When using pypolicyd-spf with Postfix, pypolicyd-spf needs to open ports to function.  I often get SELinux denials like the following, with the port numbers changing if pypolicyd-spf happens to hit a port that is labeled by some other policy.  While the suggestion is enabling the 'nis_enabled' boolean, I am hoping that the SELinux team can come up with a better solution like a boolean that's perhaps narrowed to pypolicyd-spf.  Thanks.



SELinux is preventing /usr/bin/python2.7 from name_bind access on the tcp_socket port 22874.

*****  Plugin bind_ports (92.2 confidence) suggests   ************************

If you want to allow /usr/bin/python2.7 to bind to network port 22874
Then you need to modify the port type.
Do
# semanage port -a -t PORT_TYPE -p tcp 22874
    where PORT_TYPE is one of the following: amavisd_send_port_t, smtp_port_t, spamd_port_t.

*****  Plugin catchall_boolean (7.83 confidence) suggests   ******************

If you want to allow system to run with NIS
Then you must tell SELinux about this by enabling the 'nis_enabled' boolean.

Do
setsebool -P nis_enabled 1

*****  Plugin catchall (1.41 confidence) suggests   **************************

If you believe that python2.7 should be allowed name_bind access on the port 22874 tcp_socket by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep policyd-spf /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                system_u:system_r:postfix_master_t:s0
Target Context                system_u:object_r:unreserved_port_t:s0
Target Objects                port 22874 [ tcp_socket ]
Source                        policyd-spf
Source Path                   /usr/bin/python2.7
Port                          22874
Host                          example.com
Source RPM Packages           python-2.7.10-8.fc22.x86_64
Target RPM Packages           
Policy RPM                    selinux-policy-3.13.1-128.21.fc22.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     example.com
Platform                      Linux example.com 4.2.6-201.fc22.x86_64
                              #1 SMP Tue Nov 24 18:42:39 UTC 2015 x86_64 x86_64
Alert Count                   2
First Seen                    2015-12-01 17:02:59 CST
Last Seen                     2015-12-01 17:02:59 CST
Local ID                      95335df4-f17f-4adf-88fb-7dd8f8c12001

Raw Audit Messages
type=AVC msg=audit(1449010979.552:1878): avc:  denied  { name_bind } for  pid=5976 comm="policyd-spf" src=22874 scontext=system_u:system_r:postfix_master_t:s0 tcontext=system_u:object_r:unreserved_port_t:s0 tclass=tcp_socket permissive=0


type=SYSCALL msg=audit(1449010979.552:1878): arch=x86_64 syscall=bind success=no exit=EACCES a0=4 a1=7ffeaf74fcf0 a2=10 a3=1999999999999999 items=0 ppid=5975 pid=5976 auid=4294967295 uid=99 gid=99 euid=99 suid=99 fsuid=99 egid=99 sgid=99 fsgid=99 tty=(none) ses=4294967295 comm=policyd-spf exe=/usr/bin/python2.7 subj=system_u:system_r:postfix_master_t:s0 key=(null)

Hash: policyd-spf,postfix_master_t,unreserved_port_t,tcp_socket,name_bind