2

I have a CentOS 7 box with multiple IP address on the same NIC. One IP uses 443 for ssh and I want the other IP to use 443 for the web server. SELinux won't let httpd startup saying:

(13)Permission denied: AH00072: make_sock: could not bind to address MYIPADDRESS:443

I have both services setup to specifically listen on only the relevant IP addresses via Listen arguments in their relevant config files. Before I just turn off SELinux is there a way to allow both? My config SELinux currently looks like:

# semanage port -l | grep 443
http_port_t                    tcp      80, 81, 443, 488, 8008, 8009, 8443, 9000
pki_ca_port_t                  tcp      829, 9180, 9701, 9443-9447
pki_kra_port_t                 tcp      10180, 10701, 10443-10446
pki_ocsp_port_t                tcp      11180, 11701, 11443-11446
pki_tks_port_t                 tcp      13180, 13701, 13443-13446
ssh_port_t                     tcp      443, 22

From audit log:

type=AVC msg=audit(1547705364.251:191844): avc: denied { name_bind } for pid=17495 comm="httpd" src=443 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:ssh_port_t:s0 tclass=tcp_socket
4
  • Please show the AVC denial from the audit log. Jan 18, 2019 at 0:21
  • 1
    A TCP port cannot have two types at once. Only one or the other will have effect. Rather than making ssh listen on a nonstandard port, use an iptables redirect to bring in traffic from the nonstandard port to the standard one. Jan 18, 2019 at 1:02
  • Bah. SELinux is just going to get turned off then. Surprised at the lack of support for multiple IPs. Thanks so much!
    – John Shum
    Jan 18, 2019 at 20:06
  • 1
    You're disabling the good security so you can have the not so good security?! Jan 18, 2019 at 20:47

1 Answer 1

0

OK, really old topic but funnily enough I just ran into the same issue with a multi-homed host.

Given that it is perfectly reasonable for a machine with two network interfaces to have one process bound to w.x.y.z:port and another bound to a.b.c.d:port then ideally there would be a reasonably painless way encapsulate that in SELinux

I guess it might be possible with a custom policy but it looks as though this is a thing which SELinux makes difficult, which should not be difficult.

2

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .