nagios_selinux(8)

📦

version 20250627+git412.dbf877ab7 · 7 versions

20250627+git412.dbf877ab7 · opensuse-leap 16.0 (latest)
38.1.87 · centos-stream 9
42.1.28 · centos-stream 10
43.10 · fedora 43
42.12 · fedora 43
44.11 · fedora 44
43.3 · fedora 44

💖 nagios_selinux — the manual, but make it make sense

okay so this is nagios_selinux(8), the SELinux Policy page for the nagios processes. yes bestie, the whole thing. grab a matcha, we're doing this. 🍓

✨ NAME ✨

nagios_selinux — Security Enhanced Linux Policy for the nagios processes

🦋 DESCRIPTION 🦋

so SELinux secures the nagios processes via flexible mandatory access control. that's the whole vibe. it's giving "you literally cannot do that, and no, asking nicely won't help." 💅

the nagios processes execute with the nagios_t SELinux type. you can check if you have these processes running by executing the ps command with the -Z qualifier.

for example:

ps -eZ | grep nagios_t

that's it. that's the check. run it, see what's haunted. 👑

🎀 ENTRYPOINTS 🎀

the nagios_t SELinux type can be entered via the nagios_exec_t file type.

the default entrypoint paths for the nagios_t domain are the following:

/usr/bin/icinga
/usr/bin/nagios

those two. iconic. no cap. ✨

🌸 PROCESS TYPES 🌸

SELinux defines process types (domains) for each process running on the system.

you can see the context of a process using the -Z option to ps.

policy governs the access confined processes have to files. SELinux nagios policy is very flexible, allowing users to setup their nagios processes in as secure a method as possible. like, genuinely flexible. obsessed.

the following process types are defined for nagios — read 'em and weep, there's a whole squad:

nagios_t
nagios_admin_plugin_t
nagios_checkdisk_plugin_t
nagios_mail_plugin_t
nagios_services_plugin_t
nagios_system_plugin_t
nagios_unconfined_plugin_t
nagios_eventhandler_plugin_t
nagios_openshift_plugin_t
nagios_script_t

Note: semanage permissive -a nagios_t can be used to make the process type nagios_t permissive. SELinux does not deny access to permissive process types, but the AVC (SELinux denials) messages are still generated. so like — it's not a free pass, it's just a "we're watching but not blocking" pass. 👀

🧚 BOOLEANS 🧚

SELinux policy is customizable based on least access required. nagios policy is extremely flexible and has several booleans that allow you to manipulate the policy and run nagios with the tightest access possible. tightest. access. possible. periodt.

💜 the nagios ones

if you want to allow nagios run in conjunction with PNP4Nagios, you must turn on the nagios_run_pnp4nagios boolean. Disabled by default.

setsebool -P nagios_run_pnp4nagios 1

if you want to allow nagios/nrpe to call sudo from NRPE utils scripts, you must turn on the nagios_run_sudo boolean. Disabled by default.

setsebool -P nagios_run_sudo 1

if you want to determine whether Nagios, NRPE can access nfs file systems, you must turn on the nagios_use_nfs boolean. Disabled by default.

setsebool -P nagios_use_nfs 1

🌈 the general ones (still relevant, don't skip)

if you want to dontaudit all daemons scheduling requests (setsched, sys_nice), you must turn on the daemons_dontaudit_scheduling boolean. Enabled by default.

setsebool -P daemons_dontaudit_scheduling 1

if you want to allow all domains to execute in fips_mode, you must turn on the fips_mode boolean. Enabled by default.

setsebool -P fips_mode 1

if you want to allow system to run with NIS, you must turn on the nis_enabled boolean. Disabled by default.

setsebool -P nis_enabled 1

👑 MANAGED FILES 👑

the SELinux process type nagios_t can manage files labeled with the following file types. the paths listed are the default paths for these file types. note: the processes UID still need to have DAC permissions. so like, SELinux saying yes does not mean the UID says yes. both have to agree. it's a whole consent thing. 🙈

🫶 `cluster_conf_t`

/etc/cluster(/.*)?

🫶 `cluster_var_lib_t`

/var/lib/pcsd(/.*)?
/var/lib/cluster(/.*)?
/var/lib/openais(/.*)?
/var/lib/pengine(/.*)?
/var/lib/corosync(/.*)?
/usr/lib/heartbeat(/.*)?
/var/lib/heartbeat(/.*)?
/var/lib/pacemaker(/.*)?

🫶 `cluster_var_run_t`

/run/crm(/.*)?
/run/cman_.*
/run/rsctmp(/.*)?
/run/aisexec.*
/run/heartbeat(/.*)?
/run/pcsd-ruby.socket
/run/corosync-qnetd(/.*)?
/run/corosync-qdevice(/.*)?
/run/pcsd.socket
/run/corosync.pid
/run/cpglockd.pid
/run/rgmanager.pid
/run/cluster/rgmanager.sk

🫶 `faillog_t`

/var/log/btmp.*
/run/faillock(/.*)?
/var/log/faillog.*
/var/log/tallylog.*

🫶 `krb5_host_rcache_t`

/var/tmp/krb5_0.rcache2
/var/cache/krb5rcache(/.*)?
/var/tmp/nfs_0
/var/tmp/DNS_25
/var/tmp/host_0
/var/tmp/imap_0
/var/tmp/HTTP_23
/var/tmp/HTTP_48
/var/tmp/ldap_55
/var/tmp/ldap_487
/var/tmp/ldapmap1_0

🫶 `lastlog_t`

/var/log/lastlog.*
/var/lib/lastlog(/.*)?

🫶 `nagios_log_t`

/var/log/icinga(/.*)?
/var/log/nagios(/.*)?
/var/log/netsaint(/.*)?
/var/log/pnp4nagios(/.*)?

🫶 `nagios_spool_t`

/var/spool/icinga(/.*)?
/var/spool/nagios(/.*)?

🫶 `nagios_tmp_t`

(no default paths listed for this one — she's mysterious like that 💀)

🫶 `nagios_var_lib_t`

/var/lib/nagios(/.*)?
/usr/lib/pnp4nagios(/.*)?
/var/lib/pnp4nagios(/.*)?

🫶 `nagios_var_run_t`

/run/nagios.*

🫶 `nfs_t`

(no default paths listed here either — she's a whole concept, not a list ✨)

🫶 `root_t`

/sysroot/.aleph-version.json
/sysroot/ostree/deploy/.*-atomic/deploy(/.*)?
/
/initrd
/var/lib/ntp

🫶 `security_t`

/selinux

🫶 `sudo_db_t`

/var/db/sudo(/.*)?

🫶 `systemd_passwd_var_run_t`

/run/systemd/ask-password(/.*)?
/run/systemd/ask-password-block(/.*)?

okay bestie that's the first half and there's more coming — don't go anywhere, we're not done slaying this manpage yet 🌈

💖 FILE CONTEXTS 💖

okay so SELinux is very “metadata is everything” and requires files to have an extended attribute that defines the file type.

You can peep a file’s context using the -Z option to ls.

Policy governs the access confined processes have to these files. The SELinux nagios policy is super flexible and lets users set up their nagios processes in as secure a method as possible. slay.

🎀 STANDARD FILE CONTEXT 🎀

SELinux defines the file context types for nagios. If you want to store files with these types in a different paths, you need to execute the semanage command to specify alternate labeling and then use restorecon to put the labels on disk.

semanage fcontext -a -t nagios_exec_t '/srv/nagios/content(/.*)?'
restorecon -R -v /srv/mynagios_content

Note: SELinux often uses regular expressions to specify labels that match multiple files. iykyk ✨

These are the file types defined for nagios, bestie:

🌸 `nagios_admin_plugin_exec_t`

Set files with the nagios_admin_plugin_exec_t type if you want to transition an executable to the nagios_admin_plugin_t domain.

🌸 `nagios_checkdisk_plugin_exec_t`

Set files with the nagios_checkdisk_plugin_exec_t type if you want to transition an executable to the nagios_checkdisk_plugin_t domain.

Paths:

/usr/lib/nagios/plugins/check_disk,
/usr/lib/nagios/plugins/check_disk_smb,
/usr/lib/nagios/plugins/check_ide_smart,
/usr/lib/nagios/plugins/check_linux_raid

🌸 `nagios_content_t`

Set files with the nagios_content_t type if you want to treat the files as nagios content.

🌸 `nagios_etc_t`

Set files with the nagios_etc_t type if you want to store nagios files in the /etc directories.

Paths:

/etc/icinga(/.*)?, /etc/nagios(/.*)?, /etc/pnp4nagios(/.*)?

🌸 `nagios_eventhandler_plugin_exec_t`

Set files with the nagios_eventhandler_plugin_exec_t type if you want to transition an executable to the nagios_eventhandler_plugin_t domain.

Paths:

/usr/lib/icinga/plugins/eventhandlers(/.*),
/usr/lib/nagios/plugins/eventhandlers(/.*)

🌸 `nagios_eventhandler_plugin_tmp_t`

Set files with the nagios_eventhandler_plugin_tmp_t type if you want to store nagios eventhandler plugin temporary files in the /tmp directories.

🌸 `nagios_exec_t`

Set files with the nagios_exec_t type if you want to transition an executable to the nagios_t domain.

Paths:

/usr/bin/icinga, /usr/bin/nagios

🌸 `nagios_htaccess_t`

Set files with the nagios_htaccess_t type if you want to treat the file as a nagios access file.

🌸 `nagios_initrc_exec_t`

Set files with the nagios_initrc_exec_t type if you want to transition an executable to the nagios_initrc_t domain.

Paths:

/etc/rc.d/init.d/nrpe, /etc/rc.d/init.d/nagios

🌸 `nagios_log_t`

Set files with the nagios_log_t type if you want to treat the data as nagios log data, usually stored under the /var/log directory.

Paths:

/var/log/icinga(/.*)?, /var/log/nagios(/.*)?,
/var/log/netsaint(/.*)?, /var/log/pnp4nagios(/.*)?

🌸 `nagios_mail_plugin_exec_t`

Set files with the nagios_mail_plugin_exec_t type if you want to transition an executable to the nagios_mail_plugin_t domain.

🌸 `nagios_openshift_plugin_exec_t`

Set files with the nagios_openshift_plugin_exec_t type if you want to transition an executable to the nagios_openshift_plugin_t domain.

Paths:

/usr/lib64/nagios/plugins/check_node_accept_status,
/usr/lib64/nagios/plugins/check_number_openshift_apps

🌸 `nagios_openshift_plugin_tmp_t`

Set files with the nagios_openshift_plugin_tmp_t type if you want to store nagios openshift plugin temporary files in the /tmp directories.

🌸 `nagios_ra_content_t`

Set files with the nagios_ra_content_t type if you want to treat the files as nagios read/append content.

🌸 `nagios_rw_content_t`

Set files with the nagios_rw_content_t type if you want to treat the files as nagios read/write content.

🌸 `nagios_script_exec_t`

Set files with the nagios_script_exec_t type if you want to transition an executable to the nagios_script_t domain.

Paths:

/usr/lib/icinga/cgi(/.*)?, /usr/lib/nagios/cgi(/.*)?, /usr/lib/cgi-bin/nagios(/.+)?, /usr/lib/nagios/cgi-bin(/.*)?, /usr/lib/cgi-bin/netsaint(/.*)?

🌸 `nagios_services_plugin_exec_t`

Set files with the nagios_services_plugin_exec_t type if you want to transition an executable to the nagios_services_plugin_t domain.

Paths:

/usr/lib(64)?/nagios/plugins/check_nt,
/usr/lib(64)?/nagios/plugins/check_dig,
/usr/lib(64)?/nagios/plugins/check_dns,
/usr/lib(64)?/nagios/plugins/check_rpc,
/usr/lib(64)?/nagios/plugins/check_sip,
/usr/lib(64)?/nagios/plugins/check_ssh,
/usr/lib(64)?/nagios/plugins/check_tcp,
/usr/lib(64)?/nagios/plugins/check_ups,
/usr/lib(64)?/nagios/plugins/check_dhcp,
/usr/lib(64)?/nagios/plugins/check_game,
/usr/lib(64)?/nagios/plugins/check_hpjd,
/usr/lib(64)?/nagios/plugins/check_http,
/usr/lib(64)?/nagios/plugins/check_icmp,
/usr/lib(64)?/nagios/plugins/check_ircd,
/usr/lib(64)?/nagios/plugins/check_ldap,
/usr/lib(64)?/nagios/plugins/check_nrpe,
/usr/lib(64)?/nagios/plugins/check_ping,
/usr/lib(64)?/nagios/plugins/check_real,
/usr/lib(64)?/nagios/plugins/check_smtp,
/usr/lib(64)?/nagios/plugins/check_time,
/usr/lib(64)?/nagios/plugins/check_dummy,
/usr/lib(64)?/nagios/plugins/check_fping,
/usr/lib(64)?/nagios/plugins/check_mysql,
/usr/lib(64)?/nagios/plugins/check_ntp.*,
/usr/lib(64)?/nagios/plugins/check_pgsql,
/usr/lib(64)?/nagios/plugins/check_breeze,
/usr/lib(64)?/nagios/plugins/check_oracle,
/usr/lib(64)?/nagios/plugins/check_radius,
/usr/lib(64)?/nagios/plugins/check_snmp.*,
/usr/lib(64)?/nagios/plugins/check_cluster,
/usr/lib(64)?/nagios/plugins/check_mysql_query

🌸 `nagios_spool_t`

Set files with the nagios_spool_t type if you want to store the nagios files under the /var/spool directory.

Paths:

/var/spool/icinga(/.*)?, /var/spool/nagios(/.*)?

🌸 `nagios_system_plugin_exec_t`

Set files with the nagios_system_plugin_exec_t type if you want to transition an executable to the nagios_system_plugin_t domain.

Paths:

/usr/lib(64)?/nagios/plugins/check_log,
/usr/lib(64)?/nagios/plugins/check_load,
/usr/lib(64)?/nagios/plugins/check_mrtg,
/usr/lib(64)?/nagios/plugins/check_swap,
/usr/lib(64)?/nagios/plugins/check_wave,
/usr/lib(64)?/nagios/plugins/check_procs,
/usr/lib(64)?/nagios/plugins/check_users,
/usr/lib(64)?/nagios/plugins/check_flexlm,
/usr/lib(64)?/nagios/plugins/check_nagios,
/usr/lib(64)?/nagios/plugins/check_nwstat,
/usr/lib(64)?/nagios/plugins/check_overcr,
/usr/lib(64)?/nagios/plugins/check_sensors,
/usr/lib(64)?/nagios/plugins/check_ifstatus,
/usr/lib(64)?/nagios/plugins/check_mrtgtraf,
/usr/lib(64)?/nagios/plugins/check_ifoperstatus

🌸 `nagios_system_plugin_tmp_t`

Set files with the nagios_system_plugin_tmp_t type if you want to store nagios system plugin temporary files in the /tmp directories.

🌸 `nagios_tmp_t`

Set files with the nagios_tmp_t type if you want to store nagios temporary files in the /tmp directories.

🌸 `nagios_unconfined_plugin_exec_t`

Set files with the nagios_unconfined_plugin_exec_t type if you want to transition an executable to the nagios_unconfined_plugin_t domain.

🌸 `nagios_var_lib_t`

Set files with the nagios_var_lib_t type if you want to store the nagios files under the /var/lib directory.

Paths:

/var/lib/nagios(/.*)?, /usr/lib/pnp4nagios(/.*)?,
/var/lib/pnp4nagios(/.*)?

🌸 `nagios_var_run_t`

Set files with the nagios_var_run_t type if you want to store the nagios files under the /run or /var/run directory.

Heads up: File context can be temporarily modified with the chcon command. If you want to permanently change the file context you need to use the semanage fcontext command. This will modify the SELinux labeling database. You will need to use restorecon to apply the labels.

✨ COMMANDS ✨

semanage fcontext — can also be used to manipulate default file context mappings.
semanage permissive — can also be used to manipulate whether or not a process type is permissive.
semanage module — can also be used to enable/disable/install/remove policy modules.
semanage boolean — can also be used to manipulate the booleans.
system-config-selinux — is a GUI tool available to customize SELinux policy settings.

🦋 AUTHOR 🦋

This manual page was auto-generated using sepolicy manpage.

💜 SEE ALSO 💜

the whole cross-ref crew, no cap:

selinux(8), nagios(8), semanage(8), restorecon(8), chcon(1),
sepolicy(8), setsebool(8), nagios_admin_plugin_selinux(8),
nagios_admin_plugin_selinux(8), nagios_checkdisk_plugin_selinux(8),
nagios_checkdisk_plugin_selinux(8),
nagios_eventhandler_plugin_selinux(8),
nagios_eventhandler_plugin_selinux(8), nagios_mail_plugin_selinux(8),
nagios_mail_plugin_selinux(8), nagios_openshift_plugin_selinux(8),
nagios_openshift_plugin_selinux(8), nagios_script_selinux(8),
nagios_script_selinux(8), nagios_services_plugin_selinux(8),
nagios_services_plugin_selinux(8), nagios_system_plugin_selinux(8),
nagios_system_plugin_selinux(8), nagios_unconfined_plugin_selinux(8),
nagios_unconfined_plugin_selinux(8)

and that’s the whole page, bestie 💖 footer deets: source/version nagios, date 26-10-06, page nagios_selinux(8) — go label something iconic ✨

📦 where this page comes from

opensuse-leap 16.0: selinux-policy-doc 20250627+git412.dbf877ab7-160000.1.1 · GPL-2.0-or-later
💖 girlified by deepseek-ai/DeepSeek-V4.1-Flash-1017 on 2026-11-04: a language model's rewrite of the original, under its terms

nagios_selinux(8)

💖 nagios_selinux — the manual, but make it make sense

✨ NAME ✨

🦋 DESCRIPTION 🦋

🎀 ENTRYPOINTS 🎀

🌸 PROCESS TYPES 🌸

🧚 BOOLEANS 🧚

💜 the nagios ones

🌈 the general ones (still relevant, don't skip)

👑 MANAGED FILES 👑

🫶 cluster_conf_t

🫶 cluster_var_lib_t

🫶 cluster_var_run_t

🫶 faillog_t

🫶 krb5_host_rcache_t

🫶 lastlog_t

🫶 nagios_log_t

🫶 nagios_spool_t

🫶 nagios_tmp_t

🫶 nagios_var_lib_t

🫶 nagios_var_run_t

🫶 nfs_t

🫶 root_t

🫶 security_t

🫶 sudo_db_t

🫶 systemd_passwd_var_run_t

💖 FILE CONTEXTS 💖

🎀 STANDARD FILE CONTEXT 🎀

🌸 nagios_admin_plugin_exec_t

🌸 nagios_checkdisk_plugin_exec_t

🌸 nagios_content_t

🌸 nagios_etc_t

🌸 nagios_eventhandler_plugin_exec_t

🌸 nagios_eventhandler_plugin_tmp_t

🌸 nagios_exec_t

🌸 nagios_htaccess_t

🌸 nagios_initrc_exec_t

🌸 nagios_log_t

🌸 nagios_mail_plugin_exec_t

🌸 nagios_openshift_plugin_exec_t

🌸 nagios_openshift_plugin_tmp_t

🌸 nagios_ra_content_t

🌸 nagios_rw_content_t

🌸 nagios_script_exec_t

🌸 nagios_services_plugin_exec_t

🌸 nagios_spool_t

🌸 nagios_system_plugin_exec_t

🌸 nagios_system_plugin_tmp_t

🌸 nagios_tmp_t

🌸 nagios_unconfined_plugin_exec_t

🌸 nagios_var_lib_t

🌸 nagios_var_run_t

✨ COMMANDS ✨

🦋 AUTHOR 🦋

💜 SEE ALSO 💜

🫶 `cluster_conf_t`

🫶 `cluster_var_lib_t`

🫶 `cluster_var_run_t`

🫶 `faillog_t`

🫶 `krb5_host_rcache_t`

🫶 `lastlog_t`

🫶 `nagios_log_t`

🫶 `nagios_spool_t`

🫶 `nagios_tmp_t`

🫶 `nagios_var_lib_t`

🫶 `nagios_var_run_t`

🫶 `nfs_t`

🫶 `root_t`

🫶 `security_t`

🫶 `sudo_db_t`

🫶 `systemd_passwd_var_run_t`

🌸 `nagios_admin_plugin_exec_t`

🌸 `nagios_checkdisk_plugin_exec_t`

🌸 `nagios_content_t`

🌸 `nagios_etc_t`

🌸 `nagios_eventhandler_plugin_exec_t`

🌸 `nagios_eventhandler_plugin_tmp_t`

🌸 `nagios_exec_t`

🌸 `nagios_htaccess_t`

🌸 `nagios_initrc_exec_t`

🌸 `nagios_log_t`

🌸 `nagios_mail_plugin_exec_t`

🌸 `nagios_openshift_plugin_exec_t`

🌸 `nagios_openshift_plugin_tmp_t`

🌸 `nagios_ra_content_t`

🌸 `nagios_rw_content_t`

🌸 `nagios_script_exec_t`

🌸 `nagios_services_plugin_exec_t`

🌸 `nagios_spool_t`

🌸 `nagios_system_plugin_exec_t`

🌸 `nagios_system_plugin_tmp_t`

🌸 `nagios_tmp_t`

🌸 `nagios_unconfined_plugin_exec_t`

🌸 `nagios_var_lib_t`

🌸 `nagios_var_run_t`