{"update": {"autokarma": true, "autotime": false, "stable_karma": 3, "stable_days": 0, "unstable_karma": -3, "require_bugs": true, "require_testcases": true, "display_name": "", "notes": "Fix BZ#1674258 add explicite User and Group to systemctl startup.", "type": "bugfix", "status": "obsolete", "request": null, "severity": "unspecified", "suggest": "unspecified", "locked": false, "pushed": true, "critpath": false, "critpath_groups": null, "close_bugs": true, "date_submitted": "2019-02-22 17:59:30", "date_modified": null, "date_approved": null, "date_testing": "2019-02-23 02:44:45", "date_stable": null, "alias": "FEDORA-2019-6d3112aae3", "test_gating_status": "ignored", "from_tag": null, "date_pushed": "2019-02-23 02:44:45", "meets_testing_requirements": true, "url": "https://bodhi.stg.fedoraproject.org/updates/FEDORA-2019-6d3112aae3", "title": "nagios-4.4.3-4.fc28", "version_hash": "130f04500531d63f9c56917f836c764c7758cd15", "release": {"name": "F28", "long_name": "Fedora 28", "version": "28", "id_prefix": "FEDORA", "branch": "f28", "dist_tag": "f28", "stable_tag": "f28-updates", "testing_tag": "f28-updates-testing", "candidate_tag": "f28-updates-candidate", "pending_signing_tag": "f28-signing-pending", "pending_testing_tag": "f28-updates-testing-pending", "pending_stable_tag": "f28-updates-pending", "override_tag": "f28-override", "mail_template": "fedora_errata_template", "state": "archived", "composed_by_bodhi": true, "create_automatic_updates": null, "package_manager": "dnf", "testing_repository": "updates-testing", "released_on": null, "eol": null, "critpath_mandatory_days_in_testing": 14, "mandatory_days_in_testing": 7, "critpath_min_karma": 2, "min_karma": 1, "setting_status": null}, "user": {"name": "smooge", "email": "smooge@redhat.com", "id": 398, "avatar": "https://seccdn.libravatar.org/avatar/7307344b121111b0fbfe3858b100a8e005c8757a552ec5e813ac4320b18c6162?s=24&d=retro", "openid": "smooge.id.stg.fedoraproject.org", "groups": [{"name": "packager"}, {"name": "epel-cabal"}, {"name": "epelproject"}, {"name": "fedorabugs"}, {"name": "sysadmin-noc"}, {"name": "epel-wranglers"}, {"name": "signed_fpca"}, {"name": "wikiadmin"}, {"name": "sysadmin-veteran"}, {"name": "fedora-contributor"}, {"name": "centosproject-email-aliases"}, {"name": "fi-apprentice"}, {"name": "qa_users"}, {"name": "ipausers"}, {"name": "communishift"}, {"name": "sysadmin-ppc"}, {"name": "sysadmin-centos"}, {"name": "sysadmin-backup"}, {"name": "sysadmin-analysis"}, {"name": "accounts"}, {"name": "sysadmin-securit"}, {"name": "epel-packagers-sig"}, {"name": "sysadmin-devel"}, {"name": "vendor-support"}, {"name": "sysadmin-teleirc"}, {"name": "sysadmin"}, {"name": "gitfedora-zikula"}, {"name": "aws-infra"}, {"name": "admins"}, {"name": "sysadmin-web"}, {"name": "sysadmin-accounts"}, {"name": "sysadmin-logs"}, {"name": "sysadmin-cloud"}, {"name": "sysadmin-dns"}, {"name": "sysadmin-calendar"}, {"name": "sig-infra"}, {"name": "atomic"}, {"name": "sysadmin-main"}, {"name": "gitsecstate"}, {"name": "sysadmin-dba"}, {"name": "sysadmin-survey"}, {"name": "sysadmin-hosted"}]}, "comments": [{"karma": 0, "karma_critpath": 0, "text": "This update has been submitted for testing by smooge. ", "timestamp": "2019-02-22 17:59:30", "update_id": 132232, "user_id": 91, "id": 898642, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "bodhi", "email": null, "id": 91, "avatar": "https://apps.fedoraproject.org/img/icons/bodhi-24.png", "openid": "bodhi.id.stg.fedoraproject.org", "groups": []}}, {"karma": 0, "karma_critpath": 0, "text": "This update has been pushed to testing.", "timestamp": "2019-02-23 02:45:24", "update_id": 132232, "user_id": 91, "id": 898892, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "bodhi", "email": null, "id": 91, "avatar": "https://apps.fedoraproject.org/img/icons/bodhi-24.png", "openid": "bodhi.id.stg.fedoraproject.org", "groups": []}}, {"karma": 0, "karma_critpath": 0, "text": "This update has reached 7 days in testing and can be pushed to stable now if the maintainer wishes", "timestamp": "2019-03-02 06:01:34", "update_id": 132232, "user_id": 91, "id": 902440, "bug_feedback": [], "testcase_feedback": [], "user": {"name": "bodhi", "email": null, "id": 91, "avatar": "https://apps.fedoraproject.org/img/icons/bodhi-24.png", "openid": "bodhi.id.stg.fedoraproject.org", "groups": []}}], "builds": [{"nvr": "nagios-4.4.3-4.fc28", "signed": true, "release_id": 21, "type": "rpm", "epoch": 0}], "bugs": [{"bug_id": 1674258, "title": "Nagios will not start due to SELinux denials", "security": false, "parent": false, "feedback": [{"karma": 1, "comment_id": 899033, "bug_id": 1674258, "comment": {"karma": 0, "karma_critpath": 0, "text": "", "timestamp": "2019-02-23 12:29:02", "update_id": 132230, "user_id": 207, "id": 899033, "testcase_feedback": [], "user": {"name": "anonymous", "email": null, "id": 207, "avatar": "https://seccdn.libravatar.org/avatar/37a8eec1ce19687d132fe29051dca629d164e2c4958ba141d5f4133a33f0688f?s=24&d=retro", "openid": "anonymous.id.stg.fedoraproject.org", "groups": []}}}, {"karma": 1, "comment_id": 899034, "bug_id": 1674258, "comment": {"karma": 0, "karma_critpath": 0, "text": "", "timestamp": "2019-02-23 12:30:01", "update_id": 132230, "user_id": 207, "id": 899034, "testcase_feedback": [], "user": {"name": "anonymous", "email": null, "id": 207, "avatar": "https://seccdn.libravatar.org/avatar/37a8eec1ce19687d132fe29051dca629d164e2c4958ba141d5f4133a33f0688f?s=24&d=retro", "openid": "anonymous.id.stg.fedoraproject.org", "groups": []}}}, {"karma": 1, "comment_id": 899397, "bug_id": 1674258, "comment": {"karma": 1, "karma_critpath": 0, "text": "This update solves the problem.", "timestamp": "2019-02-24 11:10:55", "update_id": 132230, "user_id": 1677, "id": 899397, "testcase_feedback": [], "user": {"name": "imsedgar", "email": "edgar.hoch@ims.uni-stuttgart.de", "id": 1677, "avatar": "https://seccdn.libravatar.org/avatar/6e9b05dfa070935c2e346cbab6b2b1c8faf64ce0347014f6be1824911c0d1c33?s=24&d=retro", "openid": "imsedgar.id.stg.fedoraproject.org", "groups": [{"name": "ipausers"}, {"name": "signed_fpca"}, {"name": "trust admins"}]}}}, {"karma": 1, "comment_id": 900206, "bug_id": 1674258, "comment": {"karma": 1, "karma_critpath": 0, "text": "Nagios runs for me, so I'd say #1674258 is fixed.\n\nThe package upgrade should have done a systemctl daemon-reload because the systemd unit changed. I had to do that manually because systemd complained that the unit changed on disk.\n\nAlso there is still the minor problem that /usr/lib/systemd/system/nagios.service is marked executable.", "timestamp": "2019-02-26 02:52:24", "update_id": 132233, "user_id": 4761, "id": 900206, "testcase_feedback": [], "user": {"name": "kenyon", "email": "kenyon@kenyonralph.com", "id": 4761, "avatar": "https://seccdn.libravatar.org/avatar/e3f833578def7f10f0227fcf93b83a728e8d46327904c52e2b44b8627c0d1d5d?s=24&d=retro", "openid": "kenyon.id.stg.fedoraproject.org", "groups": [{"name": "ipausers"}, {"name": "signed_fpca"}]}}}, {"karma": -1, "comment_id": 900273, "bug_id": 1674258, "comment": {"karma": -1, "karma_critpath": 0, "text": "Actually, it doesn't work.\n\nIt seems that maybe the fix for https://bugzilla.redhat.com/show_bug.cgi?id=1592594 caused another problem. Now I get these SELinux denials from httpd that I wasn't getting with nagios 4.3.4-5.el7:\n\n    SELinux is preventing /usr/sbin/httpd from getattr access on the file /var/spool/nagios/status.dat.\n    type=AVC msg=audit(1551152845.860:270): avc:  denied  { getattr } for  pid=2176 comm=\"httpd\" path=\"/var/spool/nagios/status.dat\" dev=\"dm-3\" ino=2114580 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:nagios_spool_t:s0 tclass=file\n\n    SELinux is preventing /usr/sbin/httpd from read access on the file /var/spool/nagios/status.dat.\n    type=AVC msg=audit(1551152845.861:271): avc:  denied  { read } for  pid=2176 comm=\"httpd\" name=\"status.dat\" dev=\"dm-3\" ino=2114580 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:nagios_spool_t:s0 tclass=file\n\n    SELinux is preventing /usr/lib64/nagios/cgi-bin/statusjson.cgi from read access on the file /var/spool/nagios/objects.cache.\n    type=AVC msg=audit(1551152846.15:272): avc:  denied  { read } for  pid=2391 comm=\"statusjson.cgi\" name=\"objects.cache\" dev=\"dm-3\" ino=2114578 scontext=system_u:system_r:nagios_script_t:s0 tcontext=system_u:object_r:nagios_spool_t:s0 tclass=file", "timestamp": "2019-02-26 04:07:40", "update_id": 132233, "user_id": 4761, "id": 900273, "testcase_feedback": [], "user": {"name": "kenyon", "email": "kenyon@kenyonralph.com", "id": 4761, "avatar": "https://seccdn.libravatar.org/avatar/e3f833578def7f10f0227fcf93b83a728e8d46327904c52e2b44b8627c0d1d5d?s=24&d=retro", "openid": "kenyon.id.stg.fedoraproject.org", "groups": [{"name": "ipausers"}, {"name": "signed_fpca"}]}}}, {"karma": 0, "comment_id": 900326, "bug_id": 1674258, "comment": {"karma": 0, "karma_critpath": 0, "text": "Also, in syslog I get these messages, which maybe indicates that these files aren't properly registered with the package management system?\n\n    /usr/bin/sealert: failed to retrieve rpm info for /var/spool/nagios/status.dat\n    /usr/bin/sealert: failed to retrieve rpm info for /var/spool/nagios/objects.cache", "timestamp": "2019-02-26 04:15:20", "update_id": 132233, "user_id": 4761, "id": 900326, "testcase_feedback": [], "user": {"name": "kenyon", "email": "kenyon@kenyonralph.com", "id": 4761, "avatar": "https://seccdn.libravatar.org/avatar/e3f833578def7f10f0227fcf93b83a728e8d46327904c52e2b44b8627c0d1d5d?s=24&d=retro", "openid": "kenyon.id.stg.fedoraproject.org", "groups": [{"name": "ipausers"}, {"name": "signed_fpca"}]}}}, {"karma": 0, "comment_id": 900327, "bug_id": 1674258, "comment": {"karma": 0, "karma_critpath": 0, "text": "Ahh actually, I think my three SELinux denials in comment https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2019-9bad34efbb#comment-900273 are bugs in selinux-policy packages. I'm running RHEL 7.4 (with EUS). If I upgrade selinux-policy and its dependencies to the RHEL 7.5 versions, these denials go away.\n\nSo, breaks nagios on RHEL 7.4: selinux-policy-3.13.1-166.el7_4.7.noarch\nAllows nagios to work on RHEL 7.4: selinux-policy-3.13.1-192.el7_5.3.noarch\n\nSo, I don't think you really need to do anything about these problems, @smooge, because we really ought to be upgrading from RHEL 7.4 anyway.", "timestamp": "2019-02-26 04:31:31", "update_id": 132233, "user_id": 4761, "id": 900327, "testcase_feedback": [], "user": {"name": "kenyon", "email": "kenyon@kenyonralph.com", "id": 4761, "avatar": "https://seccdn.libravatar.org/avatar/e3f833578def7f10f0227fcf93b83a728e8d46327904c52e2b44b8627c0d1d5d?s=24&d=retro", "openid": "kenyon.id.stg.fedoraproject.org", "groups": [{"name": "ipausers"}, {"name": "signed_fpca"}]}}}, {"karma": -1, "comment_id": 900328, "bug_id": 1674258, "comment": {"karma": -1, "karma_critpath": 0, "text": "Nope, correction again. Even with selinux-policy-3.13.1-192.el7_5.3, still getting these two httpd denials for /var/spool/nagios/status.dat with nagios-4.4.3-4.el7:\n\n    SELinux is preventing /usr/sbin/httpd from read access on the file /var/spool/nagios/status.dat.\n    type=AVC msg=audit(1551157687.728:260): avc:  denied  { read } for  pid=1604 comm=\"httpd\" name=\"status.dat\" dev=\"dm-3\" ino=2114574 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:nagios_spool_t:s0 tclass=file\n\n    SELinux is preventing /usr/sbin/httpd from getattr access on the file /var/spool/nagios/status.dat.\n    type=AVC msg=audit(1551157687.728:259): avc:  denied  { getattr } for  pid=1604 comm=\"httpd\" path=\"/var/spool/nagios/status.dat\" dev=\"dm-3\" ino=2114574 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:nagios_spool_t:s0 tclass=file", "timestamp": "2019-02-26 05:13:54", "update_id": 132233, "user_id": 4761, "id": 900328, "testcase_feedback": [], "user": {"name": "kenyon", "email": "kenyon@kenyonralph.com", "id": 4761, "avatar": "https://seccdn.libravatar.org/avatar/e3f833578def7f10f0227fcf93b83a728e8d46327904c52e2b44b8627c0d1d5d?s=24&d=retro", "openid": "kenyon.id.stg.fedoraproject.org", "groups": [{"name": "ipausers"}, {"name": "signed_fpca"}]}}}, {"karma": 1, "comment_id": 900331, "bug_id": 1674258, "comment": {"karma": -1, "karma_critpath": 0, "text": "Correcting my feedback. #1674258 seems to have been fixed, but there are new SELinux policy problems.", "timestamp": "2019-02-26 05:21:18", "update_id": 132233, "user_id": 4761, "id": 900331, "testcase_feedback": [], "user": {"name": "kenyon", "email": "kenyon@kenyonralph.com", "id": 4761, "avatar": "https://seccdn.libravatar.org/avatar/e3f833578def7f10f0227fcf93b83a728e8d46327904c52e2b44b8627c0d1d5d?s=24&d=retro", "openid": "kenyon.id.stg.fedoraproject.org", "groups": [{"name": "ipausers"}, {"name": "signed_fpca"}]}}}, {"karma": 1, "comment_id": 902792, "bug_id": 1674258, "comment": {"karma": 0, "karma_critpath": 0, "text": "", "timestamp": "2019-03-03 19:05:48", "update_id": 132230, "user_id": 207, "id": 902792, "testcase_feedback": [], "user": {"name": "anonymous", "email": null, "id": 207, "avatar": "https://seccdn.libravatar.org/avatar/37a8eec1ce19687d132fe29051dca629d164e2c4958ba141d5f4133a33f0688f?s=24&d=retro", "openid": "anonymous.id.stg.fedoraproject.org", "groups": []}}}]}], "updateid": "FEDORA-2019-6d3112aae3", "karma": 0, "content_type": "rpm", "test_cases": []}, "can_edit": false, "ci_allowed": false}