add selinux workaround for IPC in zabbix-server3.4

[bastelfreak]

No description provided.

[jameskirsop]

This doesn't seem to have fixed the sockets issue noted in the URL found within the comments.

Running 6.1.0 on Centos 7.4 I'm seeing:

audit.log

type=AVC msg=audit(1513652338.998:453): avc:  denied  { create } for  pid=44803 comm="zabbix_server" name="zabbix_server_alerter.sock" scontext=system_u:system_r:zabbix_t:s0 tcontext=system_u:object_r:tmp_t:s0 tclass=sock_file

and in zabbix-server.log

4845:20171219:140033.356 cannot start alert manager service: Cannot bind socket to "/tmp/zabbix_server_alerter.sock": [13] Permission denied.
 44846:20171219:140033.363 server #30 started [preprocessing manager #1]
 44846:20171219:140033.363 cannot start preprocessing service: Cannot bind socket to "/tmp/zabbix_server_preprocessing.sock": [13] Permission denied.

[bastelfreak]

strange that it worked in our tests. How do you call the module, just include the class or set any params?

[jameskirsop]

I've basically pulled it directly out of the guide on the Forge page:

node 'zabbix.notrealdomain.com' {
  class { 'apache':
    mpm_module => 'prefork',
  }
  include apache::mod::php

  class { 'mysql::server': }

  class { 'zabbix':
    zabbix_url    => 'client.notrealdomain.com',
    database_type => 'mysql',
  }
}

Some more specific details about the host:
uname -a output: 3.10.0-693.el7.x86_64
sudo /opt/puppetlabs/bin/puppet --version = 5.3.3

and it's running all the latest available packages from the regular repos. It's a plain install that I've built in a VM for testing.

[wyardley]

On Dec 19, 2017, at 01:57, James Kirsop ***@***.***> wrote: class { 'zabbix': zabbix_url => 'client.notrealdomain.com', database_type => 'mysql',

I think you need `manage_selinux => true` if you want the module to manage selinux.

[jameskirsop]

Yeah, I did try that previously, with no success:

  class { 'zabbix':
    zabbix_url    => 'zabbix.daraco.com.au',
    database_type => 'mysql',
    manage_selinux => true,
  }

Still doesn't have the desired result, unfortunately.