Description of problem: Use scenario from Bug 691654 on RHEL6 and you get following entry into audit.log: type=AVC msg=audit(1322219322.363:157): avc: denied { name_connect } for pid=2088 comm="qpidd" dest=5672 scontext=unconfined_u:system_r:qpidd_t:s0 tcontext=system_u:object_r:amqp_port_t:s0 tclass=tcp_socket type=SYSCALL msg=audit(1322219322.363:157): arch=c000003e syscall=42 success=no exit=-13 a0=20 a1=7f7014011b80 a2=10 a3=ff00 items=0 ppid=1 pid=2088 auid=0 uid=496 gid=496 euid=496 suid=496 fsuid=496 egid=496 sgid=496 fsgid=496 tty=(none) ses=2 comm="qpidd" exe="/usr/sbin/qpidd" subj=unconfined_u:system_r:qpidd_t:s0 key=(null) # ps -eLf | grep 2088 qpidd 2087 1 2088 0 4 11:27 ? 00:00:06 /usr/sbin/qpidd --data-dir /var/lib/qpidd --daemon Cumin web shows for broker link: State: Waiting Last error: Permission denied: localhost:5672 (qpid/sys/posix/Socket.cpp:173) There is similar (?) selinux bug: Bug 691654 Version-Release number of selected component (if applicable): only RHEL6 MRG 2.0, RHEL 6.0 cumin-0.1.4916-1.el6.noarch qpid-cpp-server-0.10-8.el6_1.x86_64 selinux-policy-3.7.19-93.el6_1.7.noarch MRG 2.1, RHEL 6.1 cumin-0.1.5098-2.el6.noarch qpid-cpp-server-0.12-6.el6.i686 selinux-policy-3.7.19-124.el6.noarch How reproducible: 100% Steps to Reproduce: 1. Bug 691654 2. See audit.log Actual results: Selinux blocks connection from cumin into qpidd Expected results: Selinux allows connection from cumin into qpidd Additional info:
The steps to reproduce are from Bug 756939. I mistyped.
I was able to reproduce this one using qpid-route: <dest-broker># qpid-route link add <dest-broker> <src-broker> [10:29:22] ecode=0 <dest-broker># cat /var/log/audit/audit.log | grep type=AVC type=AVC msg=audit(1323163763.507:42319): avc: denied { name_connect } for pid=1719 comm="qpidd" dest=5672 scontext=system_u:system_r:qpidd_t:s0 tcontext=system_u:object_r:amqp_port_t:s0 tclass=tcp_socket
# sealert -l bc54ba02-f12b-455b-886c-2c21d0a346ef SELinux is preventing qpidd from name_connect access on the tcp_socket port 5672. ***** Plugin catchall (100. confidence) suggests *************************** If you believe that qpidd should be allowed name_connect access on the port 5672 tcp_socket by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # grep qpidd /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp
The issue has been resolved. See bug 791294 comment 8 and bug 786467 comment 15. -> VERIFIED