Bug 167810 - SELinux blocks Privoxy Connections to Nonstandard Ports
Summary: SELinux blocks Privoxy Connections to Nonstandard Ports
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy-targeted
Version: 4
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Karsten Hopp
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2005-09-08 13:18 UTC by Carsten Clasohm
Modified: 2007-11-30 22:11 UTC (History)
0 users

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2005-11-30 15:04:41 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Carsten Clasohm 2005-09-08 13:18:38 UTC
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.7.10) Gecko/20050720 Fedora/1.0.6-1.1.fc4 Firefox/1.0.6

Description of problem:
With the targeted SELinux policy enabled and the browser configured to use Privoxy as its HTTP proxy, accessing a Web server which runs on a nonstandard port like 9005 will fail with a "503 - Connect Failed" error from Privoxy.


Version-Release number of selected component (if applicable):
selinux-policy-targeted-1.25.4-10

How reproducible:
Always

Steps to Reproduce:
1. Enabled the targeted SELinux policy.

2. Start Privoxy and configure your browser to use localhost:8118 as its HTTP proxy.

3. Try to access a Web server which does not run on port 80 or 443, like http://sharenet.redhat.de:9800/

4. Disable SELinux protection for Privoxy, restart Privoxy, and you can access the Web server


Actual Results:  503 - Connect Failed

Expected Results:  Privoxy should be able to connect to the server.

Additional info:

While ports other than 80 and 443 are unusual for HTTP, they are commonly used by Web developers, and for non-public Web sites. They should not be blocked by the SELinux policy.

Comment 1 Daniel Walsh 2005-11-30 15:04:41 UTC
I think you are pointing out two problems with this bug report.

The easiest to fix is allowing privoxy/httpd to connect to remote ports.

setsebool -P httpd_can_network_connect=1

Allows http to connect to any port.

Now if you wanted to run a webserver that listens on a different port, the only
solution in FC4/RHEL4 is to customize policy.  We are changing this in FC5/RHEL5
allowing administratiors to label addtional ports.  So you could specify a
specific port as an httpd_port_t and allow httpd to listen on it.

Comment 2 Carsten Clasohm 2005-12-05 13:29:12 UTC
Activating httpd_can_network_connect does not work with privoxy-3.0.3-7 and
selinux-policy-targeted-1.27.1-2.14 - I still get "503 - Connect Failed" when I
try to connect to a server running on port 9800. Note that this server runs on a
different machine. This ticket is not about how to get that server running, only
about accessing it via Privoxy.

I modified the policy and added "allow privoxy_t port_t:tcp_socket
name_connect;" in local.te - that worked.


Comment 3 Carsten Clasohm 2006-05-09 08:41:39 UTC
For the record, the following command can be used with FC5 to allow Privoxy to
connect to port 9800:

semanage port -a -t http_port_t -p tcp 9800



Note You need to log in before you can comment on or make changes to this bug.