[sane-devel] I need SELinux help

[ToddAndMargo]

Hi All,

Fedora Core 27

# rpm -qa sane\*
sane-backends-libs-1.0.27-8.fc27.i686
sane-backends-1.0.27-8.fc27.x86_64
sane-backends-daemon-1.0.27-8.fc27.x86_64
sane-backends-drivers-scanners-1.0.27-8.fc27.i686
sane-backends-libs-1.0.27-8.fc27.x86_64
sane-backends-drivers-scanners-1.0.27-8.fc27.x86_64
sane-backends-drivers-cameras-1.0.27-8.fc27.i686
sane-backends-drivers-cameras-1.0.27-8.fc27.x86_64

I am trying to run

# systemctl start saned.socket

And SELinux is taking a shine to it. The commands that it
says to run
     # ausearch -c 'systemd' --raw | audit2allow -M my-systemd
     # semodule -X 300 -i my-systemd.pp
do not work and the same SELinux error keeps appearing

Permission denied in the journalctl message

# systemctl [re]start saned.socket

starts perfectly with "setenforce Permissive" and nothing shows
up in the "SELinux Alert Browser".

Turn SELinux back on and the original problem comes back.

Many thanks,
-T


This is the SELinux error:


SELinux is preventing systemd from listen access on the tcp_socket port 
None.

*****  Plugin catchall (100. confidence) suggests 
**************************

If you believe that systemd should be allowed listen access on the port 
None tcp_socket by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'systemd' --raw | audit2allow -M my-systemd
# semodule -X 300 -i my-systemd.pp

Additional Information:
Source Context                system_u:system_r:init_t:s0
Target Context                system_u:system_r:unconfined_service_t:s0
Target Objects                port None [ tcp_socket ]
Source                        systemd
Source Path                   systemd
Port                          <Unknown>
Host                          rn4.xxx.local
Source RPM Packages
Target RPM Packages
Policy RPM                    selinux-policy-3.13.1-283.18.fc27.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     rn4.xx.local
Platform                      Linux rn4.xxx.local 4.14.7-300.fc27.x86_64
                               #1 SMP Mon Dec 18 16:06:12 UTC 2017 
x86_64 x86_64
Alert Count                   5
First Seen                    2017-12-20 13:35:43 PST
Last Seen                     2017-12-20 13:35:46 PST
Local ID                      0e806a1d-c379-4c0e-993b-286c5828ef2b

Raw Audit Messages
type=AVC msg=audit(1513805746.614:968): avc:  denied  { listen } for 
pid=1 comm="systemd" lport=6566 scontext=system_u:system_r:init_t:s0 
tcontext=system_u:system_r:unconfined_service_t:s0 tclass=tcp_socket 
permissive=0


Hash: systemd,init_t,unconfined_service_t,tcp_socket,listen



My systemctl scripts:

saned.socket

[Unit]
Description=saned incoming socket

[Socket]
ListenStream=6566
Accept=yes
MaxConnections=1

[Install]
WantedBy=sockets.target


saned at saned.service

[Unit]
Description=Scanner Service
Requires=saned.socket

[Service]
ExecStart=/usr/sbin/saned
User=saned
Group=saned
StandardInput=socket
StandardOutput=syslog
StandardError=syslog
# Environment=SANE_CONFIG_DIR=/etc/sane.d
Environment=SANE_CONFIG_DIR=/etc/sane.d SANE_DEBUG_DLL=255 
SANE_DEBUG_BJNP=5 SANE_DEBUG_NET=128


[Install]
Also=saned.socket



What am I missing?