Bug 1255627

It seems that a SELinux type name was not provided by the setroubleshoot plugin:

# semanage port -a -t  -p udp 5382

Could you attach AVC denial?

Thank you.

Here's everything the setroubleshoot tool gives me. You can find the avc denial at the bottom


SELinux is preventing /usr/lib64/firefox/plugin-container from name_bind access on the udp_socket port 5190.

*****  Plugin mozplugger (82.0 confidence) suggests   ************************

If you want to use the plugin package
Then вие трябва да изключите SELinux контрола върху Firefox плъгини.
Do
# setsebool -P unconfined_mozilla_plugin_transition 0

*****  Plugin catchall_boolean (9.19 confidence) suggests   ******************

If искате да allow mozilla to plugin bind unreserved ports
Then you must tell SELinux about this by enabling the 'mozilla_plugin_bind_unreserved_ports' boolean.
Може да прочетете man 'None' за повече информация.
Do
setsebool -P mozilla_plugin_bind_unreserved_ports 1

*****  Plugin catchall_boolean (9.19 confidence) suggests   ******************

If искате да allow mozilla to plugin use bluejeans
Then you must tell SELinux about this by enabling the 'mozilla_plugin_use_bluejeans' boolean.
Може да прочетете man 'None' за повече информация.
Do
setsebool -P mozilla_plugin_use_bluejeans 1

*****  Plugin catchall (1.58 confidence) suggests   **************************

If вярвате, че на plugin-container, по подразбиране,  трябва да е позволен достъп name_bind върху port 5190 udp_socket.
Then вие ще трябва да докладвате този бъг.
Можете да генерирате модул с локална политика за да позволите този достъп.
Do
позволете този достъп засега като изпълните:
# grep plugin-containe /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c
                              0.c1023
Target Context                system_u:object_r:aol_port_t:s0
Target Objects                port 5190 [ udp_socket ]
Source                        plugin-containe
Source Path                   /usr/lib64/firefox/plugin-container
Port                          5190
Host                          aero
Source RPM Packages           firefox-38.2.0-4.el7_1.x86_64
Target RPM Packages           
Policy RPM                    selinux-policy-3.13.1-23.el7_1.13.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     aero
Platform                      Linux aero 3.10.0-229.11.1.el7.x86_64 #1 SMP Wed
                              Jul 22 12:06:11 EDT 2015 x86_64 x86_64
Alert Count                   3
First Seen                    2015-08-21 11:16:12 EEST
Last Seen                     2015-08-21 11:16:12 EEST
Local ID                      3cfa5239-d77b-4e28-8346-765f52d35c30

Raw Audit Messages
type=AVC msg=audit(1440144972.253:2182): avc:  denied  { name_bind } for  pid=20404 comm="plugin-containe" src=5190 scontext=unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c0.c1023 tcontext=system_u:object_r:aol_port_t:s0 tclass=udp_socket


type=SYSCALL msg=audit(1440144972.253:2182): arch=x86_64 syscall=bind success=no exit=EACCES a0=26 a1=7f4b5a0fae60 a2=10 a3=1 items=0 ppid=4379 pid=20404 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=1 comm=plugin-containe exe=/usr/lib64/firefox/plugin-container subj=unconfined_u:unconfined_r:mozilla_plugin_t:s0-s0:c0.c1023 key=(null)

Hash: plugin-containe,mozilla_plugin_t,aol_port_t,udp_socket,name_bind

https://github.com/fedora-selinux/setroubleshoot/pull/69/commits/7543dc9d553a615fdef7a8af97b72d19c0bc3609

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:3101