Bug 1836574 - SELinux is preventing unbound-anchor from 'name_bind' accesses on the udp_socket Port 61000.
Summary: SELinux is preventing unbound-anchor from 'name_bind' accesses on the udp_soc...
Keywords:
Status: CLOSED DUPLICATE of bug 1935101
Alias: None
Product: Fedora
Classification: Fedora
Component: unbound
Version: 32
Hardware: x86_64
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Paul Wouters
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: abrt_hash:0ef81529ba2947576b96c2140bb...
: 1912214 (view as bug list)
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2020-05-17 00:11 UTC by Matthias Andree
Modified: 2021-04-28 13:06 UTC (History)
14 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2021-04-28 13:06:47 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)
SELinux Alert Details (6.31 KB, text/plain)
2020-10-20 21:28 UTC, Vojtech Sobota
no flags Details

Description Matthias Andree 2020-05-17 00:11:52 UTC
Description of problem:
this appeared after a wakeup from suspend (along with the tlp_lock issue reported separately) 
but is not believed to be related to the suspend/resume cycle but rather either to a dnf upgrade, or time-based.
SELinux is preventing unbound-anchor from 'name_bind' accesses on the udp_socket Port 61000.

*****  Plugin bind_ports (92.2 confidence) suggests   ************************

Sie möchten unbound-anchor erlauben, mit dem Netzwerk-Port $​​PORT_NUMBER zu verbinden
Then you need to modify the port type.
Do
# semanage port -a -t PORT_TYPE -p udp 61000
    wobei PORT_TYPE einer der folgenden Werte ist: afs3_callback_port_t, afs_bos_port_t, afs_fs_port_t, afs_ka_port_t, afs_pt_port_t, afs_vl_port_t, amanda_port_t, amavisd_recv_port_t, amavisd_send_port_t, amqp_port_t, aol_port_t, apc_port_t, apcupsd_port_t, appswitch_emp_port_t, asterisk_port_t, babel_port_t, bacula_port_t, bctp_port_t, bfd_control_port_t, bgp_port_t, boinc_client_port_t, boinc_port_t, brlp_port_t, certmaster_port_t, clamd_port_t, clockspeed_port_t, cluster_port_t, cma_port_t, cobbler_port_t, collectd_port_t, commplex_link_port_t, commplex_main_port_t, condor_port_t, conman_port_t, connlcli_port_t, conntrackd_port_t, couchdb_port_t, ctdb_port_t, cvs_port_t, cyphesis_port_t, cyrus_imapd_port_t, daap_port_t, dbskkd_port_t, dcc_port_t, dccm_port_t, dey_keyneg_port_t, dey_sapi_port_t, dhcpc_port_t, dict_port_t, distccd_port_t, dns_port_t, dnssec_port_t, dogtag_port_t, embrace_dp_c_port_t, ephemeral_port_t, epmd_port_t, fac_restore_port_t, firepower_port_t, flash_port_t, fmpro_internal_port_t, freeipmi_port_t, gatekeeper_port_t, gds_db_port_t, gear_port_t, geneve_port_t, giftd_port_t, git_port_t, glance_port_t, glance_registry_port_t, gluster_port_t, gpsd_port_t, hadoop_datanode_port_t, hadoop_namenode_port_t, hddtemp_port_t, howl_port_t, hplip_port_t, http_cache_port_t, i18n_input_port_t, ibm_dt_2_port_t, imaze_port_t, intermapper_port_t, interwise_port_t, ionixnetmon_port_t, ipp_port_t, ipsecnat_port_t, ircd_port_t, iscsi_port_t, isns_port_t, jabber_client_port_t, jabber_interserver_port_t, jabber_router_port_t, jacorb_port_t, jboss_debug_port_t, jboss_management_port_t, jboss_messaging_port_t, kerberos_port_t, keystone_port_t, kubernetes_port_t, l2tp_port_t, lirc_port_t, llmnr_port_t, lltng_port_t, lsm_plugin_port_t, luci_port_t, mail_port_t, mailbox_port_t, matahari_port_t, memcache_port_t, milter_port_t, mmcc_port_t, mongod_port_t, monopd_port_t, mountd_port_t, movaz_ssc_port_t, mpd_port_t, ms_streaming_port_t, msnp_port_t, mssql_port_t, munin_port_t, mxi_port_t, mysqld_port_t, mysqlmanagerd_port_t, mythtv_port_t, nessus_port_t, netport_port_t, netsupport_port_t, neutron_port_t, nfs_port_t, nmea_port_t, nodejs_debug_port_t, nsca_port_t, nsd_control_port_t, ntop_port_t, oa_system_port_t, ocsp_port_t, openflow_port_t, openhpid_port_t, openqa_port_t, openqa_websockets_port_t, openvpn_port_t, openvswitch_port_t, oracle_port_t, osapi_compute_port_t, ovsdb_port_t, pdps_port_t, pegasus_http_port_t, pegasus_https_port_t, pgpkeyserver_port_t, pingd_port_t, pki_kra_port_t, pki_ocsp_port_t, pki_ra_port_t, pki_tks_port_t, pki_tps_port_t, pktcable_cops_port_t, postfix_policyd_port_t, postgresql_port_t, postgrey_port_t, pptp_port_t, prelude_port_t, presence_port_t, preupgrade_port_t, priority_e_com_port_t, prosody_port_t, ptal_port_t, pulp_port_t, pulseaudio_port_t, puppet_port_t, pxe_port_t, pyzor_port_t, qpasa_agent_port_t, rabbitmq_port_t, radacct_port_t, radius_port_t, radsec_port_t, razor_port_t, redis_port_t, repository_port_t, ricci_modcluster_port_t, ricci_port_t, rkt_port_t, rtp_media_port_t, rtsclient_port_t, rtsp_port_t, salt_port_t, sap_port_t, saphostctrl_port_t, servistaitsm_port_t, sge_port_t, shellinaboxd_port_t, sieve_port_t, sip_port_t, sixxsconfig_port_t, smntubootstrap_port_t, soundd_port_t, speech_port_t, squid_port_t, ssdp_port_t, statsd_port_t, svn_port_t, swift_port_t, sype_transport_port_t, syslog_tls_port_t, tangd_port_t, tcs_port_t, tor_port_t, traceroute_port_t, tram_port_t, transproxy_port_t, trisoap_port_t, trivnet1_port_t, unreserved_port_t, ups_port_t, us_cli_port_t, varnishd_port_t, versa_tek_port_t, virt_migration_port_t, virt_port_t, virtual_places_port_t, vnc_port_t, wap_wsp_port_t, wccp_port_t, websm_port_t, whois_port_t, winshadow_port_t, wsdapi_port_t, wsicopy_port_t, xen_port_t, xfs_port_t, xinuexpansion3_port_t, xinuexpansion4_port_t, xodbc_connect_port_t, xserver_port_t, zabbix_agent_port_t, zabbix_port_t, zebra_port_t, zented_port_t, zookeeper_client_port_t, zookeeper_election_port_t, zookeeper_leader_port_t, zope_port_t.

*****  Plugin catchall_boolean (7.83 confidence) suggests   ******************

Sie folgendes tun möchten: allow nis to enabled
Then sie müssen SELinux darüber benachrichtigen, indem Sie die \tboolesche Variable »nis_enabled« aktivieren.

Do
setsebool -P nis_enabled 1

*****  Plugin catchall (1.41 confidence) suggests   **************************

Wenn Sie denken, dass es unbound-anchor standardmäßig erlaubt sein sollte, name_bind Zugriff auf Port 61000 udp_socket zu erhalten.
Then sie sollten dies als Fehler melden.
Um diesen Zugriff zu erlauben, können Sie ein lokales Richtlinien-Modul erstellen.
Do
zugriff jetzt erlauben, indem Sie die nachfolgenden Befehle ausführen:
# ausearch -c 'unbound-anchor' --raw | audit2allow -M my-unboundanchor
# semodule -X 300 -i my-unboundanchor.pp

Additional Information:
Source Context                system_u:system_r:named_t:s0
Target Context                system_u:object_r:port_t:s0
Target Objects                Port 61000 [ udp_socket ]
Source                        unbound-anchor
Source Path                   unbound-anchor
Port                          61000
Host                          (removed)
Source RPM Packages           
Target RPM Packages           
SELinux Policy RPM            selinux-policy-targeted-3.14.5-38.fc32.noarch
Local Policy RPM              selinux-policy-targeted-3.14.5-38.fc32.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 5.6.11-300.fc32.x86_64 #1 SMP Wed
                              May 6 19:12:19 UTC 2020 x86_64 x86_64
Alert Count                   1
First Seen                    2020-05-17 02:07:43 CEST
Last Seen                     2020-05-17 02:07:43 CEST
Local ID                      25691e46-bdea-4d79-9ee6-30a1fe8f65e8

Raw Audit Messages
type=AVC msg=audit(1589674063.466:566): avc:  denied  { name_bind } for  pid=81876 comm="unbound-anchor" src=61000 scontext=system_u:system_r:named_t:s0 tcontext=system_u:object_r:port_t:s0 tclass=udp_socket permissive=0


Hash: unbound-anchor,named_t,port_t,udp_socket,name_bind

Version-Release number of selected component:
selinux-policy-targeted-3.14.5-38.fc32.noarch

Additional info:
component:      selinux-policy
reporter:       libreport-2.12.0
hashmarkername: setroubleshoot
kernel:         5.6.11-300.fc32.x86_64
type:           libreport

Potential duplicate: bug 1669731

Comment 1 Zdenek Pytela 2020-05-19 11:11:53 UTC
Matthias,

Please update unbound to unbound-1.10.0-3.fc32 if you have older version and try to reproduce again.

Comment 2 Vojtech Sobota 2020-10-20 21:28:07 UTC
Created attachment 1723007 [details]
SELinux Alert Details

Today it happened on my system after resuming from suspend with unbound 1.10.1-1.fc32.

Comment 3 crf 2020-11-18 03:19:27 UTC
I get this bug in fedora 33. I don't have unbound installed. I have unbound-libs installed. unbound-libs-1.10.1-4.fc33
It did happen after a resume from suspend.

Comment 4 Zdenek Pytela 2020-12-01 18:06:59 UTC
Switching component, see also RHEL bz#1830625

Comment 5 Zdenek Pytela 2021-01-05 10:39:31 UTC
*** Bug 1912214 has been marked as a duplicate of this bug. ***

Comment 6 Fedora Admin user for bugzilla script actions 2021-04-26 12:41:47 UTC
This package has changed maintainer in Fedora. Reassigning to the new maintainer of this component.

Comment 7 aegorenk 2021-04-28 13:06:47 UTC

*** This bug has been marked as a duplicate of bug 1935101 ***


Note You need to log in before you can comment on or make changes to this bug.