We need to see the AVC messages from /var/log/audit/audit when you attempt to create an instance on a non-default port.  Please do this with SELinux in Permissive mode.

extract from audit logs:
=======================

type=USER_AVC msg=audit(1372690070.577:650): pid=1 uid=0 auid=4294967295 ses=4294967295  subj=system_u:system_r:init_t:s0 msg='avc:  received setenforce notice (enforcing=0)  exe="/usr/lib/systemd/systemd" sauid=0 hostname=? addr=? terminal=?'
type=AVC msg=audit(1372690070.679:651): avc:  denied  { name_bind } for  pid=25338 comm="ns-slapd" src=3389 scontext=system_u:system_r:dirsrv_t:s0 tcontext=system_u:object_r:unreserved_port_t:s0 tclass=tcp_socket
type=SYSCALL msg=audit(1372690070.679:651): arch=c000003e syscall=49 success=yes exit=0 a0=6 a1=7fff5b449740 a2=1c a3=7fff5b449500 items=0 ppid=1 pid=25338 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm="ns-slapd" exe="/usr/sbin/ns-slapd" subj=system_u:system_r:dirsrv_t:s0 key=(null)
type=SERVICE_START msg=audit(1372690070.686:652): pid=1 uid=0 auid=4294967295 ses=4294967295  subj=system_u:system_r:init_t:s0 msg=' comm="dirsrv@instance1" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'

AVC error messages in selinux enforcing mode when creating the instance.

type=AVC msg=audit(1372707310.496:993): avc:  denied  { name_bind } for  pid=28010 comm="ns-slapd" src=1989 scontext=system_u:system_r:dirsrv_t:s0 tcontext=system_u:object_r:unreserved_port_t:s0 tclass=tcp_socket
type=SYSCALL msg=audit(1372707310.496:993): arch=c000003e syscall=49 success=no exit=-13 a0=6 a1=7fff8a21c120 a2=1c a3=7fff8a21bee0 items=0 ppid=1 pid=28010 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm="ns-slapd" exe="/usr/sbin/ns-slapd" subj=system_u:system_r:dirsrv_t:s0 key=(null)
type=SERVICE_START msg=audit(1372707310.520:994): pid=1 uid=0 auid=4294967295 ses=4294967295  subj=system_u:system_r:init_t:s0 msg=' comm="dirsrv@testsnewew" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed'


AVC error messages when starting the DS instance in enforcing mode.

type=AVC msg=audit(1372707405.218:995): avc:  denied  { name_bind } for  pid=28054 comm="ns-slapd" src=1989 scontext=unconfined_u:system_r:dirsrv_t:s0 tcontext=system_u:object_r:unreserved_port_t:s0 tclass=tcp_socket
type=SYSCALL msg=audit(1372707405.218:995): arch=c000003e syscall=49 success=no exit=-13 a0=6 a1=7fff259c3b50 a2=1c a3=7fff259c3910 items=0 ppid=28014 pid=28054 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=12 tty=(none) comm="ns-slapd" exe="/usr/sbin/ns-slapd" subj=unconfined_u:system_r:dirsrv_t:s0 key=(null)


Error messages observed for selinux permissive. With permissive mode, there was no problem starting/creating the DS instance.

type=AVC msg=audit(1372707557.590:998): avc:  denied  { name_bind } for  pid=28181 comm="ns-slapd" src=1389 scontext=system_u:system_r:dirsrv_t:s0 tcontext=system_u:object_r:unreserved_port_t:s0 tclass=tcp_socket
type=SYSCALL msg=audit(1372707557.590:998): arch=c000003e syscall=49 success=yes exit=0 a0=6 a1=7fffb3e80900 a2=1c a3=7fffb3e806c0 items=0 ppid=1 pid=28181 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm="ns-slapd" exe="/usr/sbin/ns-slapd" subj=system_u:system_r:dirsrv_t:s0 key=(null)
type=SERVICE_START msg=audit(1372707557.595:999): pid=1 uid=0 auid=4294967295 ses=4294967295  subj=system_u:system_r:init_t:s0 msg=' comm="dirsrv@selinperm" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
type=SERVICE_STOP msg=audit(1372707627.950:1000): pid=1 uid=0 auid=4294967295 ses=4294967295  subj=system_u:system_r:init_t:s0 msg=' comm="dirsrv@selinperm" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'

type=AVC msg=audit(1372707628.775:1001): avc:  denied  { name_bind } for  pid=28357 comm="ns-slapd" src=1389 scontext=unconfined_u:system_r:dirsrv_t:s0 tcontext=system_u:object_r:unreserved_port_t:s0 tclass=tcp_socket
type=SYSCALL msg=audit(1372707628.775:1001): arch=c000003e syscall=49 success=yes exit=0 a0=6 a1=7fff17e287f0 a2=1c a3=7fff17e285b0 items=0 ppid=28315 pid=28357 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=12 tty=pts1 comm="ns-slapd" exe="/usr/sbin/ns-slapd" subj=unconfined_u:system_r:dirsrv_t:s0 key=(null)

I see the same AVC message mentioned in comment#4 on a RHEL7 system using the following package versions:

  389-ds-base-1.3.1.2-1.el7.x86_64
  selinux-policy-3.12.1-56.el7.noarch

This problem does not exist on F19 systems.  There is likely some difference in the SELinux policy between the two distributions, but I didn't notice anything obviously missing in the selinux-policy source on RHEL7.

I also noticed that this only happens when you use a non-standard port.  If I create a DS instance on a port that is labelled as ldap_port_t by the base policy (like port 389), the instance starts up without any AVC messages.  If I select a non-standard port (like port 4370), I encounter the AVC.  The interesting thing is that the port is labelled as ldap_port_t if I check immediately after the DS installer errors out:

  [root@server SOURCES]# semanage port -l | grep 4370
  ldap_port_t                    tcp      4370, 389, 636, 3268, 7389

The port labelling is done by the DS installer calling semanage.  This is obviously working since the port is labelled according to semanage, yet there is clearly some difference between using port 389 and a non-standard port.

I also disabled the dontaudit rules, but there is only the one AVC related to name_bind.

Once thing that seems odd is that I don't see any MAC_POLICY_LOAD messages in /var/log/audit/audit.log when the DS installer is running.  I am used to seeing these messages in the audit log when we label ports via semanage.

Is there an update on this?  This is blocking our QE group from testing 389-ds-base for RHEL 7.0.

I am not sure how to further troubleshoot the issue, so any assistance would be great.  Please let me know if there is any other info that I can provide.

I probably missed your points. 

You use non-standard ports which are labeled using semanage but you are still getting

type=AVC msg=audit(1372707557.590:998): avc:  denied  { name_bind } for  pid=28181 comm="ns-slapd" src=1389 scontext=system_u:system_r:dirsrv_t:s0 tcontext=system_u:object_r:unreserved_port_t:s0 tclass=tcp_socket
type=SYSCALL msg=audit(1372707557.590:998): arch=c000003e syscall=49 success=yes exit=0 a0=6 a1=7fffb3e80900 a2=1c a3=7fffb3e806c0 items=0 ppid=1 pid=28181 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm="ns-slapd" exe="/usr/sbin/ns-slapd" subj=system_u:system_r:dirsrv_t:s0 key=(null)

(In reply to Miroslav Grepl from comment #8)
> I probably missed your points. 
> 
> You use non-standard ports which are labeled using semanage but you are
> still getting
> 
> type=AVC msg=audit(1372707557.590:998): avc:  denied  { name_bind } for 
> pid=28181 comm="ns-slapd" src=1389 scontext=system_u:system_r:dirsrv_t:s0
> tcontext=system_u:object_r:unreserved_port_t:s0 tclass=tcp_socket
> type=SYSCALL msg=audit(1372707557.590:998): arch=c000003e syscall=49
> success=yes exit=0 a0=6 a1=7fffb3e80900 a2=1c a3=7fffb3e806c0 items=0 ppid=1
> pid=28181 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0
> fsgid=0 ses=4294967295 tty=(none) comm="ns-slapd" exe="/usr/sbin/ns-slapd"
> subj=system_u:system_r:dirsrv_t:s0 key=(null)

Yes, that is correct.

Here is what I am seeing on a RHEL 7 system from the most recent compose (20130712.n.0):

---------------------------------------------------------------
[root@hp-bl460c-02 ~]# semanage port -l | grep ldap
ldap_port_t                    tcp      389, 636, 3268, 7389
ldap_port_t                    udp      389, 636
[root@hp-bl460c-02 ~]# setup-ds.pl
...
<go through install selecting port 1389, defaults for the rest>
...
Job for dirsrv failed. See 'systemctl status dirsrv' and 'journalctl -xn' for details.
[12/Jul/2013:14:24:06 -0400] createprlistensockets - PR_Bind() on All Interfaces port 1389 failed: Netscape Portable Runtime error -5966 (Access Denied.)
Could not start the directory server using command '/bin/systemctl start dirsrv'.  The last line from the error log was '[12/Jul/2013:14:24:06 -0400] createprlistensockets - PR_Bind() on All Interfaces port 1389 failed: Netscape Portable Runtime error -5966 (Access Denied.)
'.  Error: Unknown error 256
Error: Could not create directory server instance 'hp-bl460c-02'.
Exiting . . .
Log file is '/tmp/setupndY_rg.log'

[root@hp-bl460c-02 ~]# semanage port -l | grep ldap
ldap_port_t                    tcp      1389, 389, 636, 3268, 7389
ldap_port_t                    udp      389, 636
[root@hp-bl460c-02 ~]#
---------------------------------------------------------------

The AVC is the same as mentioned in comment#8.

Then the install process failed.

I mean there will be a bug in setup-ds.pl.

(In reply to Miroslav Grepl from comment #12)
> I mean there will be a bug in setup-ds.pl.

In setup-ds.pl, we simply do the following to label the port:

    semanage port -a -t ldap_port_t -p tcp <portnum>

We can see that this is successful by checking the port label after the 389 DS instance creation fails.  We haven't changed anything here, and this same code is working on F19.

Was there any sort of timing change with regards to the policy being loaded when running semanage?  Does semanage exit before the policy is reloaded now?

I have narrowed down the problem further.  I have to manually force the policy to be reloaded after labelling a port before the new label is taking into account when evaluating rules.  The behavior is consistently reproducible.

This works without any AVC messages:

----------------------------------------------
semanage port -a -t ldap_port_t -p tcp 1389
semodule -R
setup-ds.pl (using port 1389)
----------------------------------------------

This fails with the name_bind AVC mentioned above:

----------------------------------------------
semanage port -a -t ldap_port_t -p tcp 1389
setup-ds.pl (using port 1389)
----------------------------------------------

Why isn't the policy being reloaded automatically when the port is labelled with semanage?  It has always been reloaded in the past, but that doesn't appear to be the case on RHEL 7.0.

The problem appears to be in /usr/sbin/semanage.  If you look at setupPortParser(), you will see the following for the -N/--noreload option:

-----------------------------------------------------------------------
    portParser.add_argument('-N', '--noreload', action='store_false', default=False, help=_('Do not reload policy after commit'))
-----------------------------------------------------------------------

The problem with this is that the value with be False when -N is specified as well as when it is not specified.  This means the policy will If I change this code like below, things work as expected:

-----------------------------------------------------------------------
    portParser.add_argument('-N', '--noreload', action='store_false', default=True, help=_('Do not reload policy after commit'))
-----------------------------------------------------------------------

In this case, specifying -N causes the policy to not be reloaded.  If I don't specify -N, the policy is properly reloaded.

This same problem is found for all of the other semanage subcommands that I saw, not just the "port" subcommand.

I looked at the semanage code from F19, and it is completely different than RHEL7.0.  This explains why the problem was only seen on RHEL 7.0.

fixed in policycoreutils-2.1.14-66.el7

I installed policycoreutils-2.1.14-66.el7, but semanage is more broken now.  It seems that argument parsing is not working correctly:

[root@hp-bl460c-02 ~]# semanage port -l
list option can not be used with --range

[root@hp-bl460c-02 ~]# semanage port -a -t ldap_port_t -p tcp 1389
usage: semanage port [-h] [-n] [-N] [-s STORE] [ --add -t TYPE -p PROTOCOL -r RANGE port_name | port_range | --delete -p PROTOCOL port_name | port_range | --deleteall  | --extract  | --list -C | --modify -t TYPE -p PROTOCOL -r RANGE port_name | port_range ]
semanage port: error: argument -t/--type: not allowed with argument -a/--add

[root@hp-bl460c-02 ~]# semanage port -d -t ldap_port_t -p tcp 1389
usage: semanage port [-h] [-n] [-N] [-s STORE] [ --add -t TYPE -p PROTOCOL -r RANGE port_name | port_range | --delete -p PROTOCOL port_name | port_range | --deleteall  | --extract  | --list -C | --modify -t TYPE -p PROTOCOL -r RANGE port_name | port_range ]
semanage port: error: argument -t/--type: not allowed with argument -d/--delete

Created attachment 775497 [details]
semanage-port.patch

Fixed in policycoreutils-2.1.14-67.fc20

If there are no objections I will switch the bug to verified.

(In reply to Milos Malik from comment #22)
> If there are no objections I will switch the bug to verified.

That is fine with me.  I tested the original issue by installing 389-ds-base on a non-default port, and everything is working correctly when using policycoreutils-python-2.1.14-67.el7.x86_64.

This request was resolved in Red Hat Enterprise Linux 7.0.

Contact your manager or support representative in case you have further questions about the request.