_selinux-policy_ now contains five additional *SELinux* booleans
This update of the _selinux-policy_ packages introduces the following SELinux booleans:
* `keepalived_connect_any` - allows the *keepalived* service to connect to arbitrary ports.
* `tomcat_use_execmem` - allows the *Tomcat* server to make its stack executable.
* `tomcat_can_network_connect_db` - allows *Tomcat* to connect to the *PosgtreSQL* port.
* `redis_enable_notify` - allows the *redis-sentinel* service to run notification scripts.
* `zabbix_run_sudo` - allows the *zabbix_agent* service to run the *sudo* utility.
Description of problem:
With latest RHEL 7 / selinux-policy-3.13.1-102.el7_3.16 when configuring a keepalived virtual server on port 9090 (real servers elsewhere) we see:
type=AVC msg=audit(1492581128.143:69): avc: denied { name_connect } for pid=1495 comm="keepalived" dest=9090 scontext=system_u:system_r:keepalived_t:s0 tcontext=system_u:object_r:websm_port_t:s0 tclass=tcp_socket
It seems that there's no machinery to allow keepalived to connect to arbitrary ports (like we have with httpd/http_port_t) which would be needed as keepalived can be used with any ports (so merely adding 9090 wouldn't be that helpful).
Please make it possible to use any needed port with keepalived under SELinux.
Thanks.
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory, and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.
https://access.redhat.com/errata/RHBA-2018:3111
Description of problem: With latest RHEL 7 / selinux-policy-3.13.1-102.el7_3.16 when configuring a keepalived virtual server on port 9090 (real servers elsewhere) we see: type=AVC msg=audit(1492581128.143:69): avc: denied { name_connect } for pid=1495 comm="keepalived" dest=9090 scontext=system_u:system_r:keepalived_t:s0 tcontext=system_u:object_r:websm_port_t:s0 tclass=tcp_socket It seems that there's no machinery to allow keepalived to connect to arbitrary ports (like we have with httpd/http_port_t) which would be needed as keepalived can be used with any ports (so merely adding 9090 wouldn't be that helpful). Please make it possible to use any needed port with keepalived under SELinux. Thanks.