Note: This is a public test instance of Red Hat Bugzilla. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback at bugzilla.redhat.com.
Bug 1187723 - SELinux is preventing /usr/bin/polipo from 'name_connect' accesses on the tcp_socket port 35651.
Summary: SELinux is preventing /usr/bin/polipo from 'name_connect' accesses on the tcp...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 21
Hardware: i686
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Miroslav Grepl
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: abrt_hash:13b6aa794267cc7284c3b01ed44...
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2015-01-30 18:16 UTC by Richard Z.
Modified: 2015-02-15 03:29 UTC (History)
5 users (show)

Fixed In Version: selinux-policy-3.13.1-105.3.fc21
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2015-02-15 03:29:29 UTC
Type: ---


Attachments (Terms of Use)

Description Richard Z. 2015-01-30 18:16:21 UTC
Description of problem:
SELinux is preventing /usr/bin/polipo from 'name_connect' accesses on the tcp_socket port 35651.

*****  Plugin catchall_boolean (89.3 confidence) suggests   ******************

If you want to allow system to run with NIS
Then you must tell SELinux about this by enabling the 'nis_enabled' boolean.
You can read 'None' man page for more details.
Do
setsebool -P nis_enabled 1

*****  Plugin catchall (11.6 confidence) suggests   **************************

If you believe that polipo should be allowed name_connect access on the port 35651 tcp_socket by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep polipo /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                system_u:system_r:polipo_t:s0
Target Context                system_u:object_r:ephemeral_port_t:s0
Target Objects                port 35651 [ tcp_socket ]
Source                        polipo
Source Path                   /usr/bin/polipo
Port                          35651
Host                          (removed)
Source RPM Packages           polipo-1.1.1-2.fc21.i686
Target RPM Packages           
Policy RPM                    selinux-policy-3.13.1-103.fc21.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 3.18.3-201.fc21.i686+PAE #1 SMP
                              Mon Jan 19 16:09:58 UTC 2015 i686 i686
Alert Count                   6
First Seen                    2015-01-30 19:07:22 CET
Last Seen                     2015-01-30 19:07:22 CET
Local ID                      2c8a0aef-381e-48e9-a4de-4f78e0f01ff5

Raw Audit Messages
type=AVC msg=audit(1422641242.492:387): avc:  denied  { name_connect } for  pid=1143 comm="polipo" dest=35651 scontext=system_u:system_r:polipo_t:s0 tcontext=system_u:object_r:ephemeral_port_t:s0 tclass=tcp_socket permissive=0


type=SYSCALL msg=audit(1422641242.492:387): arch=i386 syscall=socketcall success=no exit=EACCES a0=3 a1=bf87c510 a2=8ba3f28 a3=8bad6a8 items=0 ppid=1 pid=1143 auid=4294967295 uid=987 gid=979 euid=987 suid=987 fsuid=987 egid=979 sgid=979 fsgid=979 tty=(none) ses=4294967295 comm=polipo exe=/usr/bin/polipo subj=system_u:system_r:polipo_t:s0 key=(null)

Hash: polipo,polipo_t,ephemeral_port_t,tcp_socket,name_connect

Version-Release number of selected component:
selinux-policy-3.13.1-103.fc21.noarch

Additional info:
reporter:       libreport-2.3.0
hashmarkername: setroubleshoot
kernel:         3.18.3-201.fc21.i686+PAE
type:           libreport

Comment 1 Lukas Vrabec 2015-02-02 10:40:44 UTC
commit 1346aba8444d83d8bb80e319796b54d4b68e06e6
Author: Lukas Vrabec <lvrabec>
Date:   Mon Feb 2 11:06:09 2015 +0100

    Allow polipo_deamon connect to all ephemeral ports. BZ(1187723)

Comment 2 Fedora Update System 2015-02-05 13:15:28 UTC
selinux-policy-3.13.1-105.3.fc21 has been submitted as an update for Fedora 21.
https://admin.fedoraproject.org/updates/selinux-policy-3.13.1-105.3.fc21

Comment 3 Fedora Update System 2015-02-06 04:04:03 UTC
Package selinux-policy-3.13.1-105.3.fc21:
* should fix your issue,
* was pushed to the Fedora 21 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing selinux-policy-3.13.1-105.3.fc21'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2015-1768/selinux-policy-3.13.1-105.3.fc21
then log in and leave karma (feedback).

Comment 4 Fedora Update System 2015-02-15 03:29:29 UTC
selinux-policy-3.13.1-105.3.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.