Note: This is a public test instance of Red Hat Bugzilla. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback at bugzilla.redhat.com.
Bug 1187723
| Summary: | SELinux is preventing /usr/bin/polipo from 'name_connect' accesses on the tcp_socket port 35651. | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Richard Z. <rz> |
| Component: | selinux-policy | Assignee: | Miroslav Grepl <mgrepl> |
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 21 | CC: | dominick.grift, dwalsh, lvrabec, mgrepl, plautrba |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | i686 | ||
| OS: | Unspecified | ||
| Whiteboard: | abrt_hash:13b6aa794267cc7284c3b01ed441e2a49d2ef22d92e9ace813aa10c8ad812d17 | ||
| Fixed In Version: | selinux-policy-3.13.1-105.3.fc21 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2015-02-15 03:29:29 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
commit 1346aba8444d83d8bb80e319796b54d4b68e06e6
Author: Lukas Vrabec <lvrabec>
Date: Mon Feb 2 11:06:09 2015 +0100
Allow polipo_deamon connect to all ephemeral ports. BZ(1187723)
selinux-policy-3.13.1-105.3.fc21 has been submitted as an update for Fedora 21. https://admin.fedoraproject.org/updates/selinux-policy-3.13.1-105.3.fc21 Package selinux-policy-3.13.1-105.3.fc21: * should fix your issue, * was pushed to the Fedora 21 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing selinux-policy-3.13.1-105.3.fc21' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2015-1768/selinux-policy-3.13.1-105.3.fc21 then log in and leave karma (feedback). selinux-policy-3.13.1-105.3.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report. |
Description of problem: SELinux is preventing /usr/bin/polipo from 'name_connect' accesses on the tcp_socket port 35651. ***** Plugin catchall_boolean (89.3 confidence) suggests ****************** If you want to allow system to run with NIS Then you must tell SELinux about this by enabling the 'nis_enabled' boolean. You can read 'None' man page for more details. Do setsebool -P nis_enabled 1 ***** Plugin catchall (11.6 confidence) suggests ************************** If you believe that polipo should be allowed name_connect access on the port 35651 tcp_socket by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # grep polipo /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context system_u:system_r:polipo_t:s0 Target Context system_u:object_r:ephemeral_port_t:s0 Target Objects port 35651 [ tcp_socket ] Source polipo Source Path /usr/bin/polipo Port 35651 Host (removed) Source RPM Packages polipo-1.1.1-2.fc21.i686 Target RPM Packages Policy RPM selinux-policy-3.13.1-103.fc21.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 3.18.3-201.fc21.i686+PAE #1 SMP Mon Jan 19 16:09:58 UTC 2015 i686 i686 Alert Count 6 First Seen 2015-01-30 19:07:22 CET Last Seen 2015-01-30 19:07:22 CET Local ID 2c8a0aef-381e-48e9-a4de-4f78e0f01ff5 Raw Audit Messages type=AVC msg=audit(1422641242.492:387): avc: denied { name_connect } for pid=1143 comm="polipo" dest=35651 scontext=system_u:system_r:polipo_t:s0 tcontext=system_u:object_r:ephemeral_port_t:s0 tclass=tcp_socket permissive=0 type=SYSCALL msg=audit(1422641242.492:387): arch=i386 syscall=socketcall success=no exit=EACCES a0=3 a1=bf87c510 a2=8ba3f28 a3=8bad6a8 items=0 ppid=1 pid=1143 auid=4294967295 uid=987 gid=979 euid=987 suid=987 fsuid=987 egid=979 sgid=979 fsgid=979 tty=(none) ses=4294967295 comm=polipo exe=/usr/bin/polipo subj=system_u:system_r:polipo_t:s0 key=(null) Hash: polipo,polipo_t,ephemeral_port_t,tcp_socket,name_connect Version-Release number of selected component: selinux-policy-3.13.1-103.fc21.noarch Additional info: reporter: libreport-2.3.0 hashmarkername: setroubleshoot kernel: 3.18.3-201.fc21.i686+PAE type: libreport