Bug 732276 - SELinux is preventing /usr/sbin/unbound from 'name_bind' accesses on the tcp_socket port 8953.
Summary: SELinux is preventing /usr/sbin/unbound from 'name_bind' accesses on the tcp_...
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 14
Hardware: x86_64
OS: Linux
unspecified
medium
Target Milestone: ---
Assignee: Miroslav Grepl
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: setroubleshoot_trace_hash:6710ec8683c...
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2011-08-21 14:45 UTC by ppeirano
Modified: 2011-08-24 03:18 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2011-08-24 03:18:44 UTC


Attachments (Terms of Use)

Description ppeirano 2011-08-21 14:45:45 UTC
SELinux is preventing /usr/sbin/unbound from 'name_bind' accesses on the tcp_socket port 8953.

*****  Plugin bind_ports (92.2 confidence) suggests  *************************

If you want to allow /usr/sbin/unbound to bind to network port 8953
Then you need to modify the port type.
Do
# semanage port -a -t PORT_TYPE -p tcp 8953
    where PORT_TYPE is one of the following: rndc_port_t, dns_port_t.

*****  Plugin catchall_boolean (7.83 confidence) suggests  *******************

If you want to allow system to run with NIS
Then you must tell SELinux about this by enabling the 'allow_ypbind' boolean.
Do
setsebool -P allow_ypbind 1

*****  Plugin catchall (1.41 confidence) suggests  ***************************

If you believe that unbound should be allowed name_bind access on the port 8953 tcp_socket by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep unbound /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

Additional Information:
Source Context                unconfined_u:system_r:named_t:SystemLow
Target Context                system_u:object_r:port_t:SystemLow
Target Objects                port 8953 [ tcp_socket ]
Source                        unbound
Source Path                   /usr/sbin/unbound
Port                          8953
Host                          (removed)
Source RPM Packages           unbound-1.4.12-1.fc14
Target RPM Packages           
Policy RPM                    selinux-policy-3.9.7-44.fc14
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 2.6.35.12 #4 SMP Tue Apr 5 23:22:00
                              CEST 2011 x86_64 x86_64
Alert Count                   2
First Seen                    Sun 21 Aug 2011 04:36:45 PM CEST
Last Seen                     Sun 21 Aug 2011 04:38:14 PM CEST
Local ID                      39c2659c-5817-4b1c-b98e-d1679e07c2ad

Raw Audit Messages
type=AVC msg=audit(1313937494.530:24468): avc:  denied  { name_bind } for  pid=4531 comm="unbound" src=8953 scontext=unconfined_u:system_r:named_t:s0 tcontext=system_u:object_r:port_t:s0 tclass=tcp_socket


type=SYSCALL msg=audit(1313937494.530:24468): arch=x86_64 syscall=bind success=no exit=EACCES a0=7 a1=23ff090 a2=1c a3=7fffa4e96d3c items=0 ppid=4530 pid=4531 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=3 comm=unbound exe=/usr/sbin/unbound subj=unconfined_u:system_r:named_t:s0 key=(null)

Hash: unbound,named_t,port_t,tcp_socket,name_bind

audit2allow

#============= named_t ==============
#!!!! This avc can be allowed using the boolean 'allow_ypbind'

allow named_t port_t:tcp_socket name_bind;

audit2allow -R

#============= named_t ==============
#!!!! This avc can be allowed using the boolean 'allow_ypbind'

allow named_t port_t:tcp_socket name_bind;

Comment 1 Miroslav Grepl 2011-08-23 07:37:27 UTC
*****  Plugin bind_ports (92.2 confidence) suggests  *************************

If you want to allow /usr/sbin/unbound to bind to network port 8953
Then you need to modify the port type.
Do
# semanage port -a -t PORT_TYPE -p tcp 8953
    where PORT_TYPE is one of the following: rndc_port_t, dns_port_t.



So execute

semanage port -a -t  dns_port_t -p tcp 8953


will allow for now.

Comment 2 Daniel Walsh 2011-08-24 03:18:44 UTC
Unless this is a default port you have to make the modification.


Note You need to log in before you can comment on or make changes to this bug.