Description of problem:
When trying to use the dblink_connect functionality of PostgreSQL, SELinux blocks the connection.

PostgreSQL gives this error when SELinux is set to enforcing:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
testdb=> SELECT dblink_connect('hostaddr=127.0.0.1 dbname=testdb user=test password=test');
ERROR:  could not establish connection
DETAIL:  could not connect to server: Permission denied
        Is the server running on host "127.0.0.1" and accepting
        TCP/IP connections on port 5432?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

When SELinux is set to permissive, PostgreSQL does:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
testdb=> SELECT dblink_connect('hostaddr=127.0.0.1 dbname=testdb user=test password=test');
 dblink_connect
----------------
 OK
(1 row)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

The /var/log/audit/audit.log contains this AVC error:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
type=AVC msg=audit(1246035068.454:44): avc:  denied  { name_connect } for  pid=2028 comm="postmaster" dest=5432 scontext=root:system_r:postgresql_t:s0 tcontext=system_u:object_r:postgresql_port_t:s0 tclass=tcp_socket
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


It looks like this was fixed in Fedora Core 5 with bug 189764, but the problem has resurfaced in RHEL 5.


Version-Release number of selected component (if applicable):
postgresql-8.1.11-1.el5_1.1
selinux-policy-2.4.6-203.el5

How reproducible:
every time

Steps to Reproduce:
0. Install RHEL 5.3 with PostgreSQL packages

1. Enable PostgreSQL
     chkconfig postgresql on
     service postgresql start

2. Become the postgres user
     su - postgres

3. Create a PostgreSQL user 'test' and a database 'testdb'
     createuser -S -D -R test
     createdb testdb
     psql
       ALTER USER test WITH PASSWORD 'test';
       ALTER DATABASE testdb OWNER TO test;
       \q

4. Enable password authentication with PostgreSQL
     vi /var/lib/pgsql/data/pg_hba.conf
       # Insert these lines near the top of pg_hba.conf
       local   testdb      test                              md5
       host    testdb      test        127.0.0.1/32          md5
       host    testdb      test        ::1/128               md5
     pg_ctl reload

5. Create a table in the 'testdb' database
     psql -W -U test testdb
       CREATE TABLE test ( foo int, bar real, baz varchar(80) );
       \q

6. Enable dblink_connect functionality
     psql testdb < /usr/share/pgsql/contrib/dblink.sql

7. Try to use dblink_connect
     psql -W -U test testdb
     SELECT dblink_connect('hostaddr=127.0.0.1 dbname=testdb 
                            user=test password=test');


Actual results:
dblink_connect fails with:
ERROR:  could not establish connection
DETAIL:  could not connect to server: Permission denied
        Is the server running on host "127.0.0.1" and accepting
        TCP/IP connections on port 5432?


Expected results:
dblink_connect succeeds with:
 dblink_connect
----------------
 OK
(1 row)


Additional info:
Run 'setenforce 0' to switch SELinux to permissive mode and do step 7 again and it will succeed.