Bug 1443473 – SELinux prevents keepalived to connect to arbitrary ports

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 1443473 - SELinux prevents keepalived to connect to arbitrary ports

Summary:	SELinux prevents keepalived to connect to arbitrary ports

Status:	CLOSED ERRATA

Aliases:	None

Product:	Red Hat Enterprise Linux 7
Classification:	Red Hat
Component:	selinux-policy (Show other bugs)
Sub Component:
Version:	7.3
Hardware:	All Linux

Priority	unspecified Severity unspecified
Target Milestone:	rc
Target Release:	---
Assigned To:	Lukas Vrabec
QA Contact:	Milos Malik
Docs Contact:	Mirek Jahoda

URL:
Whiteboard:
Keywords:

Depends On:
Blocks:
	Show dependency tree / graph

Reported:	2017-04-19 06:09 EDT by Marko Myllynen
Modified:	2018-10-30 06:01 EDT (History)
CC List:	9 users (show)

See Also:
Fixed In Version:
Doc Type:	Enhancement
Doc Text:	_selinux-policy_ now contains five additional SELinux booleans This update of the _selinux-policy_ packages introduces the following SELinux booleans: * `keepalived_connect_any` - allows the keepalived service to connect to arbitrary ports. * `tomcat_use_execmem` - allows the Tomcat server to make its stack executable. * `tomcat_can_network_connect_db` - allows Tomcat to connect to the PosgtreSQL port. * `redis_enable_notify` - allows the redis-sentinel service to run notification scripts. * `zabbix_run_sudo` - allows the zabbix_agent service to run the sudo utility.
Story Points:	---
Clone Of:
Environment:
Last Closed:	2018-10-30 06:00:04 EDT
Type:	Bug
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHBA-2018:3111	None	None	None	2018-10-30 06:01 EDT

Groups: None (edit)

Description Marko Myllynen 2017-04-19 06:09:29 EDT

Description of problem:
With latest RHEL 7 / selinux-policy-3.13.1-102.el7_3.16 when configuring a keepalived virtual server on port 9090 (real servers elsewhere) we see:

type=AVC msg=audit(1492581128.143:69): avc:  denied  { name_connect } for pid=1495 comm="keepalived" dest=9090 scontext=system_u:system_r:keepalived_t:s0 tcontext=system_u:object_r:websm_port_t:s0 tclass=tcp_socket

It seems that there's no machinery to allow keepalived to connect to arbitrary ports (like we have with httpd/http_port_t) which would be needed as keepalived can be used with any ports (so merely adding 9090 wouldn't be that helpful).

Please make it possible to use any needed port with keepalived under SELinux.

Thanks.

Comment 9 errata-xmlrpc 2018-10-30 06:00:04 EDT

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:3111

Note You need to log in before you can comment on or make changes to this bug.