Red Hat Bugzilla – Bug 167810
SELinux blocks Privoxy Connections to Nonstandard Ports
Last modified: 2007-11-30 17:11:13 EST
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.7.10) Gecko/20050720 Fedora/1.0.6-1.1.fc4 Firefox/1.0.6
Description of problem:
With the targeted SELinux policy enabled and the browser configured to use Privoxy as its HTTP proxy, accessing a Web server which runs on a nonstandard port like 9005 will fail with a "503 - Connect Failed" error from Privoxy.
Version-Release number of selected component (if applicable):
Steps to Reproduce:
1. Enabled the targeted SELinux policy.
2. Start Privoxy and configure your browser to use localhost:8118 as its HTTP proxy.
3. Try to access a Web server which does not run on port 80 or 443, like http://sharenet.redhat.de:9800/
4. Disable SELinux protection for Privoxy, restart Privoxy, and you can access the Web server
Actual Results: 503 - Connect Failed
Expected Results: Privoxy should be able to connect to the server.
While ports other than 80 and 443 are unusual for HTTP, they are commonly used by Web developers, and for non-public Web sites. They should not be blocked by the SELinux policy.
I think you are pointing out two problems with this bug report.
The easiest to fix is allowing privoxy/httpd to connect to remote ports.
setsebool -P httpd_can_network_connect=1
Allows http to connect to any port.
Now if you wanted to run a webserver that listens on a different port, the only
solution in FC4/RHEL4 is to customize policy. We are changing this in FC5/RHEL5
allowing administratiors to label addtional ports. So you could specify a
specific port as an httpd_port_t and allow httpd to listen on it.
Activating httpd_can_network_connect does not work with privoxy-3.0.3-7 and
selinux-policy-targeted-1.27.1-2.14 - I still get "503 - Connect Failed" when I
try to connect to a server running on port 9800. Note that this server runs on a
different machine. This ticket is not about how to get that server running, only
about accessing it via Privoxy.
I modified the policy and added "allow privoxy_t port_t:tcp_socket
name_connect;" in local.te - that worked.
For the record, the following command can be used with FC5 to allow Privoxy to
connect to port 9800:
semanage port -a -t http_port_t -p tcp 9800