Bug 1563792 - SELinux is preventing rpcbind from 'name_bind' accesses on the udp_socket port 64948.
Summary: SELinux is preventing rpcbind from 'name_bind' accesses on the udp_socket por...
Keywords:
Status: CLOSED DUPLICATE of bug 1559324
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 28
Hardware: x86_64
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Lukas Vrabec
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: abrt_hash:353bb6bd6a8e04006146647683a...
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2018-04-04 17:37 UTC by Juan Orti
Modified: 2018-09-19 17:44 UTC (History)
7 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2018-09-19 17:44:55 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Juan Orti 2018-04-04 17:37:47 UTC
Description of problem:
SELinux is preventing rpcbind from 'name_bind' accesses on the udp_socket port 64948.

*****  Plugin catchall_boolean (89.3 confidence) suggests   ******************

Si quiere allow system to run with NIS
Then debe informar a SELinux de ello activando el indicador 'nis_enabled'.
Puede leer la página de manual 'rpcbind_selinux' para más detalles.
Do
setsebool -P nis_enabled 1

*****  Plugin catchall (11.6 confidence) suggests   **************************

Si cree que de manera predeterminada se debería permitir a rpcbind el acceso name_bind sobre  port 64948 udp_socket.     
Then debería reportar esto como un error.
Puede generar un módulo de política local para permitir este acceso.
Do
permita el acceso temporalmente ejecutando:
# ausearch -c 'rpcbind' --raw | audit2allow -M mi-rpcbind
# semodule -X 300 -i mi-rpcbind.pp

Additional Information:
Source Context                system_u:system_r:rpcbind_t:s0
Target Context                system_u:object_r:unreserved_port_t:s0
Target Objects                port 64948 [ udp_socket ]
Source                        rpcbind
Source Path                   rpcbind
Port                          64948
Host                          (removed)
Source RPM Packages           
Target RPM Packages           
Policy RPM                    selinux-policy-3.14.1-19.fc28.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 4.16.0-0.rc7.git0.1.fc28.x86_64 #1
                              SMP Mon Mar 26 15:01:02 UTC 2018 x86_64 x86_64
Alert Count                   1
First Seen                    2018-04-04 17:38:11 CEST
Last Seen                     2018-04-04 17:38:11 CEST
Local ID                      9f82ccf7-204c-4992-b226-94d36bcad3be

Raw Audit Messages
type=AVC msg=audit(1522856291.714:218): avc:  denied  { name_bind } for  pid=1475 comm="rpcbind" src=64948 scontext=system_u:system_r:rpcbind_t:s0 tcontext=system_u:object_r:unreserved_port_t:s0 tclass=udp_socket permissive=0


Hash: rpcbind,rpcbind_t,unreserved_port_t,udp_socket,name_bind

Version-Release number of selected component:
selinux-policy-3.14.1-19.fc28.noarch

Additional info:
component:      selinux-policy
reporter:       libreport-2.9.4
hashmarkername: setroubleshoot
kernel:         4.16.0-0.rc7.git0.1.fc28.x86_64
type:           libreport

Comment 1 Juan Orti 2018-04-18 06:57:58 UTC
I'm getting more AVCs in other machine when starting RPC bind:

abr 18 08:29:46 helio systemd[1]: Starting RPC Bind...
abr 18 08:29:46 helio audit[2134]: AVC avc:  denied  { name_bind } for  pid=2134 comm="rpcbind" src=61817 scontext=system_u:system_r:rpcbind_t:s0 tcontext=system_u:object_r:unreserved_port_t:s0 tclass=udp_socket permissive=0
abr 18 08:29:46 helio rpcbind[2134]: rpcbind: svc_tli_create: could not bind to anonymous port
abr 18 08:29:46 helio audit[2134]: AVC avc:  denied  { name_bind } for  pid=2134 comm="rpcbind" src=63658 scontext=system_u:system_r:rpcbind_t:s0 tcontext=system_u:object_r:unreserved_port_t:s0 tclass=udp_socket permissive=0
abr 18 08:29:46 helio systemd[1]: Started RPC Bind.
abr 18 08:29:46 helio audit[1]: SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=rpcbind comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'


Version:
selinux-policy-3.14.1-21.fc28.noarch

Comment 2 Orion Poplawski 2018-09-19 17:44:55 UTC

*** This bug has been marked as a duplicate of bug 1559324 ***


Note You need to log in before you can comment on or make changes to this bug.