Home / server / Questions / 563872
In Process
savagecitizen
Asked: 2013-12-28 21:51:46 +0800 CST

SElinux: allow httpd to connect to a specific port

  • 772

My system is running CentOS 6.4 with apache2.2.15. SElinux is enforcing and I'm trying to connect to a local instance of redis through my python/wsgi app. I get Error 13, Permission denied. I could fix this via the command:

setsebool -P httpd_can_network_connect

However, I don't exactly want httpd to be able to connect to all tcp ports. How can I specify which ports/networks httpd is allowed to connect to? If I could make a module to allow httpd to connect to port 6379 ( redis ) or any tcp on 127.0.0.1, that would be preferable. Not sure why my paranoia is so strong on this, but hey...

Anyone know?

redhat apache-2.2 redis selinux

3 Answers

  1. By default, the SELinux policy will only allow services access to recognized ports associated with those services:

    # semanage port -l | egrep '(^http_port_t|6379)'
http_port_t                    tcp      80, 81, 443, 488, 8008, 8009, 8443, 9000
# curl http://localhost/redis.php
Cannot connect to redis server.

    - add Redis port (6379) to SELinux policy

    # semanage port -a -t http_port_t -p tcp 6379
# semanage port -l | egrep '(^http_port_t|6379)'
http_port_t                    tcp      6379, 80, 81, 443, 488, 8008, 8009, 8443, 9000
# curl http://localhost/redis.php
Connected successfully.

    You can also install setroubleshoot-server RPM and run: sealert -a /var/log/audit/audit.log - it will give you a nice report with useful suggestions (including command above).

    PHP script to test connection:

    # cat redis.php 
<?php

$redis=new Redis();
$connected= $redis->connect('127.0.0.1', 6379);

if(!$connected) {
        die( "Cannot connect to redis server.\n" );
}

echo "Connected successfully.\n";

?>
    • 60

  2. You may need to use

    semanage port -m -t http_port_t -p tcp 6379

    If semanage is missing then add the package policycoreutils-python

    yum install policycoreutils-python
    • 21

  3. You could temporary put selinux in permissive mode and let httpd connect to redis, then generate and build a custom policy module using audit2allow

    • 3