Note: This is a beta release of Red Hat Bugzilla 5.0. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Also email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback here.
Bug 1366968 - SELinux does not allow systemd to create a TCP/UDP socket on port 53 (DNS)
Summary: SELinux does not allow systemd to create a TCP/UDP socket on port 53 (DNS)
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 27
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: ---
Assignee: Lukas Vrabec
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
: 1372754 1399758 1483635 1528189 1528526 (view as bug list)
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-08-15 07:26 UTC by Victor Costan
Modified: 2018-04-11 07:33 UTC (History)
15 users (show)

Fixed In Version: selinux-policy-3.13.1-283.23.fc27
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2018-01-10 02:06:55 UTC


Attachments (Terms of Use)

Description Victor Costan 2016-08-15 07:26:42 UTC
Description of problem:
selinux is blocking systemd from creating a socket on port 53. I am using this to run skydns without giving it root privileges.

Version-Release number of selected component (if applicable):
selinux-policy.noarch 3.13.1-191.10.fc24
systemd.x86_64 229-12.fc24

How reproducible:
always on F24; this used to work on F23

Steps to Reproduce:
1. sudo dnf install skydns
2. sudo systemctl start skydns.socket
3. sudo systemctl status skydns.socket

Actual results:
● skydns.socket
   Loaded: loaded (/usr/lib/systemd/system/skydns.socket; enabled; vendor preset: disabled)
   Active: failed (Result: resources)
   Listen: 0.0.0.0:53 (Stream)
           0.0.0.0:53 (Datagram)

Aug 15 06:53:44 localhost.localdomain systemd[1]: skydns.socket: Failed to listen on sockets: Permission denied
Aug 15 06:53:44 localhost.localdomain systemd[1]: Failed to listen on skydns.socket.
Aug 15 06:53:44 localhost.localdomain systemd[1]: skydns.socket: Unit entered failed state.

Expected results:
systemd should be able to create the socket

Additional info:

> audit2allow -a -w
type=AVC msg=audit(1471244024.006:1043): avc:  denied  { create } for  pid=1 comm="systemd" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:unconfined_service_t:s0 tclass=tcp_socket permissive=0
        Was caused by:
                Missing type enforcement (TE) allow rule.

                You can use audit2allow to generate a loadable module to allow this access.


> audit2allow -a
#============= init_t ==============
allow init_t unconfined_service_t:tcp_socket create;

> cat /usr/lib/systemd/system/skydns.socket
[Socket]
ListenStream=0.0.0.0:53
ListenDatagram=0.0.0.0:53

[Install]
WantedBy=sockets.target

Comment 1 Victor Costan 2016-08-26 04:52:48 UTC
Can I do anything to help move this bug along?

Thank you very much!

Comment 2 Lukas Vrabec 2016-08-26 10:57:18 UTC
We need new policy for skydns package.

Comment 3 Petr Špaček 2017-01-23 17:04:57 UTC
I confirm this is still a problem. It also applies to knot-resolver package which has exactly the same problem.

Lukas, is there anything I can do to help you move this forward?

Comment 4 Petr Špaček 2017-01-23 17:11:53 UTC
For the record, here is output from audit2allow:

allow init_t unconfined_service_t:tcp_socket { bind create listen setopt };
allow init_t unconfined_service_t:udp_socket { bind create setopt };

I used following commands to produce it:
setenforce 0
systemctl start kresd.socket
dig @127.0.0.1 . NS

Comment 5 Antoine Martin 2017-05-21 15:06:21 UTC
Looks very similar to:
https://bugzilla.redhat.com/show_bug.cgi?id=1372754
https://bugzilla.redhat.com/show_bug.cgi?id=1399758
Could be related to:
https://bugzilla.redhat.com/show_bug.cgi?id=1343685

I don't understand the comment saying that a policy is needed.
This AVC happens in systemd, before any domain transition can be made.
Also, the administrator can change the port in ListenStream as they wish, so a policy can't possibly whitelist a specific port.
How do other packages do it?

Comment 6 Fedora End Of Life 2017-07-25 22:26:09 UTC
This message is a reminder that Fedora 24 is nearing its end of life.
Approximately 2 (two) weeks from now Fedora will stop maintaining
and issuing updates for Fedora 24. It is Fedora's policy to close all
bug reports from releases that are no longer maintained. At that time
this bug will be closed as EOL if it remains open with a Fedora  'version'
of '24'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version'
to a later Fedora version.

Thank you for reporting this issue and we are sorry that we were not
able to fix it before Fedora 24 is end of life. If you would still like
to see this bug fixed and are able to reproduce it against a later version
of Fedora, you are encouraged  change the 'version' to a later Fedora
version prior this bug is closed as described in the policy above.

Although we aim to fix as many bugs as possible during every release's
lifetime, sometimes those efforts are overtaken by events. Often a
more recent Fedora release includes newer upstream software that fixes
bugs or makes them obsolete.

Comment 7 Fedora End Of Life 2017-08-08 16:33:02 UTC
Fedora 24 changed to end-of-life (EOL) status on 2017-08-08. Fedora 24 is
no longer maintained, which means that it will not receive any further
security or bug fix updates. As a result we are closing this bug.

If you can reproduce this bug against a currently maintained version of
Fedora please feel free to reopen this bug against that version. If you
are unable to reopen this bug, please file a new report against the
current release. If you experience problems, please add a comment to this
bug.

Thank you for reporting this bug and we are sorry it could not be fixed.

Comment 8 Tomas Krizek 2018-01-05 09:19:18 UTC
This issue still affects knot-resolver in Fedora 27.

Comment 9 Lukas Vrabec 2018-01-05 13:52:39 UTC
*** Bug 1399758 has been marked as a duplicate of this bug. ***

Comment 10 Lukas Vrabec 2018-01-05 13:53:02 UTC
*** Bug 1528526 has been marked as a duplicate of this bug. ***

Comment 11 Lukas Vrabec 2018-01-05 13:54:02 UTC
*** Bug 1528189 has been marked as a duplicate of this bug. ***

Comment 12 Lukas Vrabec 2018-01-05 13:54:05 UTC
*** Bug 1483635 has been marked as a duplicate of this bug. ***

Comment 13 Lukas Vrabec 2018-01-05 13:55:07 UTC
*** Bug 1372754 has been marked as a duplicate of this bug. ***

Comment 14 Petr Špaček 2018-01-05 14:02:35 UTC
Please note that DNS servers need to listed on UDP and TCP ports at once.

Comment 15 Fedora Update System 2018-01-05 14:46:20 UTC
selinux-policy-3.13.1-283.21.fc27 has been submitted as an update to Fedora 27. https://bodhi.fedoraproject.org/updates/FEDORA-2018-0d8506aba4

Comment 16 Fedora Update System 2018-01-05 14:49:11 UTC
selinux-policy-3.13.1-283.21.fc27 has been submitted as an update to Fedora 27. https://bodhi.fedoraproject.org/updates/FEDORA-2018-0d8506aba4

Comment 17 Fedora Update System 2018-01-06 21:08:45 UTC
selinux-policy-3.13.1-283.21.fc27 has been pushed to the Fedora 27 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-0d8506aba4

Comment 18 Tomas Krizek 2018-01-08 09:24:48 UTC
selinux-policy-3.13.1-283.21.fc27 only allows TCP. UDP still doesn't work.

type=AVC msg=audit(1515403081.502:412): avc:  denied  { create } for  pid=1 comm="systemd" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:unconfined_service_t:s0 tclass=udp_socket permissive=0

Comment 19 Lukas Vrabec 2018-01-08 12:37:00 UTC
Tomas, 

Thanks, I overlooked it. It will be fixed in -23.fc27 release. 

Lukas.

Comment 20 Fedora Update System 2018-01-10 02:06:55 UTC
selinux-policy-3.13.1-283.21.fc27 has been pushed to the Fedora 27 stable repository. If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.