Hi,
it seems as if something broke my selinux. Not sure what it was as it ran perfectly a couple of days ago - I suspect some update of the selinux-policies. Now some services (httpd, php-fpm…) are refusing to start with selinux in enforcing mode.
Example httpd: My httpd is running on port 80 and 444 because of sslh. This is suspicious for selinux and I had a custom rule which I generated the following way:
I restarted the service waiting for the audit messages to appear in syslog. Now I ran these commands:
journalctl --no-pager --since today | grep httpd | audit2allow -M httpd
semodule -i httpd.pp
The rule was applied successfully and httpd was working as expected.
Suddenly it seems as if has everything forgotten. I even can’t set up new rules because semodule fails with
Failed to resolve typeattributeset statement at /var/lib/selinux/targeted/tmp/modules/400/async8/cil:3
Using /usr/libexec/selinux/hll/pp to examine the generated pp shows me this:
(typeattributeset cil_gen_require amqp_port_t)
(typeattributeset cil_gen_require trisoap_port_t)
(typeattributeset cil_gen_require ntop_port_t)
(typeattributeset cil_gen_require apcupsd_port_t)
(typeattributeset cil_gen_require unreserved_port_t)
(typeattributeset cil_gen_require reserved_port_t)
(typeattributeset cil_gen_require munin_t)
(typeattributeset cil_gen_require fmpro_internal_port_t)
(typeattributeset cil_gen_require websm_port_t)
(typeattributeset cil_gen_require httpd_sys_content_t)
(typeattributeset cil_gen_require traceroute_port_t)
(typeattributeset cil_gen_require pop_port_t)
(typeattributeset cil_gen_require asterisk_port_t)
(typeattributeset cil_gen_require amanda_port_t)
(typeattributeset cil_gen_require rtp_media_port_t)
(typeattributeset cil_gen_require dnssec_t)
(typeattributeset cil_gen_require gds_db_port_t)
(typeattributeset cil_gen_require httpd_t)
(typeattributeset cil_gen_require rndc_port_t)
(allow httpd_t amanda_port_t (udp_socket (name_bind)))
(allow httpd_t amqp_port_t (udp_socket (name_bind)))
(allow httpd_t apcupsd_port_t (udp_socket (name_bind)))
(allow httpd_t asterisk_port_t (udp_socket (name_bind)))
(allow httpd_t dnssec_t (file (getattr open read)))
(allow httpd_t fmpro_internal_port_t (udp_socket (name_bind)))
(allow httpd_t gds_db_port_t (udp_socket (name_bind)))
(allow httpd_t httpd_sys_content_t (dir (add_name write)))
(allow httpd_t httpd_sys_content_t (file (append create setattr write)))
(allow httpd_t ntop_port_t (tcp_socket (name_connect)))
(allow httpd_t pop_port_t (tcp_socket (name_connect)))
(allow httpd_t reserved_port_t (tcp_socket (name_bind)))
(allow httpd_t rndc_port_t (tcp_socket (name_connect)))
(allow httpd_t rtp_media_port_t (udp_socket (name_bind)))
(allow httpd_t self (process (execmem)))
(allow httpd_t traceroute_port_t (udp_socket (name_bind)))
(allow httpd_t trisoap_port_t (udp_socket (name_bind)))
(allow httpd_t unreserved_port_t (udp_socket (name_bind)))
(allow httpd_t websm_port_t (tcp_socket (name_connect)))
(allow munin_t httpd_sys_content_t (dir (add_name remove_name setattr write)))
(allow munin_t httpd_sys_content_t (file (create getattr ioctl open read setattr unlink write)))
It seems as if he has forgotten what ntop_port_t is?
Similar things for php-fpm:
Failed to resolve typeattributeset statement at /var/lib/selinux/targeted/tmp/modules/400/async8/cil:3
(typeattributeset cil_gen_require httpd_sys_content_t)
(typeattributeset cil_gen_require httpd_t)
(typeattributeset cil_gen_require pop_port_t)
(allow httpd_t httpd_sys_content_t (dir (add_name write)))
(allow httpd_t httpd_sys_content_t (file (append create setattr write)))
(allow httpd_t pop_port_t (tcp_socket (name_connect)))
(allow httpd_t self (process (execmem)))
Now here pop_port_t is the problem?
I don’t know what is wrong here. Has anything changed to selinux port rules? How can I get my rules back?