Amavisd should be able to connect to the razor_port by default If you believe that amavi should be allowed name_connect access on the port 2703 tcp_socket by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c '/usr/sbin/amavi' --raw | audit2allow -M my-usrsbinamavi # semodule -X 300 -i my-usrsbinamavi.pp Additional Information: Source Context system_u:system_r:init_t:s0 Target Context system_u:object_r:razor_port_t:s0 Target Objects port 2703 [ tcp_socket ] Source /usr/sbin/amavi Source Path /usr/sbin/amavi Port 2703 Source RPM Packages Target RPM Packages Policy RPM selinux-policy-3.13.1-260.1.fc26.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Permissive Alert Count 79 First Seen 2017-07-24 16:34:09 CDT Last Seen 2017-07-24 18:53:17 CDT Local ID b8b2ab7c-e7e8-4568-ab68-4229233bb359 Raw Audit Messages type=AVC msg=audit(1500940397.120:774): avc: denied { name_connect } for pid=4713 comm="/usr/sbin/amavi" dest=2703 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:razor_port_t:s0 tclass=tcp_socket permissive=1 Hash: /usr/sbin/amavi,init_t,razor_port_t,tcp_socket,name_connect
There were a host of other SELinux denials for Amavisd. Though the maintainer seems to have found a workaround: PrivateDevices=true was causing problems with SELinux transitions http://pkgs.fedoraproject.org/cgit/rpms/amavisd-new.git/commit/?h=f26&id=c11edb06af512f56bbc54929f5627616652186db I'll close for now, resolved by: https://bodhi.fedoraproject.org/updates/FEDORA-2017-7705a5aa55