selinux denying haproxy connections?

Question

I'm seeing these messages popping up in syslog:

Mar 10 12:51:35 db1 kernel: [5851729.958138] type=1400 audit(1457614295.823:2925931): avc:  denied  { name_connect } for  pid=801 comm="haproxy" dest=7778 scontext=system_u:system_r:haproxy_t:s0 tcontext=system_u:object_r:interwise_port_t:s0 tclass=tcp_socket

Does this mean that SELinux is denying connections to haproxy?

Thanks

Mathilda

Answer 1

You could try running:

setsebool -P haproxy_connect_any 1

as root to enable connection for haproxy.

Forefoot

Work like a charm for me on centos 7. – Replevin

indeed this is the solution. fedora 25 here – Downcomer

one can pre/post-check the status and existence of selinux rules with: semanage boolean -l | grep haproxy – Calipash