keepalived is denied name_connect to port 3306 (mysqld_port_t).

Issue

• keepalived is denied name_connect to port 3306 (mysqld_port_t) where it tries to connect the port for healthcheck purpose.

        TCP_CHECK {
          connect_port 3306  <<<<<<<<<<<<<<<<<<<<<<<<<<<<<
          connect_timeout 30
          nb_get_retry 3
          delay_before_retry 3
        }

• The following avc denial log message is observed in /var/log/audit/audit.log:

type=AVC msg=audit(1452239091.518:28180): avc:  denied  { name_connect } for  pid=8352 comm="keepalived" dest=3306 scontext=unconfined_u:system_r:keepalived_t:s0 tcontext=system_u:object_r:mysqld_port_t:s0 tclass=tcp_socket
type=SYSCALL msg=audit(1452239091.518:28180): arch=x86_64 syscall=connect success=no exit=EINPROGRESS a0=8 a1=175e860 a2=80 a3=7fffc13b62f0 items=0 ppid=8351 pid=8352 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4378 comm=keepalived exe=/usr/sbin/keepalived subj=unconfined_u:system_r:keepalived_t:s0 key=(null)

• It should like to be allowed for keepalived to perform name_connect to any optional ports including 3306 specified in TCP_CHECK in keepalived.conf.

KEEPALIVED.CONF(5)

[...]

 #TCP healthchecker (bind to IP port)
 TCP_CHECK
 {
     # ======== generic connection options
     # Optional IP address to connect to.
     # The default is real server’s IP
     connect_ip <IP ADDRESS>
     # Optional port to connect to if not
     # The default is real server’s port
     connect_port <PORT>
     # Optional interface to use to
     # originate the connection
     bindto <IP ADDRESS>
     # Optional source port to
     # originate the connection from
     bind_port <PORT>
     # Optional connection timeout in seconds.
     # The default is 5 seconds
     connect_timeout <INTEGER>
     # Optional fwmark to mark all outgoing
     # checker pakets with
     fwmark <INTEGER>

     # Optional random delay to begin initial check for
     # maximum N seconds.
     # Useful to scatter multiple simultaneous
     # checks to the same RS. Enabled by default, with
     # the maximum at delay_loop. Specify 0 to disable
     warmup <INT>
 } #TCP_CHECK

[...]