Bug 1047099 - SELinux is preventing /usr/bin/gogoc from 'name_connect' accesses on the tcp_socket .
Summary: SELinux is preventing /usr/bin/gogoc from 'name_connect' accesses on the tcp_...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: gogoc
Version: 20
Hardware: x86_64
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Juan Orti Alcaine
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: abrt_hash:ace6e6a67cdac8d33c70378cf8a...
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2013-12-29 02:17 UTC by Alex Villacís Lasso
Modified: 2014-01-22 23:05 UTC (History)
5 users (show)

Fixed In Version: gogoc-1.2-34.fc20
Clone Of:
Environment:
Last Closed: 2014-01-22 23:05:33 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Alex Villacís Lasso 2013-12-29 02:17:25 UTC
Description of problem:
SELinux is preventing /usr/bin/gogoc from 'name_connect' accesses on the tcp_socket .

*****  Plugin connect_ports (92.2 confidence) suggests   *********************

If you want to allow /usr/bin/gogoc to connect to network port 3653
Then you need to modify the port type.
Do
# semanage port -a -t TIPO_DE_PUERTO -p tcp 3653</b>
    donde TIPO_DE_PUERTO es uno de los siguientes: dns_port_t, kerberos_port_t, ocsp_port_t.    

*****  Plugin catchall_boolean (7.83 confidence) suggests   ******************

If desea permite al sistema ejecutar con NIS
Then usted debe decir a SELinux sobre esto habilitando el booleano 'nis_enabled'.
Puede leer la página man de 'None' para más detalles.
Do
setsebool -P nis_enabled 1

*****  Plugin catchall (1.41 confidence) suggests   **************************

If cree que de manera predeterminada, gogoc debería permitir acceso name_connect sobre   tcp_socket.     
Then debería reportar esto como un error.
Puede generar un módulo de política local para permitir este acceso.
Do
permita el acceso momentáneamente executando:
# grep gogoc /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                system_u:system_r:gogoc_t:s0
Target Context                system_u:object_r:unreserved_port_t:s0
Target Objects                 [ tcp_socket ]
Source                        gogoc
Source Path                   /usr/bin/gogoc
Port                          3653
Host                          (removed)
Source RPM Packages           gogoc-1.2-32.fc20.x86_64
Target RPM Packages           
Policy RPM                    selinux-policy-3.12.1-106.fc20.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 3.12.5-302.fc20.x86_64 #1 SMP Tue
                              Dec 17 20:42:32 UTC 2013 x86_64 x86_64
Alert Count                   1
First Seen                    2013-12-28 18:29:13 ECT
Last Seen                     2013-12-28 18:29:13 ECT
Local ID                      b4ef1622-1bff-45b3-8868-31913ddb2062

Raw Audit Messages
type=AVC msg=audit(1388273353.303:543): avc:  denied  { name_connect } for  pid=1155 comm="gogoc" dest=3653 scontext=system_u:system_r:gogoc_t:s0 tcontext=system_u:object_r:unreserved_port_t:s0 tclass=tcp_socket


type=SYSCALL msg=audit(1388273353.303:543): arch=x86_64 syscall=connect success=no exit=EACCES a0=3 a1=7fffe92d0d90 a2=10 a3=0 items=0 ppid=1 pid=1155 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm=gogoc exe=/usr/bin/gogoc subj=system_u:system_r:gogoc_t:s0 key=(null)

Hash: gogoc,gogoc_t,unreserved_port_t,tcp_socket,name_connect

Additional info:
reporter:       libreport-2.1.10
hashmarkername: setroubleshoot
kernel:         3.12.5-302.fc20.x86_64
type:           libreport

Comment 1 Daniel Walsh 2014-01-03 18:46:19 UTC
gogoc ships its own policy so its their bug.

Comment 2 Fedora Update System 2014-01-13 09:05:42 UTC
gogoc-1.2-34.fc20 has been submitted as an update for Fedora 20.
https://admin.fedoraproject.org/updates/gogoc-1.2-34.fc20

Comment 3 Fedora Update System 2014-01-14 08:47:25 UTC
Package gogoc-1.2-34.fc20:
* should fix your issue,
* was pushed to the Fedora 20 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing gogoc-1.2-34.fc20'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2014-0774/gogoc-1.2-34.fc20
then log in and leave karma (feedback).

Comment 4 Fedora Update System 2014-01-22 23:05:33 UTC
gogoc-1.2-34.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.