Bug 1443473 - SELinux prevents keepalived to connect to arbitrary ports
Summary: SELinux prevents keepalived to connect to arbitrary ports
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: selinux-policy
Version: 7.3
Hardware: All
OS: Linux
Target Milestone: rc
: ---
Assignee: Lukas Vrabec
QA Contact: Milos Malik
Mirek Jahoda
Depends On:
TreeView+ depends on / blocked
Reported: 2017-04-19 10:09 UTC by Marko Myllynen
Modified: 2018-11-12 14:10 UTC (History)
10 users (show)

Fixed In Version:
Doc Type: Enhancement
Doc Text:
_selinux-policy_ now contains five additional *SELinux* booleans This update of the _selinux-policy_ packages introduces the following SELinux booleans: * `keepalived_connect_any` - allows the *keepalived* service to connect to arbitrary ports. * `tomcat_use_execmem` - allows the *Tomcat* server to make its stack executable. * `tomcat_can_network_connect_db` - allows *Tomcat* to connect to the *PosgtreSQL* port. * `redis_enable_notify` - allows the *redis-sentinel* service to run notification scripts. * `zabbix_run_sudo` - allows the *zabbix_agent* service to run the *sudo* utility.
Clone Of:
Last Closed: 2018-10-30 10:00:04 UTC
Target Upstream Version:

Attachments (Terms of Use)

System ID Private Priority Status Summary Last Updated
Red Hat Knowledge Base (Article) 3685231 0 None None None 2018-11-12 14:10:36 UTC
Red Hat Product Errata RHBA-2018:3111 0 None None None 2018-10-30 10:01:02 UTC

Description Marko Myllynen 2017-04-19 10:09:29 UTC
Description of problem:
With latest RHEL 7 / selinux-policy-3.13.1-102.el7_3.16 when configuring a keepalived virtual server on port 9090 (real servers elsewhere) we see:

type=AVC msg=audit(1492581128.143:69): avc:  denied  { name_connect } for pid=1495 comm="keepalived" dest=9090 scontext=system_u:system_r:keepalived_t:s0 tcontext=system_u:object_r:websm_port_t:s0 tclass=tcp_socket

It seems that there's no machinery to allow keepalived to connect to arbitrary ports (like we have with httpd/http_port_t) which would be needed as keepalived can be used with any ports (so merely adding 9090 wouldn't be that helpful).

Please make it possible to use any needed port with keepalived under SELinux.


Comment 9 errata-xmlrpc 2018-10-30 10:00:04 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Note You need to log in before you can comment on or make changes to this bug.