SELinuxports — различия между версиями

[root@vm-01 ~]# semanage port -l | grep 8888
[root@vm-01 ~]#

[root@vm-01 ~]# grep ^Listen /etc/httpd/conf/httpd.conf
Listen 80
[root@vm-01 ~]# sed -in 's#Listen 80#Listen 8888#g' /etc/httpd/conf/httpd.conf
[root@vm-01 ~]# grep ^Listen /etc/httpd/conf/httpd.conf
Listen 8888
[root@vm-01 ~]#

[root@vm-01 ~]# journalctl -xe

Jan 22 12:50:55 vm-01 setroubleshoot[9510]: SELinux is preventing /usr/sbin/httpd from name_bind access on the tcp_socket port 8888. For complete SELinux messages. run sealert -l d97a7d35-1491-4a0c-97ed-7aa2db7e294b
Jan 22 12:50:55 vm-01 python[9510]: SELinux is preventing /usr/sbin/httpd from name_bind access on the tcp_socket port 8888.
                                    
                                    *****  Plugin bind_ports (92.2 confidence) suggests   ************************
                                    
                                    If you want to allow /usr/sbin/httpd to bind to network port 8888
                                    Then you need to modify the port type.
                                    Do
                                    # semanage port -a -t PORT_TYPE -p tcp 8888
                                        where PORT_TYPE is one of the following: http_cache_port_t, http_port_t, jboss_management_port_t, jboss_messaging_port_t, ntop_port_t, puppet_port_t.
                                    
                                    *****  Plugin catchall_boolean (7.83 confidence) suggests   ******************
                                    
                                    If you want to allow system to run with NIS
                                    Then you must tell SELinux about this by enabling the 'nis_enabled' boolean.
                                    
                                    Do
                                    setsebool -P nis_enabled 1
                                    
                                    *****  Plugin catchall (1.41 confidence) suggests   **************************
                                    
                                    If you believe that httpd should be allowed name_bind access on the port 8888 tcp_socket by default.
                                    Then you should report this as a bug.
                                    You can generate a local policy module to allow this access.
                                    Do
                                    allow this access for now by executing:
                                    # ausearch -c 'httpd' --raw | audit2allow -M my-httpd
                                    # semodule -i my-httpd.pp

[root@vm-01 ~]# sealert -l d97a7d35-1491-4a0c-97ed-7aa2db7e294b
SELinux is preventing /usr/sbin/httpd from name_bind access on the tcp_socket port 8888.

*****  Plugin bind_ports (92.2 confidence) suggests   ************************

If you want to allow /usr/sbin/httpd to bind to network port 8888
Then you need to modify the port type.
Do
# semanage port -a -t PORT_TYPE -p tcp 8888
    where PORT_TYPE is one of the following: http_cache_port_t, http_port_t, jboss_management_port_t, jboss_messaging_port_t, ntop_port_t, puppet_port_t.

*****  Plugin catchall_boolean (7.83 confidence) suggests   ******************

If you want to allow system to run with NIS
Then you must tell SELinux about this by enabling the 'nis_enabled' boolean.
You can read 'None' man page for more details.
Do
setsebool -P nis_enabled 1

*****  Plugin catchall (1.41 confidence) suggests   **************************

If you believe that httpd should be allowed name_bind access on the port 8888 tcp_socket by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'httpd' --raw | audit2allow -M my-httpd
# semodule -i my-httpd.pp


Additional Information:
Source Context                system_u:system_r:httpd_t:s0
Target Context                system_u:object_r:unreserved_port_t:s0
Target Objects                port 8888 [ tcp_socket ]
Source                        httpd
Source Path                   /usr/sbin/httpd
Port                          8888
Host                          vm-01
Source RPM Packages           httpd-2.4.6-45.el7.x86_64
Target RPM Packages           
Policy RPM                    selinux-policy-3.13.1-102.el7.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     vm-01
Platform                      Linux vm-01 3.10.0-514.el7.x86_64 #1 SMP Wed Oct
                              19 11:24:13 EDT 2016 x86_64 x86_64
Alert Count                   1
First Seen                    2018-01-22 12:50:53 MSK
Last Seen                     2018-01-22 12:50:53 MSK
Local ID                      d97a7d35-1491-4a0c-97ed-7aa2db7e294b

Raw Audit Messages
type=AVC msg=audit(1516614653.147:1119): avc:  denied  { name_bind } for  pid=9504 comm="httpd" src=8888 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:unreserved_port_t:s0 tclass=tcp_socket


type=SYSCALL msg=audit(1516614653.147:1119): arch=x86_64 syscall=bind success=no exit=EACCES a0=3 a1=7f3204e9bcf8 a2=10 a3=7ffd1ca5dcec items=0 ppid=1 pid=9504 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=httpd exe=/usr/sbin/httpd subj=system_u:system_r:httpd_t:s0 key=(null)

Hash: httpd,httpd_t,unreserved_port_t,tcp_socket,name_bind

[root@vm-01 ~]#

[root@vm-01 ~]# semanage port -l | grep ^http
http_cache_port_t              tcp      8080, 8118, 8123, 10001-10010
http_cache_port_t              udp      3130
http_port_t                    tcp      80, 81, 443, 488, 8008, 8009, 8443, 9000
[root@vm-01 ~]#