SELinux allow http requests on Fedora 14

Question

I have a Fedora 14 instance on Amazon EC2 and I want to make an http request from that instance to another one in the same amazon security group. When I use wget to make the request it works fine. However, when I use Apache HTTP client running through JBoss 6 I get a

HttpClient ConnectException: Connection refused

JBoss does not run as root but rather as user "jboss". I suspect this is an SELinux issue. I logged in as root and I called

setsebool -P httpd_can_network_connect 1

and

setsebool -P httpd_can_network_relay 1

But still no luck. Any advice would be much appreciated.

Regards

Answer 1

First, double check that SELinux is, in fact, the culprit by checking your audit log in /var/log/audit/audit.log. There should be message with type=AVC related to JBoss.

Then, you can use that message in conjunction with the audit2allow tool to authorize the blocked access. To authorize everything blocked for any binary with the name jboss in it thus far, run this as root:

grep jboss /var/log/audit/audit.log | audit2allow -M jboss
semodule -i jboss.pp

However, it's better to only allow the specific permissions needed. To do that, copy and paste the relevant lines from your audit log to a new file, and cat that to audit2allow instead.