| 1 |
On Wed, 21 Nov 2007 15:46:03 +1100 |
| 2 |
Andrew Ross <aross@g.o> wrote: |
| 3 |
|
| 4 |
> Will Keaney wrote: |
| 5 |
> > I've just finished updating my SELinux VM, but still get a lot of |
| 6 |
> > avc denials in /var/log/syslog. What is the recommended method of |
| 7 |
> > changing the SELinux policy? I seem to remember PeBenito saying in |
| 8 |
> > IRC that editing the policy files directly is not recommended. |
| 9 |
> |
| 10 |
> > avc: denied { name_bind } for pid=5164 comm="sshd" src=2222 |
| 11 |
> > scontext=system_u:system_r:sshd_t tcontext=system_u:object_r:port_t |
| 12 |
> > tclass=tcp_socket |
| 13 |
> |
| 14 |
> I'm new to SELinux myself, but I'm almost certain I can be of help |
| 15 |
> here. |
| 16 |
> |
| 17 |
> You've configured sshd to listen on port 2222 instead of the default |
| 18 |
> 22, but SELinux policy states that sshd can only bind to ports |
| 19 |
> labelled with the type ssh_port_t. The semanage command can be used |
| 20 |
> to adjust port labels e.g. |
| 21 |
> |
| 22 |
> semanage port -a -t ssh_port_t -p tcp 2222 |
| 23 |
> |
| 24 |
> Cheers |
| 25 |
> |
| 26 |
> Andrew |
| 27 |
> |
| 28 |
AH! Thank you so very much. I hadn't gotten down to resolving that |
| 29 |
part yet, but your information will save me a great deal of time. |
| 30 |
|
| 31 |
Will |
Archives