Bug 1267932 - SELinux is preventing gpsd from 'name_connect' accesses on the tcp_socket port 8000.
SELinux is preventing gpsd from 'name_connect' accesses on the tcp_socket por...
Product: Fedora
Classification: Fedora
Component: selinux-policy (Show other bugs)
x86_64 Unspecified
medium Severity low
: ---
: ---
Assigned To: Miroslav Grepl
Fedora Extras Quality Assurance
Depends On:
  Show dependency treegraph
Reported: 2015-10-01 08:15 EDT by Frank Büttner
Modified: 2016-07-19 16:46 EDT (History)
8 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2016-07-19 16:46:15 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Frank Büttner 2015-10-01 08:15:03 EDT
Description of problem:
gpsd can't acces an remote gpsd via tcp
SELinux is preventing gpsd from 'name_connect' accesses on the tcp_socket port 8000.

*****  Plugin catchall (100. confidence) suggests   **************************

If sie denken, dass es gpsd standardmässig erlaubt sein sollte, name_connect Zugriff auf port 8000 tcp_socket zu erhalten.
Then sie sollten dies als Fehler melden.
Um diesen Zugriff zu erlauben, können Sie ein lokales Richtlinien-Modul erstellen.
zugriff jetzt erlauben, indem Sie die nachfolgenden Befehle ausführen:
# grep gpsd /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                system_u:system_r:gpsd_t:s0
Target Context                system_u:object_r:soundd_port_t:s0
Target Objects                port 8000 [ tcp_socket ]
Source                        gpsd
Source Path                   gpsd
Port                          8000
Host                          (removed)
Source RPM Packages           
Target RPM Packages           
Policy RPM                    selinux-policy-3.13.1-128.13.fc22.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Permissive
Host Name                     (removed)
Platform                      Linux (removed) 4.1.7-200.fc22.x86_64 #1 SMP Mon
                              Sep 14 20:19:24 UTC 2015 x86_64 x86_64
Alert Count                   1
First Seen                    2015-10-01 14:10:56 CEST
Last Seen                     2015-10-01 14:10:56 CEST
Local ID                      2de9dd85-ff4b-4134-9199-343dc23e4fa9

Raw Audit Messages
type=AVC msg=audit(1443701456.985:274): avc:  denied  { name_connect } for  pid=4858 comm="gpsd" dest=8000 scontext=system_u:system_r:gpsd_t:s0 tcontext=system_u:object_r:soundd_port_t:s0 tclass=tcp_socket permissive=0

Hash: gpsd,gpsd_t,soundd_port_t,tcp_socket,name_connect

Version-Release number of selected component:

Additional info:
reporter:       libreport-2.6.2
hashmarkername: setroubleshoot
kernel:         4.1.7-200.fc22.x86_64
type:           libreport
Comment 1 Miroslav Grepl 2015-10-13 03:36:56 EDT
did it happen by default or did you setup tcp/8000 port?
Comment 2 Frank Büttner 2015-10-13 04:22:31 EDT
No, only when using the function, that the gpsd receive the data remote.
See man:
TCP feed
           A URI with the prefix "tcp://", followed by a hostname, a colon,
           and a port number. The daemon will open a socket to the indicated
           address and port and read data packets from it, which will be
           interpreted as though they had been issued by a serial device.
           Example: tcp://data.aishub.net:4006.

I think it will also happens using UDP and all other remote services.
Comment 3 Miroslav Grepl 2015-10-19 02:21:11 EDT
Ok. You can allow it for now using

# grep gpsd /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp
Comment 4 Frank Büttner 2015-10-21 06:47:54 EDT
This will result in an inflexible rule:
module testpol 1.0;

require {
        type soundd_port_t;
        type unreserved_port_t;
        type gpsd_t;
        class tcp_socket name_connect;

#============= gpsd_t ==============
allow gpsd_t soundd_port_t:tcp_socket name_connect;

#!!!! This avc can be allowed using the boolean 'nis_enabled'
allow gpsd_t unreserved_port_t:tcp_socket name_connect;

Because when the port is another then all will happens again.
I think we need something like for sshd:
semanage port -a -t ssh_port_t -p tcp XXX
Where ports can be easily added.
Comment 5 Miroslav Grepl 2015-11-10 04:16:23 EST
It looks we will need to have a boolean for "TCP feed"?
Comment 6 Miroslav Lichvar 2015-11-10 04:18:15 EST
Sounds reasonable to me.
Comment 7 Fedora End Of Life 2016-07-19 16:46:15 EDT
Fedora 22 changed to end-of-life (EOL) status on 2016-07-19. Fedora 22 is
no longer maintained, which means that it will not receive any further
security or bug fix updates. As a result we are closing this bug.

If you can reproduce this bug against a currently maintained version of
Fedora please feel free to reopen this bug against that version. If you
are unable to reopen this bug, please file a new report against the
current release. If you experience problems, please add a comment to this

Thank you for reporting this bug and we are sorry it could not be fixed.

Note You need to log in before you can comment on or make changes to this bug.