title: Perl script can't open file owned by root when called from process (Nagios)
body: <p>I have a VPS with Nagios installed, and I want to use Nagios to monitor the VPS resources in the <em>/proc/user_beancounters</em> file. The file has the following permissions:</p>
  
  <pre><code>-r-------- 1 root root 0 Oct 26 15:53 /proc/user_beancounters
  </code></pre>
  
  <p>So I downloaded the script from the Nagios Exchange:</p>
  
  <p><a href="https://exchange.nagios.org/directory/Plugins/Operating-Systems/*-Virtual-Environments/OpenVZ/check-beancounters/details" rel="nofollow">https://exchange.nagios.org/directory/Plugins/Operating-Systems/*-Virtual-Environments/OpenVZ/check-beancounters/details</a></p>
  
  <p>In the instructions it suggests to: </p>
  
  <pre><code>don’t forget to set the s-bit (chmod +s check_UBC.pl)
  </code></pre>
  
  <p>So, I copied the script over, and set the s-bit, then run it from the terminal as root. It works as expected. I then delete the temp file it created, su into the nagios user, and run the script. It works as expected. I delete the temp file it created, and start up Nagios. It can't read the <em>/proc/user_beancounters</em> file! The exact error I get, helpfully, is "could not read /proc/user_beancounters". This is, I believe, thrown by the line in the Perl script:</p>
  
  <pre><code>if (! open IN, "&lt;", $UBC )
  {
      print "could not read $UBC\n";
      exit $ERRORS{'CRITICAL'};
  }
  </code></pre>
  
  <p>My OS is <em>CentOS release 6.2 (Final)</em>.</p>
  
  <p>My first thought is that it is some kind of SELinux voodoo, but there is no indication that SELinux is running on this server. Just in case, I tried the following:</p>
  
  <pre><code>echo 0 &gt; /selinux/enforce
  </code></pre>
  
  <p>But this made no difference.</p>
  
  <p>For reference, this is my nagios service running:</p>
  
  <pre><code>nagios   12939  0.0  0.0 203652  3404 ?        Ssl  15:39   0:00 /usr/sbin/nagios -d /etc/nagios/nagios.cfg
  </code></pre>
  
  <p>And this is where I've put the Perl script:</p>
  
  <pre><code>-rwsr-sr-x 1 nagios nagios   2934 Oct 26 15:37 check_UBC.pl
  </code></pre>
  
  <p>Any suggestions as to what else I can try?</p>
  
  <p>PS apologies if this should go in a different SE site - never sure with questions that involve scripts, permissions etc...</p>
  
  <p><strong>UPDATE 1</strong></p>
  
  <p>I created a shell script to see if I could 'emulate' the nagios service. It is extremely simple:</p>
  
  <pre><code>#!/bin/bash
  /usr/lib64/nagios/plugins/check_UBC.pl
  </code></pre>
  
  <p>And now I have the following permissions:</p>
  
  <pre><code>-rwsr-sr-x 1 root root     2934 Oct 26 15:37 check_UBC.pl
  -rwxrwxrwx 1 root root       51 Oct 26 19:29 check_UBC.sh
  </code></pre>
  
  <p>As root:</p>
  
  <pre><code>[root@/usr/lib64/nagios/plugins]$ ./check_UBC.pl 
    everything is fine..
  [root@/usr/lib64/nagios/plugins]$ ./check_UBC.sh 
    everything is fine..
  </code></pre>
  
  <p>As nagios:</p>
  
  <pre><code>-bash-4.1$ ./check_UBC.pl
    everything is fine..
  -bash-4.1$ ./check_UBC.sh
    everything is fine..
  </code></pre>
  
  <p>So still no clue...</p>
  
  <p><strong>UPDATE 2</strong></p>
  
  <p>My nagios command definition:</p>
  
  <pre><code>define command{
      command_name    check_beancounters
      command_line    $USER1$/check_UBC.pl
      }
  </code></pre>
  
  <p>And the service definition:</p>
  
  <pre><code>define service{
      use                             local-service
      host_name                       localhost
      service_description             VPS Beancounters
      check_command                   check_beancounters
      }
  </code></pre>
  
  <p><strong>UPDATE 3</strong></p>
  
  <p>I managed to get it to work, but am not over the moon about giving the nagios user full sudo access with no password. In /etc/sudoers I put this on the last line:</p>
  
  <pre><code>nagios ALL=(ALL:ALL) NOPASSWD: ALL
  </code></pre>
  
  <p>And then changed my command definition to:</p>
  
  <pre><code>define command{
      command_name    check_beancounters
      command_line    sudo $USER1$/check_UBC.pl
      }
  </code></pre>
  
  <p>Apparently recent versions of linux will not respect the +s permission when running an interpreted script, only a binary. So I guess I will have to compile a binary wrapper for the script?</p>
  
  <p><strong>UPDATE 4</strong></p>
  
  <p>As per Joe Young's suggestion, I changed my visudo entry to:</p>
  
  <pre><code>nagios ALL=NOPASSWD: /usr/lib64/nagios/plugins/check_UBC.pl
  </code></pre>
  
  <p>Which hopefully is relatively harmless!</p>