Zabbix external checks cannot be executed due to SELinux

Question

I try to implement external checks in Zabbix 2.2. I've created simple bash script for SSL verification which should be executed by zabbix service. The script is located in /var/lib/zabbixsrv/externalchecks directory. Even if there are 777 permission for the .sh script I still receive message telling

unable to execute /var/lib/zabbixsrv/externalscripts/test.sh: Permission denied

I've got same message when I try to run the command even as root. The ls -Z /var/lib/zabbixsrv/externalscripts/test.sh command output says:

-rwxrwxrwx. zabbixsrv zabbixsrv unconfined_u:object_r:default_t:s0 /var/lib/zabbixsrv/externalscripts/test.sh

There is no message relating this in /var/log/massages. Does anybody know how to force selinux to allow execute zabbixsrv user the script without disabling selinux?

Which zabbix service (zabbix-server, zabbix-agent, ...) should execute the external checks script?

Answer 1

The main issue was in /etc/fstab configuration file. The Zabbix has defined as default values for script /var/lib/zabbixsrv/excernalscripts directory. My server has /var mounted with rw and noexec permissions.

I've already moved the script to different location and change the configuration file accordingly. Checks are working fine now.

Thanks everybody for any contribution relating this topic.

Answer 2

Did you tried to set AllowRoot=1 in /etc/zabbix/zabbix_agentd.conf?