Bug 509707

The following was filed automatically by setroubleshoot:

Résumé:

SELinux is preventing httpd (httpd_t) "name_bind" transproxy_port_t.

Description détaillée:

SELinux denied access requested by httpd. It is not expected that this access is
required by httpd and this access may signal an intrusion attempt. It is also
possible that the specific version or configuration of the application is
causing it to require additional access.

Autoriser l'accès:

You can generate a local policy module to allow this access - see FAQ
(http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385) Or you can disable
SELinux protection altogether. Disabling SELinux protection is not recommended.
Please file a bug report (http://bugzilla.redhat.com/bugzilla/enter_bug.cgi)
against this package.

Informations complémentaires:

Contexte source               unconfined_u:system_r:httpd_t:s0
Contexte cible                system_u:object_r:transproxy_port_t:s0
Objets du contexte            None [ tcp_socket ]
source                        httpd
Chemin de la source           /usr/sbin/httpd
Port                          8081
Hôte                         (removed)
Paquetages RPM source         httpd-2.2.11-9
Paquetages RPM cible          
Politique RPM                 selinux-policy-3.6.20-2.fc12
Selinux activé               True
Type de politique             targeted
MLS activé                   True
Mode strict                   Enforcing
Nom du plugin                 catchall
Nom de l'hôte                (removed)
Plateforme                    Linux (removed) 2.6.31-0.42.rc2.fc12.x86_64 #1 SMP
                              Sat Jul 4 20:49:29 EDT 2009 x86_64 x86_64
Compteur d'alertes            3
Première alerte              dim. 05 juil. 2009 13:57:14 CEST
Dernière alerte              dim. 05 juil. 2009 14:02:41 CEST
ID local                      fe603b18-2d4c-4239-b781-3d4f78fd934a
Numéros des lignes           

Messages d'audit bruts        

node=(removed) type=AVC msg=audit(1246795361.888:31248): avc:  denied  { name_bind } for  pid=3668 comm="httpd" src=8081 scontext=unconfined_u:system_r:httpd_t:s0 tcontext=system_u:object_r:transproxy_port_t:s0 tclass=tcp_socket

node=(removed) type=SYSCALL msg=audit(1246795361.888:31248): arch=c000003e syscall=49 success=yes exit=0 a0=6 a1=7fb23e213bb0 a2=10 a3=7fff5e8db54c items=0 ppid=3667 pid=3668 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="httpd" exe="/usr/sbin/httpd" subj=unconfined_u:system_r:httpd_t:s0 key=(null)


audit2allow suggests:

#============= httpd_t ==============
allow httpd_t transproxy_port_t:tcp_socket name_bind;