| Subject: | Nagios-Plugin does not run under setgid |
| Date: | Fri, 9 Jul 2010 16:56:22 -0500 |
| To: | <bug-Nagios-Plugin [...] rt.cpan.org> |
| From: | "Matt Rose" <mcrose [...] excel.net> |
I'm unable to run Nagios::Plugin when changing the running script's
uid/gid:
Runs fine as root,
[root@opsview libexec]# ./check_conn
CONNECTIONS OK - 28 users connected at 2010-07-09T16:35:08
(0.10707234449363 sigma difference) | connections=28;; mean=28.5152;;
std_dev=4.8117;; deviation=0.10707234449363;;
But not as nagios user in nagios group.
[nagios@opsview libexec]$ ./check_conn
Insecure dependency in eval_sv() while running setgid at
/usr/local/nagios/perl/lib/Nagios/Plugin/Getopt.pm line 448.
Mode on the file is 4750, owner is root:nagios.
[nagios@opsview libexec]$ ls -alh check_conn
-rwsr-x--- 1 root nagios 4.9K Jul 9 15:38 check_conn
The script in question elevates itself to root:root by copying the
effective uid and setting the group to 0,
$< = $>;
$( = 0;
in order to read a credentials file but not give access to the file to
the nagios user.
OS is CentOS 5.5. Perl library is the base Opsview 3.7.2 distributed
modules along with a small handful of distribution-provided modules used
for internally-developed module dependencies.
Let me know if you need any more information than this to troubleshoot.
Thanks!
-Matt
* System Administrator (mcrose@excel.net)
* Excel.Net,Inc. - http://www.excel.net/