Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is there a way in SELinux to force linux to allow a program to be able to bind to a port number lower than 1024.

share|improve this question
2  
Capabilities allow that: stackoverflow.com/questions/413807/… Of course, selinux may then prevent it in which case you can fiddle with making an selinux policy. –  Mark Wagner Mar 9 '11 at 20:31

5 Answers 5

Assuming you have a proper policy module for the application (let's call your app "foo") in place, you can do one of two things. You either define a foo_port_t type in the policy, allow you4 app access to it, like this:

allow foo_t foo_port_t:tcp_socket name_bind;

and the use something like this to label the actual port

semanage port -a -t foo_port_t -p tcp 803

This will claim TCP port 803 for your application. Most ports below 1023 already have labels on them though and you cannot label a port, file, whatever multiple times.

So option two: you can allow your app to bind to a port that has a different label, by putting lines like this into your policy module:

require { 
    type http_port_t;
}

allow foo_t http_port_t:tcp_socket name_bind;

This would allow you app to bind to any port that has http_port_t (meaning 80, 443, 488, 8008, 8009 and 8443). You can find what label the port (803 in this example) you want to use, has by this command:

semanage port -l | grep 803
share|improve this answer

Run it as root or sudo it. You should only use root for testing, never in production. The kernel won't allow you to open a port below 1024 (well-known ports) without these permissions. It has nothing to do with SELinux but with the kernel.

share|improve this answer
1  
You should never run processes as root if you can help it. This could lead to a much larger security issue than shutting down SELinux –  Mike Mar 9 '11 at 20:19
1  
@Mike: Unless it's written to explicitly drop root privileges after startup. –  Ignacio Vazquez-Abrams Mar 9 '11 at 20:29
    
However if the process forks before it drops the root privileges, then you still have a security issue. Also what is the process going to do before it drops its privileges. Can you guarantee that it is going to do what you want? You are best to never run anything as the root user because you never know what the service is capable of. –  Mike Mar 9 '11 at 22:51
    
SELinux is very capable of blocking attempts of confined applications to bind to privileged ports. Yes, it can be the kernel, but it can be SELinux as well. –  wzzrd Apr 7 '11 at 21:10
    
As an addendum on this point, you actually only need the binding program to have CAP_NET_BIND_SERVICE which is given its own capability to address the exact concern that you have with running a network program run as root –  Joel Davis Aug 27 '13 at 13:58

It is not SELinux that does not allow your program to bind on privileged ports, it is the Linux kernel. You can do a port forwarding from the desired port to an unprivileged port and run the application on an unprivileged port. This is secure and allowed by SELinux.

share|improve this answer

On Linux (in general), the best way to go is to use systemd with Capabilities= and CapabilityBoundingSet= specified in the unit file, as explained in this answer (see the first comment for why other solutions are sub-par, including using setcap or iptables).

share|improve this answer

In our shop and experience, we have found it best to disable SELinux. I know that some people have found it useful but we have not.

We disable the entire thing in /etc/sysconfig/selinux (or /etc/selinux/config) with SELINUX=disabled

The problems we have had regarding SELinux have been so numerous and caused so many extra hours that it is just not worth it.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.