Hide Forgot
Description of problem: BIND has a feature to export server statistics through HTTP. However this feature is currently unusable because SELinux denies BIND to bind(2) port 80. Version-Release number of selected component (if applicable): # rpm -q selinux-policy-targeted selinux-policy-targeted-3.9.16-4.fc16.noarch How reproducible: always Actual results: bind(2) is denied: type=AVC msg=audit(1300449619.385:15): avc: denied { name_bind } for pid=1186 comm="named" src=80 scontext=system_u:system_r:named_t:s0 tcontext=system_u:object_r:http_port_t:s0 tclass=tcp_socket type=SYSCALL msg=audit(1300449619.385:15): arch=c000003e syscall=49 success=yes exit=0 a0=14 a1=7ff1de4d7600 a2=10 a3=7ff1de4d7210 items=0 ppid=1183 pid=1186 auid=4294967295 uid=25 gid=25 euid=25 suid=25 fsuid=25 egid=25 sgid=25 fsgid=25 tty=(none) ses=4294967295 comm="named" exe="/usr/sbin/named" subj=system_u:system_r:named_t:s0 key=(null) Expected results: successful bind(2) Let me know if you need more information.
Oops, set wrong component. Changing to selinux-policy-targeted.
Should we allow it by default?
(In reply to comment #2) > Should we allow it by default? If you would like to add new selinux boolean then disable it by default. Not sure if there is another way how to disable enforcing of this rule by default.
Should be a boolean. named_bind_http_port Off by default.
(In reply to comment #4) > Should be a boolean. > > named_bind_http_port > > Off by default. Sounds fine for me.
Should be fixed in the latest f15 policy.