FS#60113 - [zabbix-server] cannot execute fping due to NoNewPrivs

Attached to Project: Arch Linux
Opened by Michal Svoboda (pht) - Tuesday, 18 September 2018, 17:24 GMT
Last edited by Florian Pritz (bluewind) - Tuesday, 06 November 2018, 09:23 GMT
Task Type Bug Report
Category Packages: Extra
Status Closed
Assigned To Florian Pritz (bluewind)
Bartłomiej Piotrowski (Barthalion)
Architecture All
Severity Medium
Priority Normal
Reported Version
Due in Version Undecided
Due Date Undecided
Percent Complete 100%
Votes 0
Private No

Details

Hello,

Description:

After [some] recent upgrade zabbix couldn't test reachability of network devices via icmp ping, which is quite an important feature.

The error in logs was: fping failed: /usr/sbin/fping: can't create socket (must run as root?)
Despite fping having the necessary privileges (either via suid or filecap).

I tracked down the problem to the fact that the zabbix server is running with NoNewPrivs flag set to true (see http://man7.org/linux/man-pages/man2/prctl.2.html), which prevents the pinger process and its children from gaining extra privileges even though fping is suid and/or has fcaps.

This flag is set by systemd, as documented in https://www.freedesktop.org/software/systemd/man/systemd.exec.html

This is due to
1) the unit file contains PrivateDevices=yes and
2) as documented, NoNewPrivileges=yes is implied.

To quick fix the issue I've edited the unit file to have PrivateDevices=no and the problem disappeared.
Perhaps a better fix could be PrivateDevices=yes and NoNewPrivileges=no if supported by systemd, or something else entirely (possibly upstream escalation).

As mentioned, device reachability monitoring in zabbix is quite important feature to keep available.

Thanks
Michal

Additional info:
* package version(s)
extra/zabbix-server 3.4.13-1
Another user references same issue in bbs https://bbs.archlinux.org/viewtopic.php?id=239631


Steps to reproduce:
Run zabbix server with newest packages installed.
This task depends upon

Closed by  Florian Pritz (bluewind)
Tuesday, 06 November 2018, 09:23 GMT
Reason for closing:  Fixed
Comment by Florian Pritz (bluewind) - Thursday, 27 September 2018, 09:38 GMT
Please try updating to fping 4.0-2 and zabbix-server/zabbix-proxy 3.4.14-3 and check if that fixes your issue.
Comment by Florian Pritz (bluewind) - Tuesday, 23 October 2018, 21:17 GMT
Status?

Loading...