While installing a web application communicating with a redis service via TCP socket, I witnessed connectivity issues related to SELinux.

Connections could be established only after setting 'httpd_can_network_connect' to 'on' due to a missing policy for connecting to redis with httpd.

This had me double-check the available policies related to httpd and redis:

# sesearch -s httpd_t --allow | grep redis
allow httpd_t redis_t:unix_stream_socket connectto;
allow httpd_t redis_var_run_t:dir { getattr open search };
allow httpd_t redis_var_run_t:sock_file { append getattr open write };

When compared to the available policies related to httpd and memcache, a service similar to redis, it shows that there are available policies for connecting via TCP:

# sesearch -s httpd_t --allow | grep memcache
allow httpd_t memcache_port_t:tcp_socket name_connect; [ httpd_can_network_memcache ]:True
allow httpd_t memcache_port_t:tcp_socket name_connect; [ httpd_can_network_relay ]:True
allow httpd_t memcached_t:unix_stream_socket connectto;
allow httpd_t memcached_var_run_t:dir { add_name getattr ioctl lock open read remove_name search write }; [ httpd_manage_ipa ]:True
allow httpd_t memcached_var_run_t:dir { getattr open search };
allow httpd_t memcached_var_run_t:file { append create getattr ioctl link lock open read rename setattr unlink write }; [ httpd_manage_ipa ]:True
allow httpd_t memcached_var_run_t:sock_file { append getattr open write };

Thus, I think the equivalent policies for httpd<->redis connectivity have been omitted accidentally?


Version-Release number of selected component (if applicable):
httpd - 2.4.37-56.module+el8.8.0+18758+b3a9c8da.6
selinux-policy - 3.14.3-117.el8
selinux-policy-targeted - 3.14.3-117.el8

Additional notes:

This problem might very well affect other derivates of RHEL8.8 as well as other versions of RHEL, too.