Bug 1285425

Summary:	SELinux is preventing /usr/bin/perl from name_connect
Product:	[Fedora] Fedora	Reporter:	dan
Component:	selinux-policy	Assignee:	Vit Mojzis <vmojzis>
Status:	CLOSED ERRATA	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	22	CC:	dan, dominick.grift, dwalsh, lvrabec, mgrepl, plautrba
Target Milestone:	---
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	selinux-policy-3.13.1-128.23.fc22 selinux-policy-3.13.1-128.28.fc22	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2016-05-10 17:57:28 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description dan 2015-11-25 14:55:31 UTC

Description of problem:

/usr/bin/perl is being denied name_connect on unreserved tcp sockets.

How reproducible:

Always reproduceable.

Steps to Reproduce:

Using the ClamAV.pm perl module called by spamassasin, any attempt to scan a message triggers this error.  Setting the spamd process domain to permissive allows the connect to proceed.

xref bug #1248785

Comment 2 Vit Mojzis 2015-11-26 07:47:15 UTC

Since you are using custom configuration, could you please provide related AVC's in permissive mode?

#setenforce 0
<reproduce the issue>
#ausearch -m avc -ts recent
<or /var/log/audit/audit.log>
#setenforce 1

Comment 3 dan 2015-11-26 16:57:24 UTC

Updated to properly show that it is /usr/bin/perl being denied the name_connect.

Comment 4 dan 2015-11-26 17:03:14 UTC

Here is an example:

Raw Audit Messages
type=AVC msg=audit(1448557215.888:6073): avc:  denied  { name_connect } for  pid=3498 comm=7370616D64206368696C64 dest=1948 scontext=system_u:system_r:spamd_t:s0 tcontext=system_u:object_r:unreserved_port_t:s0 tclass=tcp_socket permissive=1


type=SYSCALL msg=audit(1448557215.888:6073): arch=x86_64 syscall=connect success=no exit=EINPROGRESS a0=b a1=6650150 a2=10 a3=f50 items=0 ppid=18216 pid=3498 auid=4294967295 uid=401 gid=401 euid=401 suid=401 fsuid=401 egid=401 sgid=401 fsgid=401 tty=(none) ses=4294967295 comm=7370616D64206368696C64 exe=/usr/bin/perl subj=system_u:system_r:spamd_t:s0 key=(null)

Hash: 7370616D64206368696C64,spamd_t,unreserved_port_t,tcp_socket,name_connect

Comment 5 Vit Mojzis 2015-12-09 16:47:56 UTC

    
commit cdfb8f857496356e08af0f06bacea652ef98630b
Author: Vit Mojzis <vmojzis>
Date:   Wed Dec 9 17:25:43 2015 +0100

    Allow spamd_t connecting to unreserved ports. #1285425
    Necessary for communication with antivirus. viz. #1248785


https://github.com/fedora-selinux/selinux-policy/pull/80

Comment 6 Fedora Update System 2016-01-18 13:20:23 UTC

selinux-policy-3.13.1-128.25.fc22 has been submitted as an update to Fedora 22. https://bodhi.fedoraproject.org/updates/FEDORA-2016-825869e1a4

Comment 7 Fedora Update System 2016-01-20 03:53:40 UTC

selinux-policy-3.13.1-128.25.fc22 has been pushed to the Fedora 22 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-825869e1a4

Comment 8 Fedora Update System 2016-02-15 17:47:23 UTC

selinux-policy-3.13.1-128.27.fc22 has been submitted as an update to Fedora 22. https://bodhi.fedoraproject.org/updates/FEDORA-2016-ce419c9cab

Comment 9 Fedora Update System 2016-02-17 06:26:27 UTC

selinux-policy-3.13.1-128.27.fc22 has been pushed to the Fedora 22 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-ce419c9cab

Comment 10 Fedora Update System 2016-02-18 12:28:22 UTC

selinux-policy-3.13.1-128.28.fc22 has been submitted as an update to Fedora 22. https://bodhi.fedoraproject.org/updates/FEDORA-2016-ce419c9cab

Comment 11 Fedora Update System 2016-02-21 18:29:21 UTC

selinux-policy-3.13.1-128.28.fc22 has been pushed to the Fedora 22 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-ce419c9cab

Comment 12 Fedora Update System 2016-05-10 17:56:07 UTC

selinux-policy-3.13.1-128.28.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.