Bug 671215

Summary:

SELinux is preventing the users from running TCP servers in the usedomain.

Detailed Description:

SELinux has denied the python program from binding to a network port 8517 which
does not have an SELinux type associated with it. python does not have an
SELinux policy defined for it when run by the user, so it runs in the users
domain. SELinux is currently setup to deny TCP servers to run within the user
domain. If you do not expect programs like python to bind to a network port,
then this could signal an intrusion attempt. If this system is running as an NIS
Client, turning on the allow_ypbind boolean may fix the problem. setsebool -P
allow_ypbind=1.

Allowing Access:

If you want to allow user programs to run as TCP Servers, you can turn on the
user_tcp_server boolean, by executing: setsebool -P user_tcp_server=1

Fix Command:

setsebool -P user_tcp_server=1

Additional Information:

Source Context                user_u:user_r:user_t:s0
Target Context                system_u:object_r:port_t:s0
Target Objects                None [ tcp_socket ]
Source                        plasma-desktop
Source Path                   /usr/bin/plasma-desktop
Port                          8517
Host                          (removed)
Source RPM Packages           python-2.6.4-27.fc13
Target RPM Packages           
Policy RPM                    selinux-policy-3.7.19-76.fc13
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Plugin Name                   user_tcp_server
Host Name                     (removed)
Platform                      Linux (removed) 2.6.34.7-66.fc13.i686 #1
                              SMP Wed Dec 15 07:40:25 UTC 2010 i686 i686
Alert Count                   120
First Seen                    Thu 06 Jan 2011 10:46:35 PM EST
Last Seen                     Sun 16 Jan 2011 05:00:29 PM EST
Local ID                      88f683e1-bceb-4cd1-86ff-5b64389add7e
Line Numbers                  

Raw Audit Messages            

node=(removed) type=AVC msg=audit(1295215229.968:210170): avc:  denied  { name_bind } for  pid=4730 comm="python" src=8517 scontext=user_u:user_r:user_t:s0 tcontext=system_u:object_r:port_t:s0 tclass=tcp_socket

node=(removed) type=SYSCALL msg=audit(1295215229.968:210170): arch=40000003 syscall=102 success=no exit=-13 a0=2 a1=b48fb1d0 a2=2ab5420 a3=b48feb38 items=0 ppid=4582 pid=4730 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=6 comm="python" exe="/usr/bin/python" subj=user_u:user_r:user_t:s0 key=(null)



Hash String generated from  user_tcp_server,plasma-desktop,user_t,port_t,tcp_socket,name_bind
audit2allow suggests:

#============= user_t ==============
#!!!! This avc can be allowed using one of the these booleans:
#     user_tcp_server, allow_ypbind

allow user_t port_t:tcp_socket name_bind;