Bug 1443473 - SELinux prevents keepalived to connect to arbitrary ports
Summary: SELinux prevents keepalived to connect to arbitrary ports
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: selinux-policy
Version: 7.3
Hardware: All
OS: Linux
unspecified
unspecified
Target Milestone: rc
: ---
Assignee: Lukas Vrabec
QA Contact: Milos Malik
Mirek Jahoda
URL:
Whiteboard:
Keywords:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2017-04-19 10:09 UTC by Marko Myllynen
Modified: 2018-11-12 14:10 UTC (History)
10 users (show)

(edit)
_selinux-policy_ now contains five additional *SELinux* booleans

This update of the _selinux-policy_ packages introduces the following SELinux booleans:

 * `keepalived_connect_any` - allows the *keepalived* service to connect to arbitrary ports.

 * `tomcat_use_execmem` - allows the *Tomcat* server to make its stack executable.

 * `tomcat_can_network_connect_db` - allows *Tomcat* to connect to the *PosgtreSQL* port.

 * `redis_enable_notify` - allows the *redis-sentinel* service to run notification scripts.

 * `zabbix_run_sudo` - allows the *zabbix_agent* service to run the *sudo* utility.
Clone Of:
(edit)
Last Closed: 2018-10-30 10:00:04 UTC


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2018:3111 None None None 2018-10-30 10:01 UTC
Red Hat Knowledge Base (Article) 3685231 None None None 2018-11-12 14:10 UTC

Description Marko Myllynen 2017-04-19 10:09:29 UTC
Description of problem:
With latest RHEL 7 / selinux-policy-3.13.1-102.el7_3.16 when configuring a keepalived virtual server on port 9090 (real servers elsewhere) we see:

type=AVC msg=audit(1492581128.143:69): avc:  denied  { name_connect } for pid=1495 comm="keepalived" dest=9090 scontext=system_u:system_r:keepalived_t:s0 tcontext=system_u:object_r:websm_port_t:s0 tclass=tcp_socket

It seems that there's no machinery to allow keepalived to connect to arbitrary ports (like we have with httpd/http_port_t) which would be needed as keepalived can be used with any ports (so merely adding 9090 wouldn't be that helpful).

Please make it possible to use any needed port with keepalived under SELinux.

Thanks.

Comment 9 errata-xmlrpc 2018-10-30 10:00:04 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:3111


Note You need to log in before you can comment on or make changes to this bug.