Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

need selinux and saned help

Hi All,

I am trying to run

# systemctl start saned.socket

And SELinux is taking a shine to it. The commands that it says to run do not work and the same SELinux error keeps appearing:

SELinux is preventing systemd from listen access on the tcp_socket port None.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that systemd should be allowed listen access on the port None tcp_socket by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
allow this access for now by executing:
# ausearch -c 'systemd' --raw | audit2allow -M my-systemd
# semodule -X 300 -i my-systemd.pp

Additional Information:
Source Context                system_u:system_r:init_t:s0
Target Context                system_u:system_r:unconfined_service_t:s0
Target Objects                port None [ tcp_socket ]
Source                        systemd
Source Path                   systemd
Port                          <Unknown>
Source RPM Packages           
Target RPM Packages           
Policy RPM                    selinux-policy-3.13.1-283.18.fc27.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     rn4.xx.local
Platform                      Linux 4.14.7-300.fc27.x86_64
                              #1 SMP Mon Dec 18 16:06:12 UTC 2017 x86_64 x86_64
Alert Count                   5
First Seen                    2017-12-20 13:35:43 PST
Last Seen                     2017-12-20 13:35:46 PST
Local ID                      0e806a1d-c379-4c0e-993b-286c5828ef2b

Raw Audit Messages
type=AVC msg=audit(1513805746.614:968): avc:  denied  { listen } for  pid=1 comm="systemd" lport=6566 scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:unconfined_service_t:s0 tclass=tcp_socket permissive=0

Hash: systemd,init_t,unconfined_service_t,tcp_socket,listen

What am I missing?

Many thanks, -T