Attachment 309477 Details for Bug 451631 – Alert text from sealert

Alert text from sealert

selinux_alert.txt (text/plain), 2.91 KB, created by Adam Huffman on 2008-06-16 10:52:54 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Adam Huffman

Created: 2008-06-16 10:52:54 UTC

Size: 2.91 KB

patch

obsolete

>
>Summary:
>
>SELinux is preventing the spamassassin (spamassassin_t) from binding to port
>32230.
>
>Detailed Description:
>
>[SELinux is in permissive mode, the operation would have been denied but was
>permitted due to permissive mode.]
>
>SELinux has denied the spamassassin from binding to a network port 32230 which
>does not have an SELinux type associated with it. If spamassassin is supposed to
>be allowed to listen on this port, you can use the semanage command to add this
>port to a port type that spamassassin_t can bind to. semanage port -l will list
>all port types. Please file a bug report
>(http://bugzilla.redhat.com/bugzilla/enter_bug.cgi) against the selinux-policy
>package. If spamassassin is not supposed to bind to this port, this could signal
>a intrusion attempt. If this system is running as an NIS Client, turning on the
>allow_ypbind boolean, may fix the problem. setsebool -P allow_ypbind=1.
>
>Allowing Access:
>
>If you want to allow spamassassin to bind to this port semanage port -a -t
>PORT_TYPE -p PROTOCOL 32230 Where PORT_TYPE is a type that spamassassin_t can
>bind and PROTOCOL is udp or tcp.
>
>Additional Information:
>
>Source Context                system_u:system_r:spamassassin_t
>Target Context                system_u:object_r:port_t
>Target Objects                None [ udp_socket ]
>Source                        spamassassin
>Source Path                   /usr/bin/perl
>Port                          32230
>Host                          saintloup.smith.man.ac.uk
>Source RPM Packages           perl-5.10.0-22.fc9
>Target RPM Packages           
>Policy RPM                    selinux-policy-3.3.1-64.fc9
>Selinux Enabled               True
>Policy Type                   targeted
>MLS Enabled                   True
>Enforcing Mode                Permissive
>Plugin Name                   bind_ports
>Host Name                     saintloup.smith.man.ac.uk
>Platform                      Linux saintloup.smith.man.ac.uk
>                              2.6.25.6-55.fc9.x86_64 #1 SMP Tue Jun 10 16:05:21
>                              EDT 2008 x86_64 x86_64
>Alert Count                   65802
>First Seen                    Tue 03 Jun 2008 11:37:51 BST
>Last Seen                     Mon 16 Jun 2008 11:51:34 BST
>Local ID                      5764345e-bd19-4c22-b94b-7e77c8dd9ea8
>Line Numbers                  
>
>Raw Audit Messages            
>
>host=saintloup.smith.man.ac.uk type=AVC msg=audit(1213613494.259:1224): avc:  denied  { name_bind } for  pid=5705 comm="spamassassin" src=32230 scontext=system_u:system_r:spamassassin_t:s0 tcontext=system_u:object_r:port_t:s0 tclass=udp_socket
>
>host=saintloup.smith.man.ac.uk type=SYSCALL msg=audit(1213613494.259:1224): arch=c000003e syscall=49 success=yes exit=0 a0=7 a1=1808e58 a2=10 a3=0 items=0 ppid=5704 pid=5705 auid=4294967295 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=4294967295 comm="spamassassin" exe="/usr/bin/perl" subj=system_u:system_r:spamassassin_t:s0 key=(null)
>
>

Actions: View

Attachments on bug 451631: 309477