Bug 1043575
| Summary: | SELinux is preventing /usr/sbin/sshd from 'name_bind' accesses on the tcp_socket . | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | frywalker <fry.futurateam> |
| Component: | selinux-policy | Assignee: | Miroslav Grepl <mgrepl> |
| Status: | CLOSED DUPLICATE | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 20 | CC: | dominick.grift, dwalsh, lvrabec, mgrepl |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Unspecified | ||
| Whiteboard: | abrt_hash:39395824d3ce675fbf6d1bc27a031db72f5c01d06648195e5193c2ca32a8c575 | ||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2014-01-07 11:34:59 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
*** This bug has been marked as a duplicate of bug 826905 *** |
Description of problem: just an "yum update". I don't have more information SELinux is preventing /usr/sbin/sshd from 'name_bind' accesses on the tcp_socket . ***** Plugin catchall (100. confidence) suggests ************************** If vous pensez que sshd devrait être autorisé à accéder name_bind sur tcp_socket par défaut. Then vous devriez rapporter ceci en tant qu'anomalie. Vous pouvez générer un module de stratégie local pour autoriser cet accès. Do autoriser cet accès pour le moment en exécutant : # grep sshd /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context system_u:system_r:sshd_t:s0-s0:c0.c1023 Target Context system_u:object_r:http_port_t:s0 Target Objects [ tcp_socket ] Source sshd Source Path /usr/sbin/sshd Port 443 Host (removed) Source RPM Packages openssh-server-6.4p1-3.fc20.x86_64 Target RPM Packages Policy RPM selinux-policy-3.12.1-106.fc20.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 3.12.4-1.fc21.x86_64 #1 SMP Mon Dec 9 16:13:55 UTC 2013 x86_64 x86_64 Alert Count 15 First Seen 2013-12-06 18:35:11 CET Last Seen 2013-12-16 17:39:41 CET Local ID 06bebf88-6320-4e4f-9f88-df5298e9820d Raw Audit Messages type=AVC msg=audit(1387211981.485:1846): avc: denied { name_bind } for pid=7519 comm="sshd" src=443 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:http_port_t:s0 tclass=tcp_socket type=SYSCALL msg=audit(1387211981.485:1846): arch=x86_64 syscall=bind success=no exit=EACCES a0=3 a1=7f890d2c53f0 a2=1c a3=7fff69328ba4 items=0 ppid=1 pid=7519 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm=sshd exe=/usr/sbin/sshd subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 key=(null) Hash: sshd,sshd_t,http_port_t,tcp_socket,name_bind Additional info: reporter: libreport-2.1.9 hashmarkername: setroubleshoot kernel: 3.12.4-1.fc21.x86_64 type: libreport Potential duplicate: bug 826905