Zabbix 6.0.19 running Linux shell script (system.run[]) returned Permission denied

[lf2024]

I'm struggling to do a proof of concept test of running a custom shell script on a Linux host via Zabbix agent. Zabbix 6.0.19 is our version. I created a login on forums and asked for help a couple of weeks ago. It said my post was not approved. Then a user responded. I was not able to find the old post to reply. The link in the email did not work. So I'm creating a new post. My problem is not resolved. Any help is greatly appreciated. Running a one-line shell script shouldn't be this difficult.

I did this to create an item.
Data collection -> Hosts -> Next to one Linux host, clicked on Items
Created an item:
Type is Zabbix agent
Key is system.run[/tmp/test.sh]
Type of Information: text

I clicked on test and it gave me an error:
sh: /tmp/test.sh: Permission denied

I added this line to zabbix_agentd.conf on the LInux host
AllowKey=system.run[*]
The permission on /tmp/test.sh is 777.

I'm able to run this test successfully -
zabbix_agentd -t system.run[/tmp/test.sh]
system.run[/tmp/test.sh] [t|]

The Zabbix agent log has no error related to this. The Linux host has RedHat Linux.

[Markku]

Do you have SELinux or something else that could prevent zabbix user (under which the Zabbix agent process usually runs, I assume also in RHEL) from running the script from /tmp?

Markku

[lf2024]

Thank you for your reply! On the Linux host, I can execute this shell script as Zabbix user. I have simplified the script for troubleshooting purpose. It only has one line - echo something and pipe the output to a log file.

[Markku]

Do you have SELinux on and can you still try with it disabled? I don't know all the dynamics but I have seen many RHEL problems related to missing SELinux configurations.

Markku

[lf2024]

I checked. The OS on the Linux host is actually Oracle Linux Server release 8.8. Do you know of any issue with this OS version? Thank you.

[Markku]

Personally, no idea. https://docs.oracle.com/en/learn/ol-.../#introduction says:

Oracle Linux installs SELinux by default and runs in Enforcing mode.

if that happens to be related to the issue.

Markku

[lf2024]

I wish the error message is more specific. If it is some library file missing, I can understand it is OS related. Permission denied doesn’t tell me much.

[Markku]

Umm... are you purposefully ignoring my suggestions and questions about SELinux, or did I misunderstand some of your answers?

Markku

[lf2024]

I do not understand. Oracle Linux is similar to Redhat while SELinux is a different Linux flavor. We do not have SELinux. Is there anything in Oracle Linux that needs to be disabled? The host is an Oracle production database server. We can not disable OS package on the host for trial and error.

[lf2024]

Okay my misunderstanding. I was thinking SUSE Linux when you said SELinux. I googled how to check whether SELinux is enabled on Oracle Linux 8. The command getenforce returned Enforcing. That tells it is enabled. The document said we would need to reboot the server to change. I can’t do that with this production server. Let me find a non-prod host and test. Thank you for your suggestion. I will update.

[lf2024]

That was it! After disabling SELinux, permission denied error is gone. Thank you very much for your help.

[cyber]

SELinux is there for a reason, disabling it might introduce many security issues. You should configure additional selinux rules to allow the things you need to do.

[lf2024]

Thank you for your input. I will research SELinux rules.