Description of problem: Currently rabbitmq uses port 35672 for cluster communications which is in the ephemeral range. Ephemeral ports are the ports kernel assigns to application if it doesn't specify which port to open. So there is a small chance that this application being started before RabbitMQ itself could grab this port. Unfortunately we've just seen this in the wild. Via BZ https://bugzilla.redhat.com/show_bug.cgi?id=1357522 we would like to move rabbit's cluster port outside of this range, to 25672. This is all ready in https://review.openstack.org/345851, but I'd like to make sure that we explicitely allow this port in the selinux policy. Could we add this port to the allowed ports to bind and connect to?
I think we are actually already good to go: rabbitmq_port_t tcp 25672 corenet_tcp_bind_rabbitmq_port(rabbitmq_t) corenet_tcp_connect_rabbitmq_port(rabbitmq_t)
[root@localhost ~]# semanage port -l | grep rabbit rabbitmq_port_t tcp 25672 0.7.13 has this