ZBX_POPEN - Access denied

[WilliamSG]

Hello guys, please ... I need help

1307:20140804:152505.422 Zabbix agent item "net.if.in[Miniplaca de WLAN de meia altura DW1501 Wireless-N - VirtualBox Bridged Networking Driver Miniport-WFP LightWeight Filter-0000]" on host "cenw07n05664" failed: first network error, wait for 15 seconds
1311:20140804:152523.713 Zabbix agent item "net.if.in[Adaptador do Microsoft ISATAP #2]" on host "cenw07n05664" failed: another network error, wait for 15 seconds
5330:20140804:152538.282 zbx_popen(): failed to create a process group: [13] Permission denied
1311:20140804:152541.716 Zabbix agent item "agent.ping" on host "cenw07n05664" failed: another network error, wait for 15 seconds
1311:20140804:152559.723 temporarily disabling Zabbix agent checks on host "cenw07n05664": host unavailable

This error appears in my zabbix_server.conf while zabbix try to send an email from SendEmail script... if I ran the script manualy, it works.

In another post a friend told me "Yout user does't have acces to fork this process (ZBX_popen)", but I'm working with only 2 users, zabbix and root, both have high privileges and the error continues.

What I need to do?

[WilliamSG]

HI!

The problem was solved with this command:

setenforce 0

Thx all!

[Renski]

another option if you need to keep SELlinux active is to create custom policies.
for CentOS very easy to follow http://wiki.centos.org/HowTos/SELinux

for a quick how to
insure you have policycoreutils-python installed
yum install policycoreutils-python

look at your audit.log and see where zabbix is being denied something like this:
example:
avc: denied { getattr } for pid=29475 comm="sh" path="/var/lib/zabbixsrv/externalscripts/if.vdom" dev=dm-0 ino=1050480 scontext=unconfined_u:system_r:zabbix_t:s0 tcontext=unconfined_ubject_r:var_lib_t:s0 tclass=file

then
grep if.vdom /var/log/audit/audit.log | audit2allow -M mypol
then
semodule -i mypol.pp