Discussion:
getting "BindException: permission denied" exception when trying to change port 8080 to 8090
Alceu R. de Freitas Jr.
2017-12-21 18:36:15 UTC
Permalink
Hello folks,
I'm new to this list, and to Tomcat as well.
I was trying to get Jenkins and Tomcat running on the same VM that I have (with CentOS 7), but I'm struggling with a small issue.
Since I already had Jenkins running on port number 8080, I decided to change Tomcat to listen to 8090 by editing /etc/tomcat/server.xml, in the following line:
<Connector port="8080" protocol="HTTP/1.1"
               connectionTimeout="20000"
               redirectPort="8443" />

And the change:
<Connector port="8090" protocol="HTTP/1.1"
               connectionTimeout="20000"
               redirectPort="8443" />

I soon as I started, I got "BindException: permission denied" exception on the catalina log file. If I stop Jenkins daemon and change it back to 8080, it works as expected.
I even tried to put port number "17777", but results were the same. I checked out ports in use with netstat, firewall configuration... I got nothing.
Since I was able to change Jenkins to run on 8090, I'm clueless what is happening over there. It seems CentOS is happy letting applications to bind to 8080 and 8090, so I'm quite curious why things are not working with Tomcat...
Thanks!
Christopher Schultz
2017-12-21 19:34:28 UTC
Permalink
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Alceu,
Hello folks, I'm new to this list, and to Tomcat as well. I was
trying to get Jenkins and Tomcat running on the same VM that I have
(with CentOS 7), but I'm struggling with a small issue. Since I
already had Jenkins running on port number 8080, I decided to
change Tomcat to listen to 8090 by editing /etc/tomcat/server.xml,
in the following line: <Connector port="8080" protocol="HTTP/1.1"
connectionTimeout="20000" redirectPort="8443" />
And the change: <Connector port="8090" protocol="HTTP/1.1"
connectionTimeout="20000" redirectPort="8443" />
I soon as I started, I got "BindException: permission denied"
exception on the catalina log file. If I stop Jenkins daemon and
change it back to 8080, it works as expected. I even tried to put
port number "17777", but results were the same. I checked out ports
in use with netstat, firewall configuration... I got nothing. Since
I was able to change Jenkins to run on 8090, I'm clueless what is
happening over there. It seems CentOS is happy letting applications
to bind to 8080 and 8090, so I'm quite curious why things are not
working with Tomcat...
I've never seem "BindException: permission denied" when the port
number is above 1024. Are you sure it's the connector port (e.g. 8090)
it's complaining about?

When you try your "other applications" test, are you sure you are
running as the same effective user as the Tomcat process?

- -chris
-----BEGIN PGP SIGNATURE-----
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iQJRBAEBCAA7FiEEMmKgYcQvxMe7tcJcHPApP6U8pFgFAlo8DMMdHGNocmlzQGNo
cmlzdG9waGVyc2NodWx0ei5uZXQACgkQHPApP6U8pFjxhRAAkkjaL042wtvpQp7G
hcGU8P3Tc8ePfMLjUrwvoRsLGHxAdt4lRF64wm/l9XqTfIDYVXPRRF4kDxHShiFL
ifbNRgYhOVdpmh9J/8oI2iVEW+xKU4edV4sGY+KCr0kAKKk1kno1uASKLH7NKMeV
q9PjKsXfWw5m2uvvyaHxGiHdFG7IGMtxxol/GSwkYWDIiJIiMONg4i3867zhZJce
1/QOmXYAdnu1KAddk1mrXZEYl6wcTm7Skqg3f0/HJ1AuAmEp511c0YCAObPfaSfj
8pEQPgA1e8OmVGbV2p1sBX46dYxFXUn0cGvgAVqs/ZuDwNJhdE0Pc8j1kQz7ylXz
/PQ4WHvcL4rkki21s73kTRudjhRNOBNH7pagXJ5KSiD9Gpz/+/7crlNLEXm2AyzR
uDft7yJD4inMBvshVtrb5FXuuQt8VRJq5a6Ee8GlNhM8Oyk273TUEENM2qnQbFE/
OETVUvJA5HN6PRekVG7KYZ166pbme3hWDEvQ+GnDradAR5ugZq9cuPupW50TwS1m
mwWyG8U2YjSdtvO4AqDlaXHAabwBQLsnQMDVHEElkhUEb9fUqkDiKWFbso/N7Ug8
qebGZpw1CA6ADJoIP83FJH5ebVLpCMKffRZnV7XhqpJyoEtjDJ8FDD0boIgbMMUb
xJIF5szgQ0F9COHwzUkIGbFyT98=
=R1XB
-----END PGP SIGNATURE-----

---------------------------------------------------------------------
To unsubscribe, e-mail: users-***@tomcat.apache.org
For additional commands, e-mail: users-***@tomcat.apache.org
Alceu R. de Freitas Jr.
2017-12-21 19:45:05 UTC
Permalink
Hello Cristopher,
I never saw something like that too. I also search on Google, all occurrences happened with people trying to run Tomcat on privileged ports (<1024).
Here is a quick test, with port 9090:

[***@localhost ~]# systemctl stop tomcat
[***@localhost ~]# rm -f /var/log/tomcat/*
[***@localhost ~]# vi /etc/tomcat/server.xml
[***@localhost ~]# grep -A 2 'Connector port="9090"' /etc/tomcat/server.xml
    <Connector port="9090" protocol="HTTP/1.1"
               connectionTimeout="20000"
               redirectPort="8443" />
[***@localhost ~]# systemctl start tomcat
[***@localhost ~]# systemctl status tomcat
● tomcat.service - Apache Tomcat Web Application Container
   Loaded: loaded (/usr/lib/systemd/system/tomcat.service; disabled; vendor preset: disabled)
   Active: active (running) since Qui 2017-12-21 17:39:57 -02; 6s ago
 Main PID: 4385 (java)
   CGroup: /system.slice/tomcat.service
           └─4385 /usr/lib/jvm/jre/bin/java -classpath /usr/share/tomcat/bin/bootstrap.jar:/usr/share/tomcat/bin/tomcat-juli.jar:/usr/share/java/commons-da...

Dez 21 17:40:03 localhost.localdomain server[4385]: dez 21, 2017 5:40:03 PM org.apache.catalina.startup.HostConfig deployDirectory
Dez 21 17:40:03 localhost.localdomain server[4385]: INFORMAÇÕES: Deployment of web application directory /var/lib/tomcat/webapps/manager has finish
 in 498 ms
Dez 21 17:40:03 localhost.localdomain server[4385]: dez 21, 2017 5:40:03 PM org.apache.catalina.startup.HostConfig deployDirectory
Dez 21 17:40:03 localhost.localdomain server[4385]: INFORMAÇÕES: Deploying web application directory /var/lib/tomcat/webapps/ROOT
Dez 21 17:40:03 localhost.localdomain server[4385]: dez 21, 2017 5:40:03 PM org.apache.catalina.startup.TldConfig execute
Dez 21 17:40:03 localhost.localdomain server[4385]: INFORMAÇÕES: At least one JAR was scanned for TLDs yet contained no TLDs. Enable debug logging 
tion time.
Dez 21 17:40:03 localhost.localdomain server[4385]: dez 21, 2017 5:40:03 PM org.apache.catalina.startup.HostConfig deployDirectory
Dez 21 17:40:03 localhost.localdomain server[4385]: INFORMAÇÕES: Deployment of web application directory /var/lib/tomcat/webapps/ROOT has finished in 534 ms
Dez 21 17:40:03 localhost.localdomain server[4385]: dez 21, 2017 5:40:03 PM org.apache.catalina.startup.HostConfig deployDirectory
Dez 21 17:40:03 localhost.localdomain server[4385]: INFORMAÇÕES: Deploying web application directory /var/lib/tomcat/webapps/examples
Hint: Some lines were ellipsized, use -l to show in full.
[***@localhost ~]# less /var/log/tomcat/catalina.2017-12-21.log
GRAVE: Failed to initialize end point associated with ProtocolHandler ["http-bio-9090"]
java.net.BindException: Permissão negada (Bind failed) <null>:9090
        at org.apache.tomcat.util.net.JIoEndpoint.bind(JIoEndpoint.java:413)
        at org.apache.tomcat.util.net.AbstractEndpoint.init(AbstractEndpoint.java:715)
        at org.apache.coyote.AbstractProtocol.init(AbstractProtocol.java:452)
        at org.apache.coyote.http11.AbstractHttp11JsseProtocol.init(AbstractHttp11JsseProtocol.java:119)
        at org.apache.catalina.connector.Connector.initInternal(Connector.java:978)
        at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:102)
        at org.apache.catalina.core.StandardService.initInternal(StandardService.java:560)
        at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:102)
        at org.apache.catalina.core.StandardServer.initInternal(StandardServer.java:840)
        at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:102)
        at org.apache.catalina.startup.Catalina.load(Catalina.java:642)
        at org.apache.catalina.startup.Catalina.load(Catalina.java:667)
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.lang.reflect.Method.invoke(Method.java:498)
        at org.apache.catalina.startup.Bootstrap.load(Bootstrap.java:253)
        at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:427)
Caused by: java.net.BindException: Permissão negada (Bind failed)
        at java.net.PlainSocketImpl.socketBind(Native Method)
        at java.net.AbstractPlainSocketImpl.bind(AbstractPlainSocketImpl.java:387)
        at java.net.ServerSocket.bind(ServerSocket.java:375)
        at java.net.ServerSocket.<init>(ServerSocket.java:237)
        at java.net.ServerSocket.<init>(ServerSocket.java:181)
        at org.apache.tomcat.util.net.DefaultServerSocketFactory.createSocket(DefaultServerSocketFactory.java:49)
        at org.apache.tomcat.util.net.JIoEndpoint.bind(JIoEndpoint.java:400)
        ... 17 more
dez 21, 2017 5:40:00 PM org.apache.catalina.core.StandardService initInternal
GRAVE: Failed to initialize connector [Connector[HTTP/1.1-9090]]
org.apache.catalina.LifecycleException: Failed to initialize component [Connector[HTTP/1.1-9090]]
        at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:107)
        at org.apache.catalina.core.StandardService.initInternal(StandardService.java:560)
        at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:102)
        at org.apache.catalina.core.StandardServer.initInternal(StandardServer.java:840)
        at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:102)
        at org.apache.catalina.startup.Catalina.load(Catalina.java:642)
        at org.apache.catalina.startup.Catalina.load(Catalina.java:667)
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.lang.reflect.Method.invoke(Method.java:498)
        at org.apache.catalina.startup.Bootstrap.load(Bootstrap.java:253)
        at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:427)
Caused by: org.apache.catalina.LifecycleException: Protocol handler initialization failed
        at org.apache.catalina.connector.Connector.initInternal(Connector.java:980)
        at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:102)
        ... 12 more
Caused by: java.net.BindException: Permissão negada (Bind failed) <null>:9090
        at org.apache.tomcat.util.net.JIoEndpoint.bind(JIoEndpoint.java:413)
        at org.apache.tomcat.util.net.AbstractEndpoint.init(AbstractEndpoint.java:715)
        at org.apache.coyote.AbstractProtocol.init(AbstractProtocol.java:452)
        at org.apache.coyote.http11.AbstractHttp11JsseProtocol.init(AbstractHttp11JsseProtocol.java:119)
        at org.apache.catalina.connector.Connector.initInternal(Connector.java:978)
        ... 13 more
Caused by: java.net.BindException: Permissão negada (Bind failed)
        at java.net.PlainSocketImpl.socketBind(Native Method)
        at java.net.AbstractPlainSocketImpl.bind(AbstractPlainSocketImpl.java:387)
        at java.net.ServerSocket.bind(ServerSocket.java:375)
[***@localhost ~]# ps aux | grep -i tomcat
tomcat    4385  3.4 10.8 2306540 110448 ?      Ssl  17:39   0:09 /usr/lib/jvm/jre/bin/java -classpath /usr/share/tomcat/bin/bootstrap.jar:/usr/share/tomcat/bin/tomcat-juli.jar:/usr/share/java/commons-daemon.jar -Dcatalina.base=/usr/share/tomcat -Dcatalina.home=/usr/share/tomcat -Djava.endorsed.dirs= -Djava.io.tmpdir=/var/cache/tomcat/temp -Djava.util.logging.config.file=/usr/share/tomcat/conf/logging.properties -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager org.apache.catalina.startup.Bootstrap start
root      4438  0.0  0.0 112680   988 pts/0    R+   17:44   0:00 grep --color=auto -i tomcat


Em quinta-feira, 21 de dezembro de 2017 17:34:39 BRST, Christopher Schultz <***@christopherschultz.net> escreveu:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

I've never seem "BindException: permission denied" when the port
number is above 1024. Are you sure it's the connector port (e.g. 8090)
it's complaining about?

When you try your "other applications" test, are you sure you are
running as the same effective user as the Tomcat process?

- -chris
Coty Sutherland
2017-12-21 20:49:43 UTC
Permalink
On Thu, Dec 21, 2017 at 2:45 PM, Alceu R. de Freitas Jr.
Post by Alceu R. de Freitas Jr.
Hello Cristopher,
I never saw something like that too. I also search on Google, all occurrences happened with people trying to run Tomcat on privileged ports (<1024).
<Connector port="9090" protocol="HTTP/1.1"
connectionTimeout="20000"
redirectPort="8443" />
● tomcat.service - Apache Tomcat Web Application Container
Loaded: loaded (/usr/lib/systemd/system/tomcat.service; disabled; vendor preset: disabled)
Active: active (running) since Qui 2017-12-21 17:39:57 -02; 6s ago
Main PID: 4385 (java)
CGroup: /system.slice/tomcat.service
└─4385 /usr/lib/jvm/jre/bin/java -classpath /usr/share/tomcat/bin/bootstrap.jar:/usr/share/tomcat/bin/tomcat-juli.jar:/usr/share/java/commons-da...
Dez 21 17:40:03 localhost.localdomain server[4385]: dez 21, 2017 5:40:03 PM org.apache.catalina.startup.HostConfig deployDirectory
Dez 21 17:40:03 localhost.localdomain server[4385]: INFORMAÇÕES: Deployment of web application directory /var/lib/tomcat/webapps/manager has finish… in 498 ms
Dez 21 17:40:03 localhost.localdomain server[4385]: dez 21, 2017 5:40:03 PM org.apache.catalina.startup.HostConfig deployDirectory
Dez 21 17:40:03 localhost.localdomain server[4385]: INFORMAÇÕES: Deploying web application directory /var/lib/tomcat/webapps/ROOT
Dez 21 17:40:03 localhost.localdomain server[4385]: dez 21, 2017 5:40:03 PM org.apache.catalina.startup.TldConfig execute
Dez 21 17:40:03 localhost.localdomain server[4385]: INFORMAÇÕES: At least one JAR was scanned for TLDs yet contained no TLDs. Enable debug logging …tion time.
Dez 21 17:40:03 localhost.localdomain server[4385]: dez 21, 2017 5:40:03 PM org.apache.catalina.startup.HostConfig deployDirectory
Dez 21 17:40:03 localhost.localdomain server[4385]: INFORMAÇÕES: Deployment of web application directory /var/lib/tomcat/webapps/ROOT has finished in 534 ms
Dez 21 17:40:03 localhost.localdomain server[4385]: dez 21, 2017 5:40:03 PM org.apache.catalina.startup.HostConfig deployDirectory
Dez 21 17:40:03 localhost.localdomain server[4385]: INFORMAÇÕES: Deploying web application directory /var/lib/tomcat/webapps/examples
Hint: Some lines were ellipsized, use -l to show in full.
GRAVE: Failed to initialize end point associated with ProtocolHandler ["http-bio-9090"]
java.net.BindException: Permissão negada (Bind failed) <null>:9090
at org.apache.tomcat.util.net.JIoEndpoint.bind(JIoEndpoint.java:413)
at org.apache.tomcat.util.net.AbstractEndpoint.init(AbstractEndpoint.java:715)
at org.apache.coyote.AbstractProtocol.init(AbstractProtocol.java:452)
at org.apache.coyote.http11.AbstractHttp11JsseProtocol.init(AbstractHttp11JsseProtocol.java:119)
at org.apache.catalina.connector.Connector.initInternal(Connector.java:978)
at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:102)
at org.apache.catalina.core.StandardService.initInternal(StandardService.java:560)
at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:102)
at org.apache.catalina.core.StandardServer.initInternal(StandardServer.java:840)
at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:102)
at org.apache.catalina.startup.Catalina.load(Catalina.java:642)
at org.apache.catalina.startup.Catalina.load(Catalina.java:667)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)
at org.apache.catalina.startup.Bootstrap.load(Bootstrap.java:253)
at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:427)
Caused by: java.net.BindException: Permissão negada (Bind failed)
at java.net.PlainSocketImpl.socketBind(Native Method)
at java.net.AbstractPlainSocketImpl.bind(AbstractPlainSocketImpl.java:387)
at java.net.ServerSocket.bind(ServerSocket.java:375)
at java.net.ServerSocket.<init>(ServerSocket.java:237)
at java.net.ServerSocket.<init>(ServerSocket.java:181)
at org.apache.tomcat.util.net.DefaultServerSocketFactory.createSocket(DefaultServerSocketFactory.java:49)
at org.apache.tomcat.util.net.JIoEndpoint.bind(JIoEndpoint.java:400)
... 17 more
dez 21, 2017 5:40:00 PM org.apache.catalina.core.StandardService initInternal
GRAVE: Failed to initialize connector [Connector[HTTP/1.1-9090]]
org.apache.catalina.LifecycleException: Failed to initialize component [Connector[HTTP/1.1-9090]]
at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:107)
at org.apache.catalina.core.StandardService.initInternal(StandardService.java:560)
at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:102)
at org.apache.catalina.core.StandardServer.initInternal(StandardServer.java:840)
at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:102)
at org.apache.catalina.startup.Catalina.load(Catalina.java:642)
at org.apache.catalina.startup.Catalina.load(Catalina.java:667)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)
at org.apache.catalina.startup.Bootstrap.load(Bootstrap.java:253)
at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:427)
Caused by: org.apache.catalina.LifecycleException: Protocol handler initialization failed
at org.apache.catalina.connector.Connector.initInternal(Connector.java:980)
at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:102)
... 12 more
Caused by: java.net.BindException: Permissão negada (Bind failed) <null>:9090
at org.apache.tomcat.util.net.JIoEndpoint.bind(JIoEndpoint.java:413)
at org.apache.tomcat.util.net.AbstractEndpoint.init(AbstractEndpoint.java:715)
at org.apache.coyote.AbstractProtocol.init(AbstractProtocol.java:452)
at org.apache.coyote.http11.AbstractHttp11JsseProtocol.init(AbstractHttp11JsseProtocol.java:119)
at org.apache.catalina.connector.Connector.initInternal(Connector.java:978)
... 13 more
Caused by: java.net.BindException: Permissão negada (Bind failed)
at java.net.PlainSocketImpl.socketBind(Native Method)
at java.net.AbstractPlainSocketImpl.bind(AbstractPlainSocketImpl.java:387)
at java.net.ServerSocket.bind(ServerSocket.java:375)
This behavior is due to a fix in the selinux-policy package; see
https://bugzilla.redhat.com/show_bug.cgi?id=1432083 for more details.
If you check /var/log/audit/audit.log you'll see an AVC denial, such
as:

type=AVC msg=audit(1513815897.006:136): avc: denied { name_bind
} for pid=1467 comm="java" src=8090
scontext=system_u:system_r:tomcat_t:s0
tcontext=system_u:object_r:unreserved_port_t:s0 tclass=tcp_socket ...

Previous version tomcat were incorrectly labeled unconfined_t and
could do whatever they wanted, that has been address and now tomcat is
confined by selinux as it should be :)

You can fix the problem by adding the port you want to allow to the
system's HTTP port type, http_port_t: `semanage port --add -t
http_port_t -p tcp 8090`

Cheers,
Post by Alceu R. de Freitas Jr.
tomcat 4385 3.4 10.8 2306540 110448 ? Ssl 17:39 0:09 /usr/lib/jvm/jre/bin/java -classpath /usr/share/tomcat/bin/bootstrap.jar:/usr/share/tomcat/bin/tomcat-juli.jar:/usr/share/java/commons-daemon.jar -Dcatalina.base=/usr/share/tomcat -Dcatalina.home=/usr/share/tomcat -Djava.endorsed.dirs= -Djava.io.tmpdir=/var/cache/tomcat/temp -Djava.util.logging.config.file=/usr/share/tomcat/conf/logging.properties -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager org.apache.catalina.startup.Bootstrap start
root 4438 0.0 0.0 112680 988 pts/0 R+ 17:44 0:00 grep --color=auto -i tomcat
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
I've never seem "BindException: permission denied" when the port
number is above 1024. Are you sure it's the connector port (e.g. 8090)
it's complaining about?
When you try your "other applications" test, are you sure you are
running as the same effective user as the Tomcat process?
- -chris
---------------------------------------------------------------------
To unsubscribe, e-mail: users-***@tomcat.apache.org
For additional commands, e-mail: users-***@tomcat.apache.org
Christopher Schultz
2017-12-22 17:58:11 UTC
Permalink
Alceu R. de Freitas Jr.
2017-12-26 13:12:41 UTC
Permalink
Hello Coty,
For the sake of others readers, I confirm the behavior you identified from SELinux:
[***@localhost audit]# grep -P '^type=AVC' audit.log | grep name_bind
type=AVC msg=audit(1513876523.918:145): avc:  denied  { name_bind } for  pid=10420 comm="java" src=8090 scontext=system_u:system_r:tomcat_t:s0 tcontext=system_u:object_r:unreserved_port_t:s0 tclass=tcp_socket
type=AVC msg=audit(1513876981.747:148): avc:  denied  { name_bind } for  pid=10726 comm="java" src=8090 scontext=system_u:system_r:tomcat_t:s0 tcontext=system_u:object_r:unreserved_port_t:s0 tclass=tcp_socket
type=AVC msg=audit(1513877805.970:135): avc:  denied  { name_bind } for  pid=2376 comm="java" src=8090 scontext=system_u:system_r:tomcat_t:s0 tcontext=system_u:object_r:unreserved_port_t:s0 tclass=tcp_socket
type=AVC msg=audit(1513877965.612:138): avc:  denied  { name_bind } for  pid=2442 comm="java" src=9090 scontext=system_u:system_r:tomcat_t:s0 tcontext=system_u:object_r:websm_port_t:s0 tclass=tcp_socket
type=AVC msg=audit(1513878056.773:141): avc:  denied  { name_bind } for  pid=2512 comm="java" src=17777 scontext=system_u:system_r:tomcat_t:s0 tcontext=system_u:object_r:unreserved_port_t:s0 tclass=tcp_socket
type=AVC msg=audit(1513878361.650:185): avc:  denied  { name_bind } for  pid=2609 comm="java" src=8090 scontext=system_u:system_r:tomcat_t:s0 tcontext=system_u:object_r:unreserved_port_t:s0 tclass=tcp_socket
type=AVC msg=audit(1513878699.852:190): avc:  denied  { name_bind } for  pid=2714 comm="java" src=8090 scontext=system_u:system_r:tomcat_t:s0 tcontext=system_u:object_r:unreserved_port_t:s0 tclass=tcp_socket
type=AVC msg=audit(1513878900.757:193): avc:  denied  { name_bind } for  pid=2803 comm="java" src=8090 scontext=system_u:system_r:tomcat_t:s0 tcontext=system_u:object_r:unreserved_port_t:s0 tclass=tcp_socket
type=AVC msg=audit(1513879083.533:196): avc:  denied  { name_bind } for  pid=2870 comm="java" src=8090 scontext=system_u:system_r:tomcat_t:s0 tcontext=system_u:object_r:unreserved_port_t:s0 tclass=tcp_socket
type=AVC msg=audit(1513879865.598:216): avc:  denied  { name_bind } for  pid=3480 comm="java" src=8090 scontext=system_u:system_r:tomcat_t:s0 tcontext=system_u:object_r:unreserved_port_t:s0 tclass=tcp_socket
type=AVC msg=audit(1513885200.245:233): avc:  denied  { name_bind } for  pid=4385 comm="java" src=9090 scontext=system_u:system_r:tomcat_t:s0 tcontext=system_u:object_r:websm_port_t:s0 tclass=tcp_socket
type=AVC msg=audit(1513964943.996:108): avc:  denied  { name_bind } for  pid=1808 comm="java" src=9090 scontext=system_u:system_r:tomcat_t:s0 tcontext=system_u:object_r:websm_port_t:s0 tclass=tcp_socket
[***@localhost audit]#

Since I'm not acquainted with SELinux, I read some introductory documentation about, so I'm guessing here that the proper way to allow a different port (8090 in your sample of semanage) to be used by Tomcat would be:
semanage port --add -t initrc_t -p tcp 8090

Since the running process of Tomcat is not related to http_port_t:
[***@localhost audit]# ps auxZ | grep -v grep | grep -i jenkins
system_u:system_r:initrc_t:s0   jenkins   1255  3.0 27.0 2417080 274544 ?      Ssl  10:34   0:51 /etc/alternatives/java -Dcom.sun.akuma.Daemon=daemonized -Djava.awt.headless=true -DJENKINS_HOME=/var/lib/jenkins -jar /usr/lib/jenkins/jenkins.war --logfile=/var/log/jenkins/jenkins.log --webroot=/var/cache/jenkins/war --daemon --httpPort=8090 --debug=5 --handlerCountMax=100 --handlerCountMaxIdle=20

Is that right?
On the other hand, semanage port -l | grep init or semanage port -l | grep 8090 gives me nothing.
Thanks,Alceu

Em quinta-feira, 21 de dezembro de 2017 18:49:48 BRST, Coty Sutherland <***@apache.org> escreveu:

This behavior is due to a fix in the selinux-policy package; see
https://bugzilla.redhat.com/show_bug.cgi?id=1432083 for more details.
If you check /var/log/audit/audit.log you'll see an AVC denial, such
as:

    type=AVC msg=audit(1513815897.006:136): avc:  denied  { name_bind
} for  pid=1467 comm="java" src=8090
scontext=system_u:system_r:tomcat_t:s0
tcontext=system_u:object_r:unreserved_port_t:s0 tclass=tcp_socket ...

Previous version tomcat were incorrectly labeled unconfined_t and
could do whatever they wanted, that has been address and now tomcat is
confined by selinux as it should be :)

You can fix the problem by adding the port you want to allow to the
system's HTTP port type, http_port_t: `semanage port --add -t
http_port_t -p tcp 8090`

Cheers,
Coty Sutherland
2018-01-02 20:59:51 UTC
Permalink
On Tue, Dec 26, 2017 at 8:12 AM, Alceu R. de Freitas Jr.
Post by Alceu R. de Freitas Jr.
Hello Coty,
Great, thanks.
Post by Alceu R. de Freitas Jr.
type=AVC msg=audit(1513876523.918:145): avc: denied { name_bind } for pid=10420 comm="java" src=8090 scontext=system_u:system_r:tomcat_t:s0 tcontext=system_u:object_r:unreserved_port_t:s0 tclass=tcp_socket
type=AVC msg=audit(1513876981.747:148): avc: denied { name_bind } for pid=10726 comm="java" src=8090 scontext=system_u:system_r:tomcat_t:s0 tcontext=system_u:object_r:unreserved_port_t:s0 tclass=tcp_socket
type=AVC msg=audit(1513877805.970:135): avc: denied { name_bind } for pid=2376 comm="java" src=8090 scontext=system_u:system_r:tomcat_t:s0 tcontext=system_u:object_r:unreserved_port_t:s0 tclass=tcp_socket
type=AVC msg=audit(1513877965.612:138): avc: denied { name_bind } for pid=2442 comm="java" src=9090 scontext=system_u:system_r:tomcat_t:s0 tcontext=system_u:object_r:websm_port_t:s0 tclass=tcp_socket
type=AVC msg=audit(1513878056.773:141): avc: denied { name_bind } for pid=2512 comm="java" src=17777 scontext=system_u:system_r:tomcat_t:s0 tcontext=system_u:object_r:unreserved_port_t:s0 tclass=tcp_socket
type=AVC msg=audit(1513878361.650:185): avc: denied { name_bind } for pid=2609 comm="java" src=8090 scontext=system_u:system_r:tomcat_t:s0 tcontext=system_u:object_r:unreserved_port_t:s0 tclass=tcp_socket
type=AVC msg=audit(1513878699.852:190): avc: denied { name_bind } for pid=2714 comm="java" src=8090 scontext=system_u:system_r:tomcat_t:s0 tcontext=system_u:object_r:unreserved_port_t:s0 tclass=tcp_socket
type=AVC msg=audit(1513878900.757:193): avc: denied { name_bind } for pid=2803 comm="java" src=8090 scontext=system_u:system_r:tomcat_t:s0 tcontext=system_u:object_r:unreserved_port_t:s0 tclass=tcp_socket
type=AVC msg=audit(1513879083.533:196): avc: denied { name_bind } for pid=2870 comm="java" src=8090 scontext=system_u:system_r:tomcat_t:s0 tcontext=system_u:object_r:unreserved_port_t:s0 tclass=tcp_socket
type=AVC msg=audit(1513879865.598:216): avc: denied { name_bind } for pid=3480 comm="java" src=8090 scontext=system_u:system_r:tomcat_t:s0 tcontext=system_u:object_r:unreserved_port_t:s0 tclass=tcp_socket
type=AVC msg=audit(1513885200.245:233): avc: denied { name_bind } for pid=4385 comm="java" src=9090 scontext=system_u:system_r:tomcat_t:s0 tcontext=system_u:object_r:websm_port_t:s0 tclass=tcp_socket
type=AVC msg=audit(1513964943.996:108): avc: denied { name_bind } for pid=1808 comm="java" src=9090 scontext=system_u:system_r:tomcat_t:s0 tcontext=system_u:object_r:websm_port_t:s0 tclass=tcp_socket
semanage port --add -t initrc_t -p tcp 8090
If that works, sure :)
I'm not sure what you mean by 'is not related to', but tomcat is
related to http_port_t because it's allowed name_bind and name_connect
by the default system policy:

~~~
# sesearch -t http_port_t -AC | grep tomcat
allow tomcat_domain http_port_t : tcp_socket { name_bind name_connect } ;
~~~
Post by Alceu R. de Freitas Jr.
system_u:system_r:initrc_t:s0 jenkins 1255 3.0 27.0 2417080 274544 ? Ssl 10:34 0:51 /etc/alternatives/java -Dcom.sun.akuma.Daemon=daemonized -Djava.awt.headless=true -DJENKINS_HOME=/var/lib/jenkins -jar /usr/lib/jenkins/jenkins.war --logfile=/var/log/jenkins/jenkins.log --webroot=/var/cache/jenkins/war --daemon --httpPort=8090 --debug=5 --handlerCountMax=100 --handlerCountMaxIdle=20
Is that right?
On the other hand, semanage port -l | grep init or semanage port -l | grep 8090 gives me nothing.
You don't see the port in the list because 8090 is not a port that's
in any port type definition by default, hence my suggestion to add it
to a type that tomcat can use. From what you've noted above though
you're not trying to bind tomcat to 8090, you're trying to bind
jenkins to 8090. Is that right?

By the way, you can check what labels any port has with seinfo:

~~~
# seinfo --portcon=8090
portcon tcp 1024-32767 system_u:object_r:unreserved_port_t:s0
portcon udp 1024-32767 system_u:object_r:unreserved_port_t:s0
# seinfo --portcon=8080
portcon tcp 8080 system_u:object_r:http_cache_port_t:s0
portcon tcp 1024-32767 system_u:object_r:unreserved_port_t:s0
portcon udp 1024-32767 system_u:object_r:unreserved_port_t:s0
~~~

Note that a port that works (8080) is labeled http_cache_port_t which
is usable by tomcat_domain and port 8090 is just labeled as an
unreserved_port_t.
Post by Alceu R. de Freitas Jr.
Thanks,Alceu
This behavior is due to a fix in the selinux-policy package; see
https://bugzilla.redhat.com/show_bug.cgi?id=1432083 for more details.
If you check /var/log/audit/audit.log you'll see an AVC denial, such
type=AVC msg=audit(1513815897.006:136): avc: denied { name_bind
} for pid=1467 comm="java" src=8090
scontext=system_u:system_r:tomcat_t:s0
tcontext=system_u:object_r:unreserved_port_t:s0 tclass=tcp_socket ...
Previous version tomcat were incorrectly labeled unconfined_t and
could do whatever they wanted, that has been address and now tomcat is
confined by selinux as it should be :)
You can fix the problem by adding the port you want to allow to the
system's HTTP port type, http_port_t: `semanage port --add -t
http_port_t -p tcp 8090`
Cheers,
---------------------------------------------------------------------
To unsubscribe, e-mail: users-***@tomcat.apache.org
For additional commands, e-mail: users-***@tomcat.apache.org

Loading...