1

I'm running on RedHat7, with apache 2.4 and redis installed. Apache won't connect to redis unless selinux issues are resolved. I know that one option to fix that is to allow all connections with:

setsebool -P httpd_can_network_connect=1

but I'd rather only allow connections to redis, which is running locally, instead of all tcp ports. I followed the suggestions in:

SElinux: allow httpd to connect to a specific port

but it didn't quite work for me. The first suggestion failed because the redis port is already defined (by redis):

 semanage port -l | egrep '(^http_port_t|6379)'
 http_port_t                    tcp      80, 81, 443, 488, 8008, 8009, 8443, 9000
 redis_port_t                   tcp      6379, 16379, 26379

 semanage port -a -t http_port_t -p tcp 6379
ValueError: Port tcp/6379 already defined

The second suggestion:

 semanage port -m -t http_port_t -p tcp 6379

worked, and apache was able to connect to redis properly. Though, after a reboot, redis didn't want to start, giving me another selinux error ("SELinux is preventing /opt/rh/rh-redis32/root/usr/bin/redis-server from name_bind access on the tcp_socket port 6379"):

SELinux is preventing /opt/rh/rh-redis32/root/usr/bin/redis-server from name_bind access on the tcp_socket port 6379.

*****  Plugin catchall (100. confidence) suggests     
If you believe that redis-server should be allowed name_bind access on the port 6379 tcp_socket by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
 Do allow this access for now by executing:
 ausearch -c 'redis-server' --raw | audit2allow -M my-redisserver
 semodule -i my-redisserver.pp
Additional Information:

Source Context                system_u:system_r:redis_t:s0
Target Context                system_u:object_r:http_port_t:s0
Target Objects                port 6379 [ tcp_socket ]
Source                        redis-server
Source Path                   /opt/rh/rh-redis32/root/usr/bin/redis-server
Port                          6379

Does anyone know how to properly allow apache to connect to (a locally installed) redis, without setting "httpd_can_network_connect"?

Note: the selinux complaint about httpd not being able to use redis, before doing any semanage commands was:

SELinux is preventing /opt/rh/httpd24/root/usr/sbin/httpd from name_connect access on the tcp_socket port 6379.
*****  Plugin catchall_boolean (89.3 confidence) suggests   ******************
If you want to allow httpd to can network connect
Then you must tell SELinux about this by enabling the 'httpd_can_network_connect' boolean.
Do
setsebool -P httpd_can_network_connect 1
*****  Plugin catchall (11.6 confidence) suggests   **************************
If you believe that httpd should be allowed name_connect access on the port 6379 tcp_socket by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'httpd' --raw | audit2allow -M my-httpd
# semodule -i my-httpd.pp

Additional Information:
Source Context                system_u:system_r:httpd_t:s0
Target Context                system_u:object_r:redis_port_t:s0
Target Objects                port 6379 [ tcp_socket ]
Source                        httpd
Source Path                   /opt/rh/httpd24/root/usr/sbin/httpd
Port                          6379
Host                          <Unknown>
Source RPM Packages           httpd24-httpd-2.4.27-8.el7.1.x86_64
Target RPM Packages
Policy RPM                    selinux-policy-3.13.1-192.el7_5.6.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
[...]
Raw Audit Messages
type=AVC msg=audit(1540322412.65:21558): avc:  denied  { name_connect } for  pid=26250 comm="httpd" dest=6379 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:redis_port_t:s0 tclass=tcp_socket
type=SYSCALL msg=audit(1540322412.65:21558): arch=x86_64 syscall=connect success=no exit=EACCES a0=11 a1=7efca766b050 a2=10 a3=5bcf746c items=0 ppid=11656 pid=26250 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm=httpd exe=/opt/rh/httpd24/root/usr/sbin/httpd subj=system_u:system_r:httpd_t:s0 key=(null)
Hash: httpd,httpd_t,redis_port_t,tcp_socket,name_connect
0

I think the best thing to do is revert the port number to its original type, put it in permissive to collect AVCs, then build the local policy module. You can then go back to enforcing.

  • Thanks; yes, that's always an option. I was just wondering if there was a less "hand made" way of doing it. I got optimistic when I saw the other post (that "almost" worked for me). – user515971 Apr 1 at 17:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.