https://bugzilla.redhat.com/show_bug.cgi?id=1228918

Bug ID: 1228918 Summary: selinux denies rsyslog logging to elasticsearch via rsyslog-elasticsearch Product: Fedora Version: 22 Component: elasticsearch Assignee: jvanek@redhat.com Reporter: david@algorithmicarmada.com QA Contact: extras-qa@fedoraproject.org CC: bkabrda@redhat.com, bobjensen@gmail.com, java-sig-commits@lists.fedoraproject.org, jvanek@redhat.com, pbrobinson@gmail.com, zbyszek@in.waw.pl

Created attachment 1035659 --> https://bugzilla.redhat.com/attachment.cgi?id=1035659&action=edit /etc/rsyslog.d/elasticsearch.conf

Description of problem: The package rsyslog-elasticsearch is broken out-of-the-box. rsyslog attempting to log to elasticsearch results in the following AVC denials if NIS_ENABLED is off:

Jun 6 10:50:11 geth01 audit: <audit-1400> avc: denied { name_connect } for pid=734 comm=72733A616374696F6E203120717565 dest=9200 scontext=system_u:system_r:syslogd_t:s0 tcontext=system_u:object_r:unreserved_port_t:s0 tclass=tcp_socket permissive=0 Jun 6 10:50:11 geth01 audit: <audit-1400> avc: denied { name_connect } for pid=734 comm=72733A616374696F6E203120717565 dest=9200 scontext=system_u:system_r:syslogd_t:s0 tcontext=system_u:object_r:unreserved_port_t:s0 tclass=tcp_socket permissive=0 Jun 6 10:50:11 geth01 audit: <audit-1400> avc: denied { name_connect } for pid=731 comm=72733A616374696F6E203120717565 dest=9200 scontext=system_u:system_r:syslogd_t:s0

Installation of the package rsyslog-elasticsearch should allow rsyslog to connect to elasticsearch's particular port, without opening rsyslog to all ports, and also without impacting other installed programs.

Version-Release number of selected component (if applicable): Fedora 22 Server $ dnf list elasticsearch rsyslog-elasticsearch rsyslog Last metadata expiration check performed 0:06:09 ago on Sat Jun 6 12:05:59 2015. Installed Packages elasticsearch.noarch 1.5.2-0.fc22 @System rsyslog.x86_64 8.8.0-2.fc22 @System rsyslog-elasticsearch.x86_64 8.8.0-2.fc22 @System

How reproducible: Very.

Steps to Reproduce: 1. Install elasticsearch and rsyslog-elasticsearch. I'm using a cluster of 2 machines, but that shouldn't matter. 2. Ensure the SELinux bool nis_enabled is off. This was the case without my intervention. 3. Configure rsylog as per the attached configuration (separate file in /etc/rsyslog.d/)

Actual results: AVC denials in /var/log/messages, no index created in elasticsearch.

Expected results: Indices should be created in elasticsearch while messages are logged, AVC should not deny rsyslog's connections, nothing noteworthy should be logged in /var/log/messages.

Note that if rsyslog-elasticsearch is not installed, rsyslog should not be allowed to connect to port 9200 (without nis_enabled being set), regardless of whether elasticsearch is installed.

Additional info: - I'm using a bare-metal cluster of 2 computers for elasticsearch, both of which should be configured identically, courtesy of ansible. - Elasticsearch configuration specified the network name as the host name. - Elasticsearch configuration specifies a non-default cluster name. - Elasticsearch uses a few ports other than 9200. I know of 9300, can't find a documented list at the moment. - I do have the logstash repository from www.elastic.co setup, but should not be using packages from it.