_file write;

SELinux is preventing /usr/sbin/zabbix_agentd from using the setrlimit access on a process.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that zabbix_agentd should be allowed setrlimit access on processes labeled zabbix_agent_t by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
\# ausearch -c 'zabbix_agentd' --raw | audit2allow -M my-zabbixagentd
\# semodule -i my-zabbixagentd.pp


Additional Information:
Source Context                system_u:system_r:zabbix_agent_t:s0
Target Context                system_u:system_r:zabbix_agent_t:s0
Target Objects                Unknown [ process ]
Source                        zabbix_agentd
Source Path                   /usr/sbin/zabbix_agentd
Port                          <Unknown>
Host                          <Unknown>
Source RPM Packages           zabbix-agent-3.2.3-1.el7.x86_64
Target RPM Packages
Policy RPM                    selinux-policy-3.13.1-102.el7_3.13.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     iscsi.robbrucks.com
Platform                      Linux iscsi.robbrucks.com
                              3.10.0-514.6.1.el7.x86_64 #1 SMP Wed Jan 18
                              13:06:36 UTC 2017 x86_64 x86_64
Alert Count                   8
First Seen                    2017-02-20 15:09:50 CST
Last Seen                     2017-02-20 15:11:02 CST
Local ID                      efb1c345-c86f-4c2c-bdde-8350f5610bc5

Raw Audit Messages
type=AVC msg=audit(1487625062.33:1164): avc:  denied  { setrlimit } for  pid=3074 comm="zabbix_agentd" scontext=system_u:system_r:zabbix_agent_t:s0 tcontext=system_u:system_r:zabbix_agent_t:s0 tclass=process


type=SYSCALL msg=audit(1487625062.33:1164): arch=x86_64 syscall=setrlimit success=no exit=EACCES a0=4 a1=7ffd09e50da0 a2=0 a3=7ffd09e50b20 items=0 ppid=1 pid=3074 auid=4294967295 uid=992 gid=989 euid=992 suid=992 fsuid=992 egid=989 sgid=989 fsgid=989 tty=(none) ses=4294967295 comm=zabbix_agentd exe=/usr/sbin/zabbix_agentd subj=system_u:system_r:zabbix_agent_t:s0 key=(null)

Hash: zabbix_agentd,zabbix_agent_t,zabbix_agent_t,process,setrlimit

module my-zabbixagentd 1.0;

require {
	type zabbix_agent_t;
	class process setrlimit;
}

#============= zabbix_agent_t ==============
allow zabbix_agent_t self:process setrlimit;