Bug 547247
| Summary: | SELinux is preventing /usr/libexec/mysqld from connecting to port 49527. | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Bradley <bbaetz> |
| Component: | selinux-policy | Assignee: | Daniel Walsh <dwalsh> |
| Status: | CLOSED CURRENTRELEASE | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | 12 | CC: | dwalsh, mgrepl |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Linux | ||
| Whiteboard: | setroubleshoot_trace_hash:ff4081aec444e76ab8ebbaaff51bafd4f4ad5bfbd050bc721bb45a942045e7bb | ||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2009-12-22 20:42:34 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
I'm playing with mysql clustering (all on the same machine). This uses dynamic ports (see http://lists.mysql.com/cluster/4773) Note - sometimes this is listed as success=yes, and setroubleshootd tells me that mysqld_t has a permissive type and that the access is permitted, ie: type=AVC msg=audit(1260766450.541:3673): avc: denied { name_connect } for pid =15630 comm="mysqld" dest=49527 scontext=unconfined_u:system_r:mysqld_t:s0 tcont ext=system_u:object_r:port_t:s0 tclass=tcp_socket type=SYSCALL msg=audit(1260766450.541:3673): arch=c000003e syscall=42 success=ye s exit=128 a0=1f a1=2b24bb4 a2=10 a3=0 items=0 ppid=15518 pid=15630 auid=500 uid =27 gid=27 euid=27 suid=27 fsuid=27 egid=27 sgid=27 fsgid=27 tty=pts0 ses=1 comm ="mysqld" exe="/usr/libexec/mysqld" subj=unconfined_u:system_r:mysqld_t:s0 key=( null) type=AVC msg=audit(1260766450.683:3674): avc: denied { name_connect } for pid =15630 comm="mysqld" dest=49527 scontext=unconfined_u:system_r:mysqld_t:s0 tcont ext=system_u:object_r:port_t:s0 tclass=tcp_socket type=SYSCALL msg=audit(1260766450.683:3674): arch=c000003e syscall=42 success=no exit=-13 a0=1f a1=2b24bb4 a2=10 a3=0 items=0 ppid=15518 pid=15630 auid=500 uid= 27 gid=27 euid=27 suid=27 fsuid=27 egid=27 sgid=27 fsgid=27 tty=pts0 ses=1 comm= "mysqld" exe="/usr/libexec/mysqld" subj=unconfined_u:system_r:mysqld_t:s0 key=(n ull) Even though it does log success=yes, it doesn't work, but disabling selinux enforcing allows the mysql sql api node to connect to the admin node. Added mysql_connect_any boolean. Fixed in selinux-policy-3.6.32-59.fc12.noarch selinux-policy-3.6.32-59.fc12 has been submitted as an update for Fedora 12. http://admin.fedoraproject.org/updates/selinux-policy-3.6.32-59.fc12 selinux-policy-3.6.32-59.fc12 has been pushed to the Fedora 12 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with su -c 'yum --enablerepo=updates-testing update selinux-policy'. You can provide feedback for this update here: http://admin.fedoraproject.org/updates/F12/FEDORA-2009-13384 |
Summary: SELinux is preventing /usr/libexec/mysqld from connecting to port 49527. Detailed Description: SELinux has denied mysqld from connecting to a network port 49527 which does not have an SELinux type associated with it. If mysqld should be allowed to connect on 49527, use the semanage command to assign 49527 to a port type that mysqld_t can connect to (ldap_port_t, dns_port_t, mysqld_port_t). If mysqld is not supposed to connect to 49527, this could signal a intrusion attempt. Allowing Access: If you want to allow mysqld to connect to 49527, you can execute semanage port -a -t PORT_TYPE -p tcp 49527 where PORT_TYPE is one of the following: ldap_port_t, dns_port_t, mysqld_port_t. Additional Information: Source Context unconfined_u:system_r:mysqld_t:s0 Target Context system_u:object_r:port_t:s0 Target Objects None [ tcp_socket ] Source mysqld Source Path /usr/libexec/mysqld Port 49527 Host (removed) Source RPM Packages mysql-server-5.1.40-1.fc12 Target RPM Packages Policy RPM selinux-policy-3.6.32-55.fc12 Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Plugin Name connect_ports Host Name (removed) Platform Linux (removed) 2.6.31.6-166.fc12.x86_64 #1 SMP Wed Dec 9 10:46:22 EST 2009 x86_64 x86_64 Alert Count 2069 First Seen Mon 14 Dec 2009 15:41:45 EST Last Seen Mon 14 Dec 2009 15:54:05 EST Local ID 3c3dadde-c61f-4935-b19c-c94bcd2be176 Line Numbers Raw Audit Messages node=(removed) type=AVC msg=audit(1260766445.664:3639): avc: denied { name_connect } for pid=15630 comm="mysqld" dest=49527 scontext=unconfined_u:system_r:mysqld_t:s0 tcontext=system_u:object_r:port_t:s0 tclass=tcp_socket node=(removed) type=SYSCALL msg=audit(1260766445.664:3639): arch=c000003e syscall=42 success=no exit=-13 a0=1f a1=2b24bb4 a2=10 a3=0 items=0 ppid=15518 pid=15630 auid=500 uid=27 gid=27 euid=27 suid=27 fsuid=27 egid=27 sgid=27 fsgid=27 tty=pts0 ses=1 comm="mysqld" exe="/usr/libexec/mysqld" subj=unconfined_u:system_r:mysqld_t:s0 key=(null) Hash String generated from selinux-policy-3.6.32-55.fc12,connect_ports,mysqld,mysqld_t,port_t,tcp_socket,name_connect audit2allow suggests: #============= mysqld_t ============== allow mysqld_t port_t:tcp_socket name_connect;