Bug 1443473

Summary: SELinux prevents keepalived to connect to arbitrary ports
Product: Red Hat Enterprise Linux 7 Reporter: Marko Myllynen <myllynen>
Component: selinux-policyAssignee: Lukas Vrabec <lvrabec>
Status: CLOSED ERRATA QA Contact: Milos Malik <mmalik>
Severity: unspecified Docs Contact: Mirek Jahoda <mjahoda>
Priority: unspecified    
Version: 7.3CC: bperkins, jswensso, lvrabec, mgrepl, mmalik, plautrba, ptalbert, pvrabec, ssekidde, zpytela
Target Milestone: rc   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Enhancement
Doc Text:
_selinux-policy_ now contains five additional *SELinux* booleans This update of the _selinux-policy_ packages introduces the following SELinux booleans: * `keepalived_connect_any` - allows the *keepalived* service to connect to arbitrary ports. * `tomcat_use_execmem` - allows the *Tomcat* server to make its stack executable. * `tomcat_can_network_connect_db` - allows *Tomcat* to connect to the *PosgtreSQL* port. * `redis_enable_notify` - allows the *redis-sentinel* service to run notification scripts. * `zabbix_run_sudo` - allows the *zabbix_agent* service to run the *sudo* utility.
Story Points: ---
Clone Of: Environment:
Last Closed: 2018-10-30 10:00:04 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description Marko Myllynen 2017-04-19 10:09:29 UTC
Description of problem:
With latest RHEL 7 / selinux-policy-3.13.1-102.el7_3.16 when configuring a keepalived virtual server on port 9090 (real servers elsewhere) we see:

type=AVC msg=audit(1492581128.143:69): avc:  denied  { name_connect } for pid=1495 comm="keepalived" dest=9090 scontext=system_u:system_r:keepalived_t:s0 tcontext=system_u:object_r:websm_port_t:s0 tclass=tcp_socket

It seems that there's no machinery to allow keepalived to connect to arbitrary ports (like we have with httpd/http_port_t) which would be needed as keepalived can be used with any ports (so merely adding 9090 wouldn't be that helpful).

Please make it possible to use any needed port with keepalived under SELinux.

Thanks.

Comment 9 errata-xmlrpc 2018-10-30 10:00:04 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:3111