SELinux blocks custom ruby notification scripts

Describe the bug

We are currently experiencing issues when using custom notifications scripts (https://github.com/Mordecaine/icinga2_mail_notification):
Every time the script is run the icinga2.log has an entry with the following error message
Permission denied @ realpath_rec - /etc/icinga2 (Errno::EACCES)

[root@ma01 ~]# ls -laZ /etc/icinga2/scripts/
total 24
drwxr-x---. 4 icinga icinga system_u:object_r:icinga2_etc_t:s0                          179 Feb 16 18:14 .
d-wxr-xrwT. 7 icinga icinga system_u:object_r:icinga2_etc_t:s0                         4096 Jul 27 00:12 ..
drwxr-xr-x. 3 icinga icinga unconfined_u:object_r:icinga2_etc_t:s0                      241 Feb  3 11:52 CQ-icinga-jira-notification-scripts
-rwxr-xr-x. 1 icinga icinga unconfined_u:object_r:nagios_notification_plugin_exec_t:s0  520 Aug  2  2021 icingacli-webhook.sh
-rwxr-xr-x. 1 root   root   system_u:object_r:nagios_notification_plugin_exec_t:s0     4379 Feb 16 18:13 mail-host-notification.sh
-rwxr-xr-x. 1 root   root   system_u:object_r:nagios_notification_plugin_exec_t:s0     4764 Feb 16 18:13 mail-service-notification.sh
drwxr-xr-x. 3 icinga icinga unconfined_u:object_r:nagios_unconfined_plugin_exec_t:s0     92 Jul 26 09:31 ruby-notification-scripts

[root@ma01 ~]# ls -laZ /etc/icinga2/scripts/ruby-notification-scripts/
total 16
drwxr-xr-x. 3 icinga icinga unconfined_u:object_r:nagios_unconfined_plugin_exec_t:s0     92 Jul 26 09:31 .
drwxr-x---. 4 icinga icinga system_u:object_r:icinga2_etc_t:s0                          179 Feb 16 18:14 ..
-rwxr-xr-x. 1 icinga icinga unconfined_u:object_r:nagios_notification_plugin_exec_t:s0 6277 May 24  2022 mail-host-notification.rb
-rwxr-xr-x. 1 icinga icinga unconfined_u:object_r:nagios_notification_plugin_exec_t:s0 6842 May 24  2022 mail-service-notification.rb
drwxr-xr-x. 2 icinga icinga unconfined_u:object_r:icinga2_etc_t:s0                      172 Jul 26 14:58 templates

Disabling SElinux via setenforce 0 (which is not an option) does help and the scripts are executed as expected.

Further debugging showed which process with which SELinux context ran the scripts:

After this we tried replicating this manually with

sudo -u icinga -s /bin/bash
runcon -u system_u -t nagios_notification_plugin_t -r system_r /etc/icinga2/scripts/ruby-notification-scripts/mail-service-notification.rb

which provided us with the same error message as seen in the icinga2.log.

What is irritating about this is that our own ruby scripts isn't able to execute, but the original icinga notification scripts (which have the same SELinux contexts set) are working flawlessly.

Here is the sealert (with semanage dontaudit off ) output which corresponds with the error message:

SELinux is preventing /usr/bin/ruby from getattr access on the directory /etc/icinga2.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that ruby should be allowed getattr access on the icinga2 directory by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'ruby' --raw | audit2allow -M my-ruby
# semodule -X 300 -i my-ruby.pp


Additional Information:
Source Context                system_u:system_r:nagios_notification_plugin_t:s0-
                              s0:c0.c1023
Target Context                system_u:object_r:icinga2_etc_t:s0
Target Objects                /etc/icinga2 [ dir ]
Source                        ruby
Source Path                   /usr/bin/ruby
Port                          <Unknown>
Host                          <Unknown>
Source RPM Packages           ruby-2.5.9-110.module+el8.6.0+15956+aa803fc1.x86_6
                              4
Target RPM Packages           icinga2-2.13.7-1.el8.x86_64
SELinux Policy RPM            selinux-policy-targeted-3.14.3-117.el8_8.2.noarch
Local Policy RPM              <Unknown>
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     ma01
Platform                      Linux msd-ic-ma01 4.18.0-477.15.1.el8_8.x86_64 #1
                              SMP Fri Jun 2 08:27:19 EDT 2023 x86_64 x86_64
Alert Count                   1
First Seen                    2023-07-27 11:45:06 CEST
Last Seen                     2023-07-27 11:45:06 CEST
Local ID                      4118214c-0e48-4233-9c24-0ad897ee7448

Raw Audit Messages
type=AVC msg=audit(1690451106.703:199967): avc:  denied  { getattr } for  pid=1283377 comm="ruby" path="/etc/icinga2" dev="dm-0" ino=8617644 scontext=system_u:system_r:nagios_notification_plugin_t:s0-s0:c0.c1023 tcontext=system_u:object_r:icinga2_etc_t:s0 tclass=dir permissive=0


type=SYSCALL msg=audit(1690451106.703:199967): arch=x86_64 syscall=lstat success=no exit=EACCES a0=5b5cedd7f2b8 a1=7ffcb0bb05a0 a2=7ffcb0bb05a0 a3=69b6d50e46595b81 items=0 ppid=1283303 pid=1283377 auid=1000 uid=993 gid=990 euid=993 suid=993 fsuid=993 egid=990 sgid=990 fsgid=990 tty=pts0 ses=12597 comm=ruby exe=/usr/bin/ruby subj=system_u:system_r:nagios_notification_plugin_t:s0-s0:c0.c1023 key=(null)ARCH=x86_64 SYSCALL=lstat AUID=msadm UID=icinga GID=icinga EUID=icinga SUID=icinga FSUID=icinga EGID=icinga SGID=icinga FSGID=icinga

Hash: ruby,nagios_notification_plugin_t,icinga2_etc_t,dir,getattr

To Reproduce

Provide a link to a live example, or an unambiguous set of steps to reproduce this bug. Include configuration, logs, etc. to reproduce, if relevant.

1. Have a ruby notification script (https://github.com/Mordecaine/icinga2_mail_notification)
2. use it with icinga

Expected behavior

As the shell scripts are working, the ruby script should execute without errors as well.

Your Environment

Include as many relevant details about the environment you experienced the problem in

• Version used (icinga2 --version): v2.13.7
• Operating System and version: RHEL 8.8
• Enabled features (icinga2 feature list): api checker icingadb influxdb2 mainlog notification syslog
• Config validation (icinga2 daemon -C): ✅

Start by reproducing the denial with the Ruby notification scripts and the provided runcon command on RHEL 8.8, then compare their behavior and SELinux contexts with the working shell notification scripts. Done means custom Ruby notification scripts execute under enforcing SELinux without the reported /etc/icinga2 permission error.