network failures maybe SELinux related?

[Daniel J Walsh]

On 05/18/2009 12:37 PM, Brian Ginn wrote:
> Thanks!
>
> For the listining ports, I've done that.
> For the connecting ports, I pick a random port between 1025..65535, call connect() then if the port
> is in use, increment the port number and try again.
>
> Up until selinex, "permission denied" has not been a connect() error that I've had to deal with.
> I could change it so that "permission denied" also results in incrementing the port number and
> retrying connect().
> ... however looking at the results of 'semanage port -l', most of those ports aren't used by the
> selinux domains they are registered for.
>
> When "hardening" a system, we make sure that various un-needed network services are not installed.
> Should we also remove selinux policy (and port registration) for those services?
>
>
> Thanks,
> Brian
>
> ________________________________________
> From: Daniel J Walsh [dwalsh at redhat.com]
> Sent: Saturday, May 16, 2009 4:49 AM
> To: Brian Ginn
> Cc: 'fedora-selinux-list at redhat.com'
> Subject: Re: network failures maybe SELinux related?
>
> On 05/15/2009 05:48 PM, Brian Ginn wrote:
>> corenet_tcp_bind_all_ports()  seems to have solved my problems.
>>
> On what domain?  This will allow that domain to bind to any port, if you
> know what port you want to listen on, you might be able to add the port
> using
>
> semanage port -a -t MISTERYDOMAIN_port_t -p tcp PORTNUMBER
>> -Brian
>>
>>
>> From: Brian Ginn
>> Sent: Friday, May 15, 2009 1:44 PM
>> To: 'fedora-selinux-list at redhat.com'
>> Subject: network failures maybe SELinux related?
>>
>> I have a client app run by users, and two server apps run from xinetd.
>> The client connects to server1
>> Server1 connects to server2
>> Server2 connects back to the client app
>>
>> When not confined by SELinux policy. Everything works fine.
>> I can run several hundred iterations without any failures.
>> When confined, but run in permissive mode, Everything works fine. - nothing in audit.log
>>
>> When confined and enforced, it works a few times, then the connection from server1 to server2 fails.
>> Then, after a rest, it works a few times, then the connection from server1 to server2 fails.
>> There is nothing in audit.log.
>> Does anyone have suggestions for constraints or don't audit rules I should look into?
>>
>>
>> Thanks,
>> Brian
>>
>>
>>
>>
>>
>>
>>
>> ------------------------------------------------------------------------
>>
>> --
>> fedora-selinux-list mailing list
>> fedora-selinux-list at redhat.com
>> https://www.redhat.com/mailman/listinfo/fedora-selinux-list


corenet_tcp_bind_generic_port(DOMAIN)

Will allow you to bind to the first port_t port, IE a port that is not 
have an SELInux port defined for it.  It will dontaudit attempts to bind 
to ports with SELInux ports defined.