Bug 2133221
| Summary: | SELINUX policy denies net-snmp's bind to TLS/DTLS port 10161 | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 9 | Reporter: | Graham Leggett <minfrin> |
| Component: | selinux-policy | Assignee: | Nikola Knazekova <nknazeko> |
| Status: | CLOSED ERRATA | QA Contact: | Milos Malik <mmalik> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 9.2 | CC: | lvrabec, mmalik, zpytela |
| Target Milestone: | rc | Keywords: | Triaged |
| Target Release: | --- | Flags: | pm-rhel:
mirror+
|
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | selinux-policy-34.1.44-1.el9 | Doc Type: | Bug Fix |
| Doc Text: |
Cause: Simple Network Management Protocol over TLS and DTLS uses 10161-10162 ports.
Consequence: SELinux denied snmpd name connect to unreserved_port_t
Fix: Label ports 10161-10162 tcp/udp with snmp and allow name_connect to these ports
Result: No denials
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2023-05-09 08:16:52 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Hi Graham, have you tried to use semanage command to open that port for net-snmp? By default, net-snmp is allowed to bind to ports 161-162 (udp) and 199, 1161, 161-162 (tcp). To add new port use semanage command (as root/sudo user) as follows: # semanage port -a -t snmp_port_t -p udp 10161 Let me know, if it resolves your issue. Josef Ports 10161 and 10162 are IANA assigned ports for secure SNMP. https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=53&page=4 Manually fiddling with semanage should not be necessary, and secure operation should be default behaviour. Please fix this. Caught in enforcing mode:
----
type=PROCTITLE msg=audit(10/11/2022 07:45:56.892:319) : proctitle=/usr/sbin/snmpd -LS0-6d -f
type=SOCKADDR msg=audit(10/11/2022 07:45:56.892:319) : saddr={ saddr_fam=inet laddr=127.0.0.1 lport=10161 }
type=SYSCALL msg=audit(10/11/2022 07:45:56.892:319) : arch=x86_64 syscall=bind success=no exit=EACCES(Permission denied) a0=0x7 a1=0x7ffd9a31f8d0 a2=0x10 a3=0x7ffd9a31f78c items=0 ppid=1 pid=15568 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=snmpd exe=/usr/sbin/snmpd subj=system_u:system_r:snmpd_t:s0 key=(null)
type=AVC msg=audit(10/11/2022 07:45:56.892:319) : avc: denied { name_bind } for pid=15568 comm=snmpd src=10161 scontext=system_u:system_r:snmpd_t:s0 tcontext=system_u:object_r:unreserved_port_t:s0 tclass=udp_socket permissive=0
----
type=PROCTITLE msg=audit(10/11/2022 07:45:56.892:320) : proctitle=/usr/sbin/snmpd -LS0-6d -f
type=SOCKADDR msg=audit(10/11/2022 07:45:56.892:320) : saddr={ saddr_fam=inet6 laddr=::1 lport=10161 }
type=SYSCALL msg=audit(10/11/2022 07:45:56.892:320) : arch=x86_64 syscall=bind success=no exit=EACCES(Permission denied) a0=0x7 a1=0x7ffd9a31f8e0 a2=0x1c a3=0x7ffd9a31f7f4 items=0 ppid=1 pid=15568 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=snmpd exe=/usr/sbin/snmpd subj=system_u:system_r:snmpd_t:s0 key=(null)
type=AVC msg=audit(10/11/2022 07:45:56.892:320) : avc: denied { name_bind } for pid=15568 comm=snmpd src=10161 scontext=system_u:system_r:snmpd_t:s0 tcontext=system_u:object_r:unreserved_port_t:s0 tclass=udp_socket permissive=0
----
# rpm -qa selinux\* net-snmp\* | sort
net-snmp-5.9.1-7.el9_0.1.x86_64
net-snmp-agent-libs-5.9.1-7.el9_0.1.x86_64
net-snmp-libs-5.9.1-7.el9_0.1.x86_64
selinux-policy-34.1.43-1.el9.noarch
selinux-policy-targeted-34.1.43-1.el9.noarch
# grep agentaddress /etc/snmp/snmpd.conf
agentaddress localhost:10161,localhost:[::]:10161
#
Caught in permissive mode:
----
type=PROCTITLE msg=audit(10/11/2022 07:49:39.168:323) : proctitle=/usr/sbin/snmpd -LS0-6d -f
type=SOCKADDR msg=audit(10/11/2022 07:49:39.168:323) : saddr={ saddr_fam=inet laddr=127.0.0.1 lport=10161 }
type=SYSCALL msg=audit(10/11/2022 07:49:39.168:323) : arch=x86_64 syscall=bind success=yes exit=0 a0=0x7 a1=0x7ffc8b73f4e0 a2=0x10 a3=0x7ffc8b73f39c items=0 ppid=1 pid=15608 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=snmpd exe=/usr/sbin/snmpd subj=system_u:system_r:snmpd_t:s0 key=(null)
type=AVC msg=audit(10/11/2022 07:49:39.168:323) : avc: denied { name_bind } for pid=15608 comm=snmpd src=10161 scontext=system_u:system_r:snmpd_t:s0 tcontext=system_u:object_r:unreserved_port_t:s0 tclass=udp_socket permissive=1
----
Commit to backport:
commit 1481091ea81cb62ffcfbd6c5eb6b6345d4a70cc0 (HEAD -> rawhide, upstream/rawhide)
Author: Nikola Knazekova <nknazeko>
Date: Tue Oct 11 14:26:13 2022 +0200
Label ports 10161-10162 tcp/udp with snmp
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (selinux-policy bug fix and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2023:2483 |
Description of problem: net-snmp cannot enable TLS, SELINUX forbids it. Version-Release number of selected component (if applicable): net-snmp-5.9.1-7.el9_0.1.x86_64 How reproducible: Always Steps to Reproduce: 1. Enable TLS in /etc/snmpd.conf as follows: agentaddress dtlsudp:10161,dtlsudp:[::]:10161 [snmp] localCert snmpd [snmp] trustCert ssl-cacert Actual results: net-snmp fails to start: Oct 08 23:19:58 seawitch snmpd[9384]: Cannot bind for clientaddr: Permission denied Oct 08 23:19:58 seawitch snmpd[9384]: Error opening specified endpoint "dtlsudp:10161" Oct 08 23:19:58 seawitch snmpd[9384]: Server Exiting with code 1 Oct 08 23:19:58 seawitch systemd[1]: snmpd.service: Main process exited, code=exited, status=1/FAILURE Reason, selinux denied: type=AVC msg=audit(1665263998.057:1053): avc: denied { name_bind } for pid=9384 comm="snmpd" src=10161 scontext=system_u:system_r:snmpd_t:s0 tcontext=system_u:object_r:unreserved_port_t:s0 tclass=udp_socket permissive=0 Expected results: snmpd starts normally. Additional info: Workaround: disable selinux (yuck)