| Summary: | SELinux is preventing ejabberd (/usr/lib64/erlang/erts-5.9.3.1/bin/beam.smp) from name_connect access on the 5269/tcp (tcp_socket) | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Vladislav Grigoryev <vg.aetera> |
| Component: | selinux-policy | Assignee: | Miroslav Grepl <mgrepl> |
| Status: | CLOSED CURRENTRELEASE | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | medium | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 20 | CC: | dominick.grift, dwalsh, jorti, lvrabec, mgrepl, vg.aetera |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2014-11-24 12:33:17 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
# rpm -q ejabberd
ejabberd-2.1.13-7.fc20.x86_64
SELinux is preventing /usr/lib64/erlang/erts-5.10.4/bin/beam.smp from name_connect access on the tcp_socket .
***** Plugin catchall (100. confidence) suggests **************************
If you believe that beam.smp should be allowed name_connect access on the tcp_socket by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep beam.smp /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp
Additional Information:
Source Context system_u:system_r:rabbitmq_beam_t:s0
Target Context system_u:object_r:jabber_interserver_port_t:s0
Target Objects [ tcp_socket ]
Source beam.smp
Source Path /usr/lib64/erlang/erts-5.10.4/bin/beam.smp
Port 5269
Host strange.miceliux.com
Source RPM Packages erlang-erts-R16B-03.1.fc20.x86_64
Target RPM Packages
Policy RPM selinux-policy-3.12.1-122.fc20.noarch
Selinux Enabled True
Policy Type targeted
Enforcing Mode Enforcing
Host Name strange.miceliux.com
Platform Linux strange.miceliux.com 3.13.3-201.fc20.x86_64
#1 SMP Fri Feb 14 19:08:32 UTC 2014 x86_64 x86_64
Alert Count 1
First Seen 2014-02-24 13:51:51 CET
Last Seen 2014-02-24 13:51:51 CET
Local ID f6639631-2a41-48a6-830a-828127d8ccf1
Raw Audit Messages
type=AVC msg=audit(1393246311.400:175216): avc: denied { name_connect } for pid=21576 comm="beam.smp" dest=5269 scontext=system_u:system_r:rabbitmq_beam_t:s0 tcontext=system_u:object_r:jabber_interserver_port_t:s0 tclass=tcp_socket
type=SYSCALL msg=audit(1393246311.400:175216): arch=x86_64 syscall=connect success=no exit=EACCES a0=18 a1=7fa1b7c41a48 a2=10 a3=1 items=0 ppid=1 pid=21576 auid=4294967295 uid=989 gid=989 euid=989 suid=989 fsuid=989 egid=989 sgid=989 fsgid=989 ses=4294967295 tty=(none) comm=beam.smp exe=/usr/lib64/erlang/erts-5.10.4/bin/beam.smp subj=system_u:system_r:rabbitmq_beam_t:s0 key=(null)
Hash: beam.smp,rabbitmq_beam_t,jabber_interserver_port_t,tcp_socket,name_connect
commit c98518430905a983fb0aeceb0c4bfb1277668e78 allows this in git. |
SELinux is preventing ejabberd (/usr/lib64/erlang/erts-5.9.3.1/bin/beam.smp) from name_connect access on the 5269/tcp (tcp_socket) # rpm -q ejabberd ejabberd-2.1.13-7.fc19.x86_64 # grep 5269 /etc/services xmpp-server 5269/tcp # XMPP Server Connection # LANG=C sealert -l 314de087-a46f-452a-ad38-25d6b8c1bd6f SELinux is preventing /usr/lib64/erlang/erts-5.9.3.1/bin/beam.smp from name_connect access on the tcp_socket . ***** Plugin catchall (100. confidence) suggests *************************** If you believe that beam.smp should be allowed name_connect access on the tcp_socket by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # grep beam.smp /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context system_u:system_r:rabbitmq_beam_t:s0 Target Context system_u:object_r:jabber_interserver_port_t:s0 Target Objects [ tcp_socket ] Source beam.smp Source Path /usr/lib64/erlang/erts-5.9.3.1/bin/beam.smp Port 5269 Host srv6.kola.fad.ru Source RPM Packages erlang-erts-R16B-02.3.fc19.x86_64 Target RPM Packages Policy RPM selinux-policy-3.12.1-74.14.fc19.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Permissive Host Name srv6.kola.fad.ru Platform Linux srv6.kola.fad.ru 3.11.9-200.fc19.x86_64 #1 SMP Wed Nov 20 21:22:24 UTC 2013 x86_64 x86_64 Alert Count 2624 First Seen 2013-10-04 08:45:11 MSK Last Seen 2013-12-06 08:16:05 MSK Local ID 314de087-a46f-452a-ad38-25d6b8c1bd6f Raw Audit Messages type=AVC msg=audit(1386303365.247:350): avc: denied { name_connect } for pid=1002 comm="beam.smp" dest=5269 scontext=system_u:system_r:rabbitmq_beam_t:s0 tcontext=system_u:object_r:jabber_interserver_port_t:s0 tclass=tcp_socket type=SYSCALL msg=audit(1386303365.247:350): arch=x86_64 syscall=connect success=no exit=EINPROGRESS a0=38 a1=7ff12b1ab680 a2=10 a3=1 items=0 ppid=1 pid=1002 auid=4294967295 uid=985 gid=984 euid=985 suid=985 fsuid=985 egid=984 sgid=984 fsgid=984 ses=4294967295 tty=(none) comm=beam.smp exe=/usr/lib64/erlang/erts-5.10.3/bin/beam.smp subj=system_u:system_r:rabbitmq_beam_t:s0 key=(null) Hash: beam.smp,rabbitmq_beam_t,jabber_interserver_port_t,tcp_socket,name_connect