https://www.puppeteers.net/tags/selinux/ Recent content in Selinux on Puppeteers Oy Hugo en-US Thu, 21 Sep 2023 00:00:00 +0000 https://www.puppeteers.net/blog/blackbox-exporter-icmp-module-and-selinux/ Thu, 21 Sep 2023 00:00:00 +0000 https://www.puppeteers.net/blog/blackbox-exporter-icmp-module-and-selinux/ <p><img src="https://puppeteers-public.hel1.your-objectstorage.com/pexels-pixabay-2748861-1024x682.jpg" alt=""></p> <p>Blackbox Exporter ICMP module and selinux do not like each other. Same goes for systemd units and ICMP Echo sockets. However, with persistence, skill and a bit of luck you can make it all work together. <a href="https://www.pexels.com/it-it/foto/foto-in-scala-di-grigi-del-filo-spinato-274886/">Photo credit</a>.</p> <h2 id="introduction">Introduction</h2> <p><a href="https://github.com/prometheus/blackbox_exporter">Blackbox Exporter</a> is an exporter for the <a href="https://prometheus.io/">Prometheus</a> monitoring system. It is able to probe a target, such as a host or an application from the outside. Blackbox Exporter does probing with modules such as http, tcp, dns, icmp and grpc (details <a href="https://github.com/prometheus/blackbox_exporter/blob/master/CONFIGURATION.md">here</a>). The icmp module is special because it does privileged operations that require the CAP_NET_RAW capability and as well as custom selinux policies. This article aims to explain how you can make Blackbox Exporter ICMP module and selinux work together. <strong>NOTE:</strong> you do not need any of these tricks if you use non-icmp Blackbox exporter modules.</p>