Should it be allowed to connect to the matahari ports also? 49000?

Fixed in selinux-policy-3.7.19-137.el6

Package selinux-policy-3.7.19-137.el6 reliably fixes the original reported issue (tested on RHEL6.3-20120222.n.0 i686 / x86_64 / ppc64 / s390x).

When extending tests to matahari-broker as well I'm still able to trigger the similar AVC to matahari broker's port 49000.

services qpidd and matahari-broker launch separate brokers by default listening on 5672 (qpidd) and 49000 (matahari-broker).

I expect that selinux-policy-3.7.19-137.el6 should not deny matahari-broker  from name_connect (to port 49000):

  ...
  [root@hp-bl460cg7-01 bz786467_769352]# service matahari-broker restart
  
  [root@hp-bl460cg7-01 bz786467_769352]# grep  'AVC' /var/log/audit/audit.log
  [root@hp-bl460cg7-01 bz786467_769352]# qpid-route link add $(hostname):49000 hp-bl495cg5-01:49000
  [root@hp-bl460cg7-01 bz786467_769352]# service qpidd status
  qpidd (pid  13898) is running...
  [root@hp-bl460cg7-01 bz786467_769352]# service matahari-broker status
  qpidd (pid  14181) is running...
  [root@hp-bl460cg7-01 bz786467_769352]# netstat -nlp | grep -E '(matahari|qpidd)'
  tcp        0      0 0.0.0.0:49000               0.0.0.0:*                   LISTEN      14181/matahari-brok 
  tcp        0      0 0.0.0.0:5672                0.0.0.0:*                   LISTEN      13898/qpidd         
  tcp        0      0 :::49000                    :::*                        LISTEN      14181/matahari-brok 
  tcp        0      0 :::5672                     :::*                        LISTEN      13898/qpidd         
  [root@hp-bl460cg7-01 bz786467_769352]# grep  'AVC' /var/log/audit/audit.log|tail -1 
  type=AVC msg=audit(1330001026.984:148354): avc:  denied  { name_connect } for  pid=14182 comm="qpidd" dest=49000 scontext=unconfined_u:system_r:qpidd_t:s0 tcontext=system_u:object_r:matahari_port_t:s0 tclass=tcp_socket


I'm seeing fix included in selinux-policy-3.7.19-137.el6 incomplete pointing out Dan's comment 2.


-> ASSIGNED


P.S. Let me know if you want to track matahari's ACL in separate BZ.

Created attachment 565304 [details]
New reproducer for both qpidd and matahari-broker

New reproducers.

Please update hosts:
  run_matahari-broker.sh:29
  run_qpidd.sh:30

At least one remote broker has to be running while the test process.

So we need also add

corenet_tcp_connect_matahari_port(qpidd_t)

The issue has been reliably fixed for both daemons (qpidd, matahari-broker) in selinux-policy-3.7.19-138.el6.noarch.

Tested on RHEL6.3-20120222.n.0 and RHEL6.3-20120229.n.2 (selinux-policy-3.7.19-138.el6) i686 / x86_64 / s390x / ppc64.


-> VERIFIED

    Technical note added. If any revisions are required, please edit the "Technical Notes" field
    accordingly. All revisions will be proofread by the Engineering Content Services team.
    
    New Contents:
An incorrect SELinux policy prevented the qpidd service from connecting to the AMQP (Advanced Message Queuing Protocol) port when the qpidd daemon was configured with Corosync clustering. These selinux-policy packages contain updated SELinux rules, which allow the qpidd service to be started correctly.

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2012-0780.html