Dear Maintainer,

When I fix the NFS ports to allow firewalling of NFS Services
SELinux prevents rpc.statd or rpc.mountd starting.

Aug 15 12:31:34 deb12 rpc.statd[811]: Version 2.6.2 starting
Aug 15 12:31:34 deb12 rpc.statd[811]: Flags: TI-RPC
Aug 15 12:31:34 deb12 rpc.statd[811]: Could not bind socket: (13) Permission denied
Aug 15 12:31:34 deb12 rpc.statd[811]: Could not bind socket: (13) Permission denied
Aug 15 12:31:34 deb12 rpc.statd[811]: Could not bind socket: (13) Permission denied
Aug 15 12:31:34 deb12 rpc.statd[811]: Could not bind socket: (13) Permission denied
Aug 15 12:31:34 deb12 rpc.statd[811]: failed to create RPC listeners, exiting
.
.
Aug 15 12:31:34 deb12 systemd[1]: rpc-statd.service: Control process exited, code=exited, status=1/FAILURE
Aug 15 12:31:23 deb12 systemd[1]: Mounted run-rpc_pipefs.mount - RPC Pipe File System.
Aug 15 12:31:24 deb12 systemd[1]: Starting nfs-mountd.service - NFS Mount Daemon...
Aug 15 12:31:24 deb12 rpc.mountd[758]: Could not bind socket: (13) Permission denied
Aug 15 12:31:24 deb12 rpc.mountd[758]: Could not bind socket: (13) Permission denied
.
Aug 15 12:31:24 deb12 rpc.mountd[758]: mountd: No V2 or V3 listeners created!
Aug 15 12:31:24 deb12 rpc.mountd[760]: Version 2.6.2 starting
Aug 15 12:31:24 deb12 systemd[1]: Started nfs-mountd.service - NFS Mount Daemon.

I get a bit further if I set these ports in nfs_port_t:

semanage  port -l | grep nfs
nfs_port_t                     tcp      4003, 4002, 4001, 2049
nfs_port_t                     udp      4003, 4002, 4001, 2049

And I have applied:
setsebool -P nfs_export_all_rw 1

I now get mountd to start but statd is still failing..

Aug 15 16:29:33 deb12 rpc.statd[695]: Could not bind socket: (13) Permission denied

Also opened this upstream but not sure if an upstream issue, that
was probably the wrong thing to do:
https://github.com/SELinuxProject/refpolicy/issues/629

This all works fine in permissive mode and there is nothing reported by audit2allow on the
log file.

Thanks

Colin Simpson

Please run "semodule -DB" and then reproduce the problem, the -D option means
to remove dontaudit rules and the -B option means to rebuild the policy that
is loaded into the kernel.  After that you will get lots of messages you
previously didn't get and you can grep /var/log/audit/audit.log for the
relevant ones.

I ran something similar for the upstream report. 

Okay audit2allow now says:
#============= rpcd_t ==============
allow rpcd_t nfs_port_t:tcp_socket name_bind;
allow rpcd_t nfs_port_t:udp_socket name_bind;
allow rpcd_t nfsd_fs_t:dir search;
allow rpcd_t nfsd_fs_t:file { open read };

Or the raw log if that's more what you want:
type=AVC msg=audit(1692348946.100:70): avc: denied { name_bind } for
pid=687 comm="rpc.statd" src=4001 scontext=system_u:system_r:rpcd_t:s0
tcontext=system_u:object_r:nfs_port_t:s0 tclass=udp_socket permissive=0
type=SYSCALL msg=audit(1692348946.100:70): arch=c000003e syscall=49
success=no exit=-13 a0=8 a1=55ac43c8da00 a2=10 a3=7ffdfc06cff0 items=0
ppid=681 pid=687 auid=4294967295 uid=116 gid=65534 euid=116 suid=116
fsuid=116 egid=65534 sgid=65534 fsgid=65534 tty=(none) ses=4294967295
comm="rpc.statd" exe="/usr/sbin/rpc.statd"
subj=system_u:system_r:rpcd_t:s0 key=(null)ARCH=x86_64 SYSCALL=bind
AUID="unset" UID="statd" GID="nogroup" EUID="statd" SUID="statd"
FSUID="statd" EGID="nogroup" SGID="nogroup" FSGID="nogroup"
type=PROCTITLE msg=audit(1692348946.100:70):
proctitle="/sbin/rpc.statd"
type=AVC msg=audit(1692348946.100:71): avc: denied { name_bind } for
pid=687 comm="rpc.statd" src=4001 scontext=system_u:system_r:rpcd_t:s0
tcontext=system_u:object_r:nfs_port_t:s0 tclass=tcp_socket permissive=0
type=SYSCALL msg=audit(1692348946.100:71): arch=c000003e syscall=49
success=no exit=-13 a0=8 a1=55ac43c8da00 a2=10 a3=7ffdfc06cff0 items=0
ppid=681 pid=687 auid=4294967295 uid=116 gid=65534 euid=116 suid=116
fsuid=116 egid=65534 sgid=65534 fsgid=65534 tty=(none) ses=4294967295
comm="rpc.statd" exe="/usr/sbin/rpc.statd"
subj=system_u:system_r:rpcd_t:s0 key=(null)ARCH=x86_64 SYSCALL=bind
AUID="unset" UID="statd" GID="nogroup" EUID="statd" SUID="statd"
FSUID="statd" EGID="nogroup" SGID="nogroup" FSGID="nogroup"
type=PROCTITLE msg=audit(1692348946.100:71):
proctitle="/sbin/rpc.statd"
type=AVC msg=audit(1692348946.100:72): avc: denied { name_bind } for
pid=687 comm="rpc.statd" src=4001 scontext=system_u:system_r:rpcd_t:s0
tcontext=system_u:object_r:nfs_port_t:s0 tclass=udp_socket permissive=0
type=SYSCALL msg=audit(1692348946.100:72): arch=c000003e syscall=49
success=no exit=-13 a0=8 a1=55ac43c8f080 a2=1c a3=7ffdfc06cff0 items=0
ppid=681 pid=687 auid=4294967295 uid=116 gid=65534 euid=116 suid=116
fsuid=116 egid=65534 sgid=65534 fsgid=65534 tty=(none) ses=4294967295
comm="rpc.statd" exe="/usr/sbin/rpc.statd"
subj=system_u:system_r:rpcd_t:s0 key=(null)ARCH=x86_64 SYSCALL=bind
AUID="unset" UID="statd" GID="nogroup" EUID="statd" SUID="statd"
FSUID="statd" EGID="nogroup" SGID="nogroup" FSGID="nogroup"
type=PROCTITLE msg=audit(1692348946.100:72):
proctitle="/sbin/rpc.statd"
type=AVC msg=audit(1692348946.100:73): avc: denied { name_bind } for
pid=687 comm="rpc.statd" src=4001 scontext=system_u:system_r:rpcd_t:s0
tcontext=system_u:object_r:nfs_port_t:s0 tclass=tcp_socket permissive=0
type=SYSCALL msg=audit(1692348946.100:73): arch=c000003e syscall=49
success=no exit=-13 a0=8 a1=55ac43c8f080 a2=1c a3=7ffdfc06cff0 items=0
ppid=681 pid=687 auid=4294967295 uid=116 gid=65534 euid=116 suid=116
fsuid=116 egid=65534 sgid=65534 fsgid=65534 tty=(none) ses=4294967295
comm="rpc.statd" exe="/usr/sbin/rpc.statd"
subj=system_u:system_r:rpcd_t:s0 key=(null)ARCH=x86_64 SYSCALL=bind
AUID="unset" UID="statd" GID="nogroup" EUID="statd" SUID="statd"
FSUID="statd" EGID="nogroup" SGID="nogroup" FSGID="nogroup"
type=PROCTITLE msg=audit(1692348946.100:73):
proctitle="/sbin/rpc.statd"
type=SERVICE_START msg=audit(1692348946.100:74): pid=1 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0
msg='unit=rpc-statd comm="systemd" exe="/usr/lib/systemd/systemd"
hostname=? addr=? terminal=? res=failed'UID="root" AUID="unset"
type=SERVICE_START msg=audit(1692348946.184:85): pid=1 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0
msg='unit=rpc-statd-notify comm="systemd"
exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=?
res=success'UID="root" AUID="unset" undefinedundefined

# sesearch -A -s rpcd_t -c tcp_socket -p name_bind
allow nsswitch_domain port_t:tcp_socket name_bind; [ allow_ypbind ]:True
allow rpc_domain port_t:tcp_socket name_bind;
allow rpc_domain reserved_port_t:tcp_socket name_bind;
allow rpc_domain rpc_port_type:tcp_socket name_bind;
# sesearch -A -s rpcd_t -c udp_socket -p name_bind
allow nsswitch_domain port_t:udp_socket name_bind; [ allow_ypbind ]:True
allow rpc_domain port_t:udp_socket name_bind;
allow rpc_domain rpc_port_type:udp_socket name_bind;
# seinfo -a rpc_domain -x

Type Attributes: 1
   attribute rpc_domain;
	blkmapd_t
	gssd_t
	nfsd_t
	rpcd_t


The above commands show that the domains for RPC can bind to the rpc_port_type
types.  The command "seinfo -a rpc_port_type -x" shows a large list of types
that those domains can bind to.  Which is probably more than desired and also
threre isn't one for just this purpose.

What we probably need is a new type for this sort of thing and reserving a few
ports for it.  Are there good ports that can be used for such things?