Bug 1559324 - rpcbind: svc_tli_create: could not bind to anonymous port (due to SELinux policy)
Summary: rpcbind: svc_tli_create: could not bind to anonymous port (due to SELinux pol...
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 29
Hardware: Unspecified
OS: Unspecified
low
low
Target Milestone: ---
Assignee: Lukas Vrabec
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
: 1563792 (view as bug list)
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2018-03-22 09:57 UTC by Martin Pitt
Modified: 2019-05-15 21:16 UTC (History)
6 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2019-05-15 21:16:17 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)

Description Martin Pitt 2018-03-22 09:57:45 UTC
Description of problem: In current Fedora 28, rpcbind.service can't bind its port as the SELinux policy denies it.


Version-Release number of selected component (if applicable):

rpcbind-0.2.4-10.rc3.fc28.x86_64
selinux-policy-targeted-3.14.1-14.fc28.noarch
selinux-policy-3.14.1-14.fc28.noarch


How reproducible: Always


Steps to Reproduce:
1. systemctl start rpcbind
2. systemctl status rpcbind

Actual results:

rpcbind.service starts, but logs an error:

rpcbind[1446]: rpcbind: svc_tli_create: could not bind to anonymous port

During that, this SELinux denial gets logged:

audit: type=1400 audit(1521712389.010:254): avc:  denied  { name_bind } for  pid=1446 comm="rpcbind" src=63890 scontext=system_u:system_r:rpcbind_t:s0 tcontext=system_u:object_r:unreserved_port_t:s0 tclass=udp_socket permissive=0


Expected results: Service starts cleanly without any SELinux denials

If this restriction is intentioal, rpcbind should be configured appropriately; otherwise please reassign this to selinux-policy to get it allowed.

Comment 2 Lukas Vrabec 2018-03-24 19:19:31 UTC
Steve, 

Does rpcbind binding on random port or port 63890 is somewhere defined? 

Thanks,
Lukas.

Comment 3 Steve Dickson 2018-04-02 15:05:33 UTC
(In reply to Lukas Vrabec from comment #2)
> Steve, 
> 
> Does rpcbind binding on random port or port 63890 is somewhere defined? 
Sorry for the delay response... I've been traveling 

Yes, rpcbind opens a random listening port for its
remote calls support, where rpcbind makes an RPC call
for a remote client. It is an ancient interface that was
that Netapp (and I believe SUN) remove it years ago.

There has been some recent discussion about adding 
a command line argument to turn it off... 

So opening that port is causing the SELinux denials?

Comment 4 Orion Poplawski 2018-09-19 17:44:55 UTC
*** Bug 1563792 has been marked as a duplicate of this bug. ***

Comment 5 Lukas Vrabec 2019-04-29 12:27:30 UTC
Quite late, but yes, openening random ports causing SELinux denials.

Comment 6 Ben Cotton 2019-05-02 19:22:17 UTC
This message is a reminder that Fedora 28 is nearing its end of life.
On 2019-May-28 Fedora will stop maintaining and issuing updates for
Fedora 28. It is Fedora's policy to close all bug reports from releases
that are no longer maintained. At that time this bug will be closed as
EOL if it remains open with a Fedora 'version' of '28'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version' 
to a later Fedora version.

Thank you for reporting this issue and we are sorry that we were not 
able to fix it before Fedora 28 is end of life. If you would still like 
to see this bug fixed and are able to reproduce it against a later version 
of Fedora, you are encouraged  change the 'version' to a later Fedora 
version prior this bug is closed as described in the policy above.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events. Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.

Comment 7 Ben Cotton 2019-05-02 19:35:17 UTC
This message is a reminder that Fedora 28 is nearing its end of life.
On 2019-May-28 Fedora will stop maintaining and issuing updates for
Fedora 28. It is Fedora's policy to close all bug reports from releases
that are no longer maintained. At that time this bug will be closed as
EOL if it remains open with a Fedora 'version' of '28'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version' 
to a later Fedora version.

Thank you for reporting this issue and we are sorry that we were not 
able to fix it before Fedora 28 is end of life. If you would still like 
to see this bug fixed and are able to reproduce it against a later version 
of Fedora, you are encouraged  change the 'version' to a later Fedora 
version prior this bug is closed as described in the policy above.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events. Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.

Comment 8 Martin Pitt 2019-05-03 07:11:43 UTC
This works on Fedora 29 and 30.

Comment 9 Martin Pitt 2019-05-03 09:35:12 UTC
Sorry, it still fails on Fedora 30, recent example: https://209.132.184.41:8493/logs/pull-11733-20190503-090101-b85fe2a8-container-kubernetes/log.html#18

Comment 10 Martin Pitt 2019-05-03 09:39:06 UTC
Correction, that log is Fedora 29.

Comment 11 Lukas Vrabec 2019-05-15 12:19:32 UTC
Hi Steve, 

The main issue here is that rpcbind choosed port 63890 and this port is labeled as unreserved_port_t. rpcbind cannot bind on unreserved_port_t. 

I read in comment#3 that this is some leftover from old functionality, does it make sense to support it? 

THanks,
Lukas.

Comment 12 Steve Dickson 2019-05-15 21:16:17 UTC
(In reply to Lukas Vrabec from comment #11)
> Hi Steve, 
> 
> The main issue here is that rpcbind choosed port 63890 and this port is
> labeled as unreserved_port_t. rpcbind cannot bind on unreserved_port_t. 
> 
> I read in comment#3 that this is some leftover from old functionality, does
> it make sense to support it? 
> 
> THanks,
> Lukas.

This problem was fixed in Fedora 29 due to this commit
commit 2e9c289246c647e25649914bdb0d9400c66f486e (tag: pcbind-0_2_5-rc4)
Author: Steve Dickson <steved>
Date:   Wed Aug 15 10:22:36 2018 -0400

    rpcbind: Disable remote calls by default
    
    Added a new configuration flag --enable-rmtcalls
    which will be needed to enable the remote call
    functionality.
    
    This also stops rpcbind from opening up random
    listening ports.
    
    Signed-off-by: Steve Dickson <steved>

So an older rpcbind must being used.


Note You need to log in before you can comment on or make changes to this bug.