Issue

• In Satellite, SELinux is blocking the web console by default:

[root@example foreman]# sealert -a /var/log/audit/audit.log
100% done'list' object has no attribute 'split'
100% done

found 1 alerts in /var/log/audit/audit.log

SELinux is preventing /usr/bin/python2.7 from name_connect access on the tcp_socket port 35596.

***** Plugin catchall (100. confidence) suggests **************************

• python2.7 should be allowed name_connect access on the port 35596 tcp_socket by default.

• Generate a local policy module to allow this access.

• Allow this access by executing:

# grep websockify.py /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp


* Additional Information:

Source Context                system_u:system_r:websockify_t:s0
Target Context                system_u:object_r:ephemeral_port_t:s0
Target Objects                port 35596 [ tcp_socket ]
Source                        websockify.py
Source Path                   /usr/bin/python2.7
Port                          35596
Host                          <Unknown>
Source RPM Packages           python-2.7.5-34.el7.x86_64
Target RPM Packages           
Policy RPM                    selinux-policy-3.13.1-60.el7.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Permissive
Host Name                     dantooine.outerrim.lan
Platform                      Linux dantooine.outerrim.lan
                              3.10.0-327.3.1.el7.x86_64 #1 SMP Fri Nov 20
                              05:40:26 EST 2015 x86_64 x86_64
Alert Count                   3
First Seen                    2016-03-05 23:41:59 CET
Last Seen                     2016-03-05 23:42:30 CET
Local ID                      cfd738f2-88ee-4c46-b1fe-27c4ab2f1b16

Raw Audit Messages
type=AVC msg=audit(1457217750.249:33170): avc:  denied  { name_connect } for  pid=21030 comm="websockify.py" dest=35596 scontext=system_u:system_r:websockify_t:s0 tcontext=system_u:object_r:ephemeral_port_t:s0 tclass=tcp_socket


type=SYSCALL msg=audit(1457217750.249:33170): arch=x86_64 syscall=connect success=no exit=EACCES a0=7 a1=7ffea85a06e0 a2=10 a3=1 items=0 ppid=21029 pid=21030 auid=4294967295 uid=996 gid=995 euid=996 suid=996 fsuid=996 egid=995 sgid=995 fsgid=995 tty=(none) ses=4294967295 comm=websockify.py exe=/usr/bin/python2.7 subj=system_u:system_r:websockify_t:s0 key=(null)

Hash: websockify.py,websockify_t,ephemeral_port_t,tcp_socket,name_connect

- SELinux policy created :

module webconsole 1.0;

require {
        type ephemeral_port_t;
        type websockify_t;
        class tcp_socket name_connect;
}


#============= websockify_t ==============
allow websockify_t ephemeral_port_t:tcp_socket name_connect;

• Shouldn't this policy be included???