Project

General

Profile

Bug #9407

memcached plugin not working with selinux enabled

Added by Gerwin Krist over 3 years ago. Updated 3 months ago.

Status:
Closed
Priority:
Normal
Assignee:
Category:
Plugins
Target version:
Difficulty:
easy
Triaged:
Bugzilla link:
Team Backlog:
Fixed in Releases:
Found in Releases:

Description

The memcached plugin is not working because passenger is not allowed to connect memcache_port_t

Reproduce:
  • Just install the ruby193-rubygem-foreman_memcache package and configure it to localhost
  • login on Foreman
Result:
  • In production log: DalliError: No server available
  • selinux logs: ruby system_u:system_r:passenger_t:s0 42 tcp_socket name_connect system_u:object_r:memcache_port_t:s0 denied 16180

Solutions

  1. setsebool -P passenger_can_connect_all=on (personally my last resort solution)
  2. Create a selinux module (See below)
module passenger_can_connect_memcache 1.0;

require {
        type passenger_t;
        type memcache_port_t;
        class tcp_socket name_connect;
}

#============= passenger_t ==============

#!!!! This avc can be allowed using the boolean 'passenger_can_connect_all'
allow passenger_t memcache_port_t:tcp_socket name_connect;

Related issues

Related to SELinux - Bug #9772: selinux should enable memcache pluginDuplicate2015-03-15

Associated revisions

Revision 128e06fe (diff)
Added by Sean O'Keeffe 9 months ago

Fixes #9407 - add Foreman Memcache support

History

#1 Updated by Dominic Cleal over 3 years ago

  • Project changed from Foreman to SELinux
  • Category changed from 56 to Plugins

#2 Updated by The Foreman Bot 9 months ago

  • Assignee set to Sean O'Keeffe
  • Status changed from New to Ready For Testing
  • Pull request https://github.com/theforeman/foreman-selinux/pull/76 added

#3 Updated by Anonymous 9 months ago

  • % Done changed from 0 to 100
  • Status changed from Ready For Testing to Closed

#4 Updated by Lukas Zapletal 5 months ago

  • Legacy Backlogs Release (now unused) set to 330

#5 Updated by Lukas Zapletal 4 months ago

  • Related to Bug #9772: selinux should enable memcache plugin added

#6 Updated by Anonymous 3 months ago

  • Target version deleted (1.18.0)

Also available in: Atom PDF