Hide Forgot
SELinux is preventing ejabberd (/usr/lib64/erlang/erts-5.9.3.1/bin/beam.smp) from name_connect access on the 5269/tcp (tcp_socket) # rpm -q ejabberd ejabberd-2.1.13-7.fc19.x86_64 # grep 5269 /etc/services xmpp-server 5269/tcp # XMPP Server Connection # LANG=C sealert -l 314de087-a46f-452a-ad38-25d6b8c1bd6f SELinux is preventing /usr/lib64/erlang/erts-5.9.3.1/bin/beam.smp from name_connect access on the tcp_socket . ***** Plugin catchall (100. confidence) suggests *************************** If you believe that beam.smp should be allowed name_connect access on the tcp_socket by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # grep beam.smp /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context system_u:system_r:rabbitmq_beam_t:s0 Target Context system_u:object_r:jabber_interserver_port_t:s0 Target Objects [ tcp_socket ] Source beam.smp Source Path /usr/lib64/erlang/erts-5.9.3.1/bin/beam.smp Port 5269 Host srv6.kola.fad.ru Source RPM Packages erlang-erts-R16B-02.3.fc19.x86_64 Target RPM Packages Policy RPM selinux-policy-3.12.1-74.14.fc19.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Permissive Host Name srv6.kola.fad.ru Platform Linux srv6.kola.fad.ru 3.11.9-200.fc19.x86_64 #1 SMP Wed Nov 20 21:22:24 UTC 2013 x86_64 x86_64 Alert Count 2624 First Seen 2013-10-04 08:45:11 MSK Last Seen 2013-12-06 08:16:05 MSK Local ID 314de087-a46f-452a-ad38-25d6b8c1bd6f Raw Audit Messages type=AVC msg=audit(1386303365.247:350): avc: denied { name_connect } for pid=1002 comm="beam.smp" dest=5269 scontext=system_u:system_r:rabbitmq_beam_t:s0 tcontext=system_u:object_r:jabber_interserver_port_t:s0 tclass=tcp_socket type=SYSCALL msg=audit(1386303365.247:350): arch=x86_64 syscall=connect success=no exit=EINPROGRESS a0=38 a1=7ff12b1ab680 a2=10 a3=1 items=0 ppid=1 pid=1002 auid=4294967295 uid=985 gid=984 euid=985 suid=985 fsuid=985 egid=984 sgid=984 fsgid=984 ses=4294967295 tty=(none) comm=beam.smp exe=/usr/lib64/erlang/erts-5.10.3/bin/beam.smp subj=system_u:system_r:rabbitmq_beam_t:s0 key=(null) Hash: beam.smp,rabbitmq_beam_t,jabber_interserver_port_t,tcp_socket,name_connect
# rpm -q ejabberd ejabberd-2.1.13-7.fc20.x86_64 SELinux is preventing /usr/lib64/erlang/erts-5.10.4/bin/beam.smp from name_connect access on the tcp_socket . ***** Plugin catchall (100. confidence) suggests ************************** If you believe that beam.smp should be allowed name_connect access on the tcp_socket by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # grep beam.smp /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context system_u:system_r:rabbitmq_beam_t:s0 Target Context system_u:object_r:jabber_interserver_port_t:s0 Target Objects [ tcp_socket ] Source beam.smp Source Path /usr/lib64/erlang/erts-5.10.4/bin/beam.smp Port 5269 Host strange.miceliux.com Source RPM Packages erlang-erts-R16B-03.1.fc20.x86_64 Target RPM Packages Policy RPM selinux-policy-3.12.1-122.fc20.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name strange.miceliux.com Platform Linux strange.miceliux.com 3.13.3-201.fc20.x86_64 #1 SMP Fri Feb 14 19:08:32 UTC 2014 x86_64 x86_64 Alert Count 1 First Seen 2014-02-24 13:51:51 CET Last Seen 2014-02-24 13:51:51 CET Local ID f6639631-2a41-48a6-830a-828127d8ccf1 Raw Audit Messages type=AVC msg=audit(1393246311.400:175216): avc: denied { name_connect } for pid=21576 comm="beam.smp" dest=5269 scontext=system_u:system_r:rabbitmq_beam_t:s0 tcontext=system_u:object_r:jabber_interserver_port_t:s0 tclass=tcp_socket type=SYSCALL msg=audit(1393246311.400:175216): arch=x86_64 syscall=connect success=no exit=EACCES a0=18 a1=7fa1b7c41a48 a2=10 a3=1 items=0 ppid=1 pid=21576 auid=4294967295 uid=989 gid=989 euid=989 suid=989 fsuid=989 egid=989 sgid=989 fsgid=989 ses=4294967295 tty=(none) comm=beam.smp exe=/usr/lib64/erlang/erts-5.10.4/bin/beam.smp subj=system_u:system_r:rabbitmq_beam_t:s0 key=(null) Hash: beam.smp,rabbitmq_beam_t,jabber_interserver_port_t,tcp_socket,name_connect
commit c98518430905a983fb0aeceb0c4bfb1277668e78 allows this in git.