Attachment 295541 Details for Bug 433703 – selinux port outpout

selinux port outpout

selinux.txt (text/plain), 2.70 KB, created by Mike Christie on 2008-02-21 17:11:31 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Mike Christie

Created: 2008-02-21 17:11:31 UTC

Size: 2.70 KB

patch

obsolete

>Feb 20 16:03:19 meanminna-5 setroubleshoot: SELinux is preventing the iscsid (iscsid_t) from connecting to port 3205. For complete SELinux messages. run sealert -l 9f52c97d-e46b-4f5a-aa03-a4eb2033bd5d
>
>
>
>[root@meanminna-5 ~]# sealert -l 9f52c97d-e46b-4f5a-aa03-a4eb2033bd5d
>
>Summary:
>
>SELinux is preventing the iscsid (iscsid_t) from connecting to port 3205.
>
>Detailed Description:
>
>SELinux has denied the iscsid from connecting to a network port 3205 which does
>not have an SELinux type associated with it. If iscsid is supposed to be allowed
>to connect on this port, you can use the semanage command to add this port to a
>port type that iscsid_t can connect to. semanage port -L will list all port
>types. Please file a bug report
>(http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against the selinux-policy
>package. If iscsid is not supposed to bind to this port, this could signal a
>intrusion attempt.
>
>Allowing Access:
>
>If you want to allow iscsid to connect to this port semanage port -a -t
>PORT_TYPE -p PROTOCOL 3205 Where PORT_TYPE is a type that iscsid_t can connect.
>
>Additional Information:
>
>Source Context                root:system_r:iscsid_t
>Target Context                system_u:object_r:port_t
>Target Objects                None [ tcp_socket ]
>Source                        iscsid
>Source Path                   /sbin/iscsid
>Port                          3205
>Host                          meanminna-5.2
>Source RPM Packages           iscsi-initiator-utils-6.2.0.868-0.3.el5
>Target RPM Packages           
>Policy RPM                    selinux-policy-2.4.6-121.el5
>Selinux Enabled               True
>Policy Type                   targeted
>MLS Enabled                   True
>Enforcing Mode                Enforcing
>Plugin Name                   connect_ports
>Host Name                     meanminna-5.2
>Platform                      Linux meanminna-5.2 2.6.18-79.el5 #1 SMP Fri Feb 8
>                              01:28:17 EST 2008 x86_64 x86_64
>Alert Count                   1
>First Seen                    Wed Feb 20 16:03:17 2008
>Last Seen                     Wed Feb 20 16:03:17 2008
>Local ID                      9f52c97d-e46b-4f5a-aa03-a4eb2033bd5d
>Line Numbers                  
>
>Raw Audit Messages            
>
>host=meanminna-5.2 type=AVC msg=audit(1203541397.94:18): avc:  denied  { name_connect } for  pid=6793 comm="iscsid" dest=3205 scontext=root:system_r:iscsid_t:s0 tcontext=system_u:object_r:port_t:s0 tclass=tcp_socket
>
>host=meanminna-5.2 type=SYSCALL msg=audit(1203541397.94:18): arch=c000003e syscall=42 success=no exit=-13 a0=9 a1=62aae0 a2=80 a3=0 items=0 ppid=1 pid=6793 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="iscsid" exe="/sbin/iscsid" subj=root:system_r:iscsid_t:s0 key=(null)
>

Actions: View

Attachments on bug 433703: 295460 | 295461 | 295541