Description of problem: SELinux is preventing iptables from using the 'noatsecure' accesses on a process. ***** Plugin catchall (100. confidence) suggests ************************** If you believe that iptables should be allowed noatsecure access on processes labeled iptables_t by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # grep iptables /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context system_u:system_r:firewalld_t:s0 Target Context system_u:system_r:iptables_t:s0 Target Objects Unknown [ process ] Source iptables Source Path iptables Port <Unknown> Host (removed) Source RPM Packages Target RPM Packages Policy RPM selinux-policy-3.13.1-128.18.fc22.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 4.2.3-200.fc22.x86_64 #1 SMP Thu Oct 8 03:23:55 UTC 2015 x86_64 x86_64 Alert Count 183 First Seen 2015-10-22 11:55:03 BST Last Seen 2015-10-23 11:02:09 BST Local ID 23ceb695-89a1-41f1-a8d7-879323d93a5f Raw Audit Messages type=AVC msg=audit(1445594529.891:2607): avc: denied { noatsecure } for pid=17692 comm="ip6tables" scontext=system_u:system_r:firewalld_t:s0 tcontext=system_u:system_r:iptables_t:s0 tclass=process permissive=0 Hash: iptables,firewalld_t,iptables_t,process,noatsecure Version-Release number of selected component: selinux-policy-3.13.1-128.18.fc22.noarch Additional info: reporter: libreport-2.6.3 hashmarkername: setroubleshoot kernel: 4.2.3-200.fc22.x86_64 type: libreport
Did you disable dontaudit rules? audit2allow -i /tmp/t #============= firewalld_t ============== #!!!! This avc has a dontaudit rule in the current policy allow firewalld_t iptables_t:process noatsecure;
I did, but I was thinking it should have been enabled by default if it was a legitimate process considering iptables is a core part of the distribution.
(In reply to Adam Nicholson from comment #2) > I did, but I was thinking it should have been enabled by default if it was a > legitimate process considering iptables is a core part of the distribution. Not sure if I understand correctly. Do you want to see it by default?