Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

My system is running CentOS 6.4 with apache2.2.15. SElinux is enforcing and I'm trying to connect to a local instance of redis through my python/wsgi app. I get Error 13, Permission denied. I could fix this via the command:

setsebool -P httpd_can_network_connect

However, I don't exactly want httpd to be able to connect to all tcp ports. How can I specify which ports/networks httpd is allowed to connect to? If I could make a module to allow httpd to connect to port 6379 ( redis ) or any tcp on, that would be preferable. Not sure why my paranoia is so strong on this, but hey...

Anyone know?

share|improve this question
Would it not be better to force it to go out through a proxy? That way you can a) have better control over what can be accessed b) have better auditing over what happened and when. –  Cameron Kerr May 13 at 9:56

3 Answers 3

By default, the SELinux policy will only allow services access to recognized ports associated with those services:

# semanage port -l | egrep '(^http_port_t|6379)'
http_port_t                    tcp      80, 81, 443, 488, 8008, 8009, 8443, 9000
# curl http://localhost/redis.php
Cannot connect to redis server.

- add Redis port (6379) to SELinux policy

# semanage port -a -t http_port_t -p tcp 6379
# semanage port -l | egrep '(^http_port_t|6379)'
http_port_t                    tcp      6379, 80, 81, 443, 488, 8008, 8009, 8443, 9000
# curl http://localhost/redis.php
Connected successfully.

You can also install setroubleshoot-server RPM and run: sealert -a /var/log/audit/audit.log - it will give you a nice report with useful suggestions (including command above).

PHP script to test connection:

# cat redis.php 

$redis=new Redis();
$connected= $redis->connect('', 6379);

if(!$connected) {
        die( "Cannot connect to redis server.\n" );

echo "Connected successfully.\n";

share|improve this answer

You could temporary put selinux in permissive mode and let httpd connect to redis, then generate and build a custom policy module using audit2allow

share|improve this answer

You may need to use

semanage port -m -t http_port_t -p tcp 6379

If semanage is missing then add the package policycoreutils-python

yum install policycoreutils-python
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.