SELinux prevent connection clamd_port_t:tcp_socket

MAAN SHARBAJI

1/22/23, 9:57 AM

We have API Server (tomcat) which has clamAV configuration to scan any uploaded file to the system.

clamAV configuration will require the API server to connect to clamAV server.

SELinux is enabled on both servers and whenever we try to upload files we get the following error/exception:

tomcat: java.net.socketexception permission denied (connect failed)

This error is related to SELinux, and here the audit log for this denial:

type=AVC msg=audit(1632293242.892:403): avc:  denied  { name_connect } for  pid=2663 comm="http-nio-8780-e" dest=3310 scontext=system_u:system_r:tomcat_t:s0 tcontext=system_uSmiley Surprisedbject_r:clamd_port_t:s0 tclass=tcp_socket permissive=0

    Was caused by:
        Missing type enforcement (TE) allow rule.

        You can use audit2allow to generate a loadable module to allow this access.

We solved this by creating SELinux custom policy using Audit2Allow command.

But, we need to know if there is any other way to solve this using SELinux Booleans or any label change we can apply.

Could you please advise ?

Thanks

0 + 0

linux

selinux

clamav

tomcat8

Score:0

Server

Michael Hampton

1/22/23, 1:23 PM

If there was another way then audit2why would have told you about it.

You can also try the sealert tool which will show recent SELinux denials and provide detailed information.

0 + 0

MAAN SHARBAJI

1/22/23, 3:03 PM

audit2why told that: Missing type enforcement (TE) allow rule. You can use audit2allow to generate a loadable module to allow this access.

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: SELinux prevent connection clamd_port_t:tcp_socket

TH: SELinux ป้องกันการเชื่อมต่อ clamd_port_t:tcp_socket

RO: SELinux împiedică conexiunea clamd_port_t:tcp_socket

RU: SELinux предотвращает подключение clamd_port_t:tcp_socket

VI: SELinux ngăn chặn kết nối clashd_port_t:tcp_socket

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.