(Centos 8) SELinux preventing pdns_server from name_bind access on the udp_socket port (random high port)

• Program: Authoritative, pdns-ansible
• Issue type: Bug report

Short description

SELinux (permissive) complains that if enforcing it would not allow pdns_server to bind to the random high v4/v6 UDP query/notify sockets.

Environment

• Operating system: Centos 8 Stream
• Software version: pdns: pdns-4.3.1-1.el8, pdns-ansible: f0ac78c
• Software source: EPEL (pdns), github (pdns-ansible)

Steps to reproduce

1. use pdns-ansible to install pdns on CentOS 8
2. Selinux targeted/permissive or enforcing
3. Start pdns service

Expected behaviour

No SELinux complaints in journal

Actual behaviour

message in systemd journal:

SELinux is preventing /usr/sbin/pdns_server from name_bind access on the udp_socket port 12023

Other information

UPDATE: tracing the ansible run, .../tasks/selinux.yml is called and the 'allow pdns to bind to udp high ports' seport task is run but it seems not to have the desired effect.

From freenode/#selinux, a working solution seems to be something to the effect of:

echo '(allow pdns_t unreserved_port_type (udp_socket (name_bind)))' > mypdnsfix.cil && sudo semodule -i mypdnsfix.cil

I'm not sure how to refine that to limit the range to 10000-20000 as listed in selinux.yml

My Ansible-fu is not sufficiently strong to submit a PR at this time.

[SrX]

Seems to be the actual seport rule for ports 10000-20000 not helping, as pdns has access to unreserved ports, and is able to send a NOTIFY and listen for an answer.

Let's trace your case, the port that appears in the AVC (example: 12023) is labeled unreserved_port_t.

$ semanage port -l | grep unreserved_port_t

unreserved_port_t              sctp     1024-65535
unreserved_port_t              tcp      61000-65535, 1024-32767
unreserved_port_t              udp      61000-65535, 1024-32767

Unreserved_port_t belongs to port_type:

$ seinfo -t unreserved_port_t -x

Types: 1
   type unreserved_port_t, port_type, unreserved_port_type;

Query the actual allow rule for pdns_t and port_type:

$ sesearch -A -s pdns_t -t port_type -c udp_socket -p name_bind

allow pdns_t port_type:udp_socket name_bind;

I'll consider delete that seport rule, as it's not contributing to the functionality of pdns.