### README.OPENBSD

Some nagios plugins need elevated privileges to run properly. As the code
quality of these plugins is not really good, they are not installed suid
root by default, but instead I suggest running them with systrace's
privilege elevation feature. This way they are run as _nagios, but single
syscalls are run as root.

1) Create a preliminary systrace policy for the plugin.

# cd ${PREFIX}/libexec/nagios
# systrace -A -d /tmp ./<plugin> <plugin arguments>

This creates a policy for the plugin <plugin> in /tmp.

2) Refine the policy and configure privilege elevation as required. This
is an example, permitting the bind(2) syscall as root.

native-bind: sockaddr eq "inet-[0.0.0.0]:68" then permit as root

3) Copy the systrace policy to /etc/systrace.

4) Run visudo as root and configure sudo for user _nagios like this.

_nagios ALL=NOPASSWD: /bin/systrace -a -c 550\:550 \
    ${PREFIX}/libexec/nagios/<plugin> <plugin arguments>

5) Configure the respective command in nagios.

define command {
        command_name check_dhcp
        command_line sudo /bin/systrace -a -c 550:550 $USER1$/<plugin> <plugin arguments>
}

6) In case of problems, systrace will log to /var/log/messages.


### My steps 

# cd /usr/local/libexec/nagios/
# systrace -A -d /tmp ./check_ping -H 192.168.100.110 -w 3000.0,80% -c 5000.0,100% -p 1
PING OK - Packet loss = 0%, RTA = 0.29 ms
# cp /tmp/usr_local_libexec_nagios_check_ping /etc/systrace/
# visudo
_nagios ALL=NOPASSWD: /bin/systrace -a -c 550\:550 \
    /usr/local/libexec/nagios/check_ping <plugin arguments>