Foreman » SELinux

That's unlikely to be Foreman, all it shows is that the context is passenger_t. It's more likely to be Passenger itself (prestart) when using an old Rack-based master.

Hi Lukas,

As I hit that issue in Katello 3.1/Foreman 1.12.4 and Satellite 6.2.4, too, I wanted to give a hint to anyone else how to resolv this. Even that everything seemed to work as expected but one never knows. I hope that helps.

1.) One way would be to allow Passenger to connect to all ports, but that's not what I wanted. Just enable the following boolean if that's OK for you:

# getsebool passenger_can_connect_all
passenger_can_connect_all --> off

2.) The other way that worked for me was to create a custom selinux module to allow Passenger the connection with tcp/8140.

# cat allow_passenger_puppet_port.te

module allow_passenger_puppet_port 1.0;

require {
        type puppet_port_t;
        type passenger_t;
        class tcp_socket name_connect;
}

#============= passenger_t ==============

#!!!! This avc is allowed in the current policy
allow passenger_t puppet_port_t:tcp_socket name_connect;

Best regards

I also ran into this issue with my Katello 3.1 installation.

Rather than granting all port access, I used semanage to label the requested port to something passenger could connect to.

semanage port -m -t http_port_t -p tcp 8140