Uploaded image for project: 'JBoss Web Server'
  1. JBoss Web Server
  2. JWS-819

SELinux denies name_connect to mssql_port_t for tomcat_t

    XMLWordPrintable

Details

    • Bug
    • Resolution: Done
    • Major
    • JWS 5.0_RHEL DR1
    • JWS 3.1.0 GA
    • selinux, tomcat
    • None

    Description

      +++ This bug was initially created as a clone of Bug #1484572 +++
      SELinux is denying tomcat from connecting to Microsoft SQL Server on port 1433, with the following AVC denial in /var/log/audit.log

      type=AVC msg=audit(1503434074.102:50305): avc:  denied  { name_connect } for  pid=4488 comm="java" dest=1433 scontext=system_u:system_r:tomcat_t:s0 tcontext=system_u:object_r:mssql_port_t:s0 tclass=tcp_socket
      

      This worked without issue in previous versions of the targeted policy.

      Version-Release number of selected component (if applicable):

      • selinux-policy-targeted-3.13.1-166.el7.noarch
      • RHEL 7.4

      How reproducible:
      Always

      Steps to Reproduce:
      1. Create a new RHEL 7.4 machine
      2. yum install tomcat; systemctl start tomcat.service
      3. Install a tomcat application that will connect to an existing MS SQL server.

      Actual results:
      AVC denial

      Expected results:
      A successful connection, like previous versions of the policy.

      Attachments

        Issue Links

          Activity

            People

              rhn-support-csutherl Coty Sutherland
              rhn-support-csutherl Coty Sutherland
              Jan Onderka Jan Onderka
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: