Port 1533 is the default port for Sametime messaging services. Summary: SELinux is preventing /usr/libexec/telepathy-haze from connecting to port 1533. Detailed Description: SELinux has denied telepathy-haze from connecting to a network port 1533 which does not have an SELinux type associated with it. If telepathy-haze should be allowed to connect on 1533, use the semanage command to assign 1533 to a port type that telepathy_msn_t can connect to (ldap_port_t, dns_port_t, msnp_port_t, http_port_t, kerberos_port_t, ocsp_port_t). If telepathy-haze is not supposed to connect to 1533, this could signal a intrusion attempt. Allowing Access: If you want to allow telepathy-haze to connect to 1533, you can execute semanage port -a -t PORT_TYPE -p tcp 1533 where PORT_TYPE is one of the following: ldap_port_t, dns_port_t, msnp_port_t, http_port_t, kerberos_port_t, ocsp_port_t. Additional Information: Source Context unconfined_u:unconfined_r:telepathy_msn_t:s0-s0:c0 .c1023 Target Context system_u:object_r:port_t:s0 Target Objects None [ tcp_socket ] Source telepathy-haze Source Path /usr/libexec/telepathy-haze Port 1533 Host (removed) Source RPM Packages telepathy-haze-0.4.0-1.fc14 Target RPM Packages Policy RPM selinux-policy-3.9.0-2.fc14 Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Plugin Name connect_ports Host Name (removed) Platform Linux (removed) 2.6.35.4-12.fc14.x86_64 #1 SMP Fri Aug 27 07:45:05 UTC 2010 x86_64 x86_64 Alert Count 40 First Seen Fri 03 Sep 2010 02:00:44 PM EDT Last Seen Fri 03 Sep 2010 02:01:24 PM EDT Local ID bd8dcf09-ca58-455b-8d18-3e6174f3207a Line Numbers Raw Audit Messages node=(removed) type=AVC msg=audit(1283536884.774:481): avc: denied { name_connect } for pid=23001 comm="telepathy-haze" dest=1533 scontext=unconfined_u:unconfined_r:telepathy_msn_t:s0-s0:c0.c1023 tcontext=system_u:object_r:port_t:s0 tclass=tcp_socket node=(removed) type=SYSCALL msg=audit(1283536884.774:481): arch=c000003e syscall=42 success=no exit=-13 a0=a a1=79fdb0 a2=10 a3=1 items=0 ppid=1 pid=23001 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=(none) ses=1 comm="telepathy-haze" exe="/usr/libexec/telepathy-haze" subj=unconfined_u:unconfined_r:telepathy_msn_t:s0-s0:c0.c1023 key=(null) Hash String generated from connect_ports,telepathy-haze,telepathy_msn_t,port_t,tcp_socket,name_connect audit2allow suggests: #============= telepathy_msn_t ============== #!!!! This avc can be allowed using one of the these booleans: # telepathy_tcp_connect_generic_network_ports, allow_ypbind allow telepathy_msn_t port_t:tcp_socket name_connect;
Dominick should we add a port definition for this or put in jabber?
In general i believe for the file transfer to work the client needs to connect to random ports (that is why the telepathy boolean is implemented) However: 1. I have not written policy for telepathy haze nor have i tried it. 2. This is what i found: Prior to Manager 2007 8.3 and Sametime 7.5.1, Sametime File Transfer was supported only by having Sametime IM clients connect on a port other than 1533. Starting with IM Manager 2007 8.3 and Sametime 7.5.1 IM Manager supports File Transfer connections on port 1533. 3. If the above is applicable here and if a connection to tcp 1533 is sufficient, then i would add a new port declaration for "sametime". That way we can have decent file transfer functionality for telepathy-haze. 4. It is my believe that we should declare as many port types as possible, and in this reasoning it would be best to add the sametime port declaration.
So in short: The preferred method is to add a new port declaration for tcp:1533. Hopefully this will be sufficient to support this functionality. If however, besides connecting to tcp:1533, telepathy-haze needs to connect to other generic ports (some port range, or random ports), then it is encouraged to set the boolean that allows all telepathy_connection_managers to connect to all generic ports.
http://publib.boulder.ibm.com/infocenter/sametime/v7r5m1/topic/com.ibm.help.sametime.admin.doc/st_adm_intro_whatstserver_c.html I think sametime is like msn, jabber etcetera and that the haze connection manager is used for this service/protocol. Thus i think we should declare a sametime_port_t for tcp:1533
Fixed in selinux-policy-3.9.3-1.fc14
selinux-policy-3.9.3-1.fc14 has been submitted as an update for Fedora 14. https://admin.fedoraproject.org/updates/selinux-policy-3.9.3-1.fc14
selinux-policy-3.9.3-1.fc14 has been pushed to the Fedora 14 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with su -c 'yum --enablerepo=updates-testing update selinux-policy'. You can provide feedback for this update here: https://admin.fedoraproject.org/updates/selinux-policy-3.9.3-1.fc14
Verified, I can now connect with the new selinux-policy-3.9.3-1.fc14.noarch.
selinux-policy-3.9.3-1.fc14 has been pushed to the Fedora 14 stable repository. If problems still persist, please make note of it in this bug report.