Samba が RHEL7 上の hi-reserved ポートにアクセスしているという SElinux の警告

Issue

以下が監査ログに記録されます。

type=AVC msg=audit(1477868191.022:45744): avc:  denied  { name_bind } for  pid=60347 comm="smbd" src=739 scontext=system_u:system_r:smbd_t:s0 tcontext=system_u:object_r:hi_reserved_port_t:s0 tclass=udp_socket
type=SYSCALL msg=audit(1477868191.022:45744): arch=c000003e syscall=49 success=no exit=-13 a0=29 a1=7ffdb81ccdd0 a2=10 a3=58167a9f items=0 ppid=1510 pid=60347 auid=4294967295 uid=48 gid=0 euid=48 suid=0 fsuid=48 egid=48 sgid=0 fsgid=48 tty=(none) ses=4294967295 comm="smbd" exe="/usr/sbin/smbd" subj=system_u:system_r:smbd_t:s0 key=(null)
type=AVC msg=audit(1477868191.043:45745): avc:  denied  { name_bind } for  pid=60347 comm="smbd" src=740 scontext=system_u:system_r:smbd_t:s0 tcontext=system_u:object_r:hi_reserved_port_t:s0 tclass=udp_socket
type=SYSCALL msg=audit(1477868191.043:45745): arch=c000003e syscall=49 success=no exit=-13 a0=29 a1=7ffdb81ccdd0 a2=10 a3=3d items=0 ppid=1510 pid=60347 auid=4294967295 uid=48 gid=0 euid=48 suid=0 fsuid=48 egid=48 sgid=0 fsgid=48 tty=(none) ses=4294967295 comm="smbd" exe="/usr/sbin/smbd" subj=system_u:system_r:smbd_t:s0 key=(null)
type=AVC msg=audit(1477868193.266:45746): avc:  denied  { name_bind } for  pid=60347 comm="smbd" src=741 scontext=system_u:system_r:smbd_t:s0 tcontext=system_u:object_r:hi_reserved_port_t:s0 tclass=udp_socket
type=SYSCALL msg=audit(1477868193.266:45746): arch=c000003e syscall=49 success=no exit=-13 a0=2f a1=7ffdb81ccdd0 a2=10 a3=3d items=0 ppid=1510 pid=60347 auid=4294967295 uid=48 gid=0 euid=48 suid=0 fsuid=48 egid=48 sgid=0 fsgid=48 tty=(none) ses=4294967295 comm="smbd" exe="/usr/sbin/smbd" subj=system_u:system_r:smbd_t:s0 key=(null)
type=AVC msg=audit(1477868196.273:45747): avc:  denied  { name_bind } for  pid=60347 comm="smbd" src=742 scontext=system_u:system_r:smbd_t:s0 tcontext=system_u:object_r:hi_reserved_port_t:s0 tclass=udp_socket

以下は smbd の strace ログからのものです。

14:00:42 bind(28, {sa_family=AF_INET, sin_port=htons(909), sin_addr=inet_addr("0.0.0.0")}, 16)=-1 EACCES (Permission denied)
14:00:42 setsockopt(28, SOL_IP, IP_RECVERR, [1], 4)=0
4:00:42 recvfrom(28, "x20x12xecx72x00x00x00x01x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00", 400, MSG_DONTWAIT, {sa_family=AF_INET, sin_port=htons(111), sin_addr=inet_addr("10.68.217.30")}, [16])=28


14:00:36 bind(28, {sa_family=AF_INET, sin_port=htons(908), sin_addr=inet_addr("0.0.0.0")}, 16)=-1 EACCES (Permission denied)
14:00:36 setsockopt(28, SOL_IP, IP_RECVERR, [1], 4)=0
14:00:36 sendto(28, "x42xb8x02xabx00x00x00x00x00x00x00x02x00x01x86xa0x00x00x00x02x00x00x00x03x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x01x86xabx00x00x00x01x00x00x00x11x00x00x00x00", 56, 0, {sa_family=AF_INET, sin_port=htons(111), sin_addr=inet_addr("10.68.217.26")}, 16)=56

14:00:42 bind(28, {sa_family=AF_INET, sin_port=htons(909), sin_addr=inet_addr("0.0.0.0")}, 16)=-1 EACCES (Permission denied)
14:00:42 setsockopt(28, SOL_IP, IP_RECVERR, [1], 4)=0
14:00:42 sendto(28, "x20x12xecx72x00x00x00x00x00x00x00x02x00x01x86xa0x00x00x00x02x00x00x00x03x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x01x86xabx00x00x00x01x00x00x00x11x00x00x00x00", 56, 0, {sa_family=AF_INET, sin_port=htons(111), sin_addr=inet_addr("10.68.217.30")}, 16)=56
14:00:42 poll([{fd=28, events=POLLIN}], 1, 5000)=1 ([{fd=28, revents=POLLIN}])
14:00:42 recvfrom(28, "x20x12xecx72x00x00x00x01x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00", 400, MSG_DONTWAIT, {sa_family=AF_INET, sin_port=htons(111), sin_addr=inet_addr("10.68.217.30")}, [16])=28
14:00:42 close(28)                     =0
14:00:42 getegid()                     =48