### README.OPENBSDSome nagios plugins need elevated privileges to run properly. As the codequality of these plugins is not really good, they are not installed suidroot by default, but instead I suggest running them with systrace'sprivilege elevation feature. This way they are run as _nagios, but singlesyscalls are run as root.1) Create a preliminary systrace policy for the plugin.# cd ${PREFIX}/libexec/nagios# systrace -A -d /tmp ./<plugin> <plugin arguments>This creates a policy for the plugin <plugin> in /tmp.2) Refine the policy and configure privilege elevation as required. Thisis an example, permitting the bind(2) syscall as root.native-bind: sockaddr eq "inet-[0.0.0.0]:68" then permit as root3) Copy the systrace policy to /etc/systrace.4) Run visudo as root and configure sudo for user _nagios like this._nagios ALL=NOPASSWD: /bin/systrace -a -c 550\:550 \ ${PREFIX}/libexec/nagios/<plugin> <plugin arguments>5) Configure the respective command in nagios.define command { command_name check_dhcp command_line sudo /bin/systrace -a -c 550:550 $USER1$/<plugin> <plugin arguments>}6) In case of problems, systrace will log to /var/log/messages.### My steps # cd /usr/local/libexec/nagios/# systrace -A -d /tmp ./check_ping -H 192.168.100.110 -w 3000.0,80% -c 5000.0,100% -p 1PING OK - Packet loss = 0%, RTA = 0.29 ms# cp /tmp/usr_local_libexec_nagios_check_ping /etc/systrace/# visudo_nagios ALL=NOPASSWD: /bin/systrace -a -c 550\:550 \ /usr/local/libexec/nagios/check_ping <plugin arguments>