FAQ Search Today's Posts Mark Forums Read
» Video Reviews

» Linux Archive

Linux-archive is a website aiming to archive linux email lists and to make them easily accessible for linux users/developers.


» Sponsor

» Partners

» Sponsor

Go Back   Linux Archive > Redhat > Fedora SELinux Support

 
 
LinkBack Thread Tools
 
Old 02-12-2008, 10:14 AM
Paul Howarth
 
Default named avc (Fedora 8)

Got this one today:

type=AVC msg=audit(1202724149.875:1426): avc: denied { name_bind } for
pid=2468 comm="named" src=2605 scontext=system_u:system_r:named_t:s0
tcontext=system_ubject_r:bgp_port_t:s0 tclass=udp_socket
type=SYSCALL msg=audit(1202724149.875:1426): arch=c000003e syscall=49
success=no exit=-13 a0=38 a1=41400d70 a2=1c a3=41400b6c items=0 ppid=1
pid=2468 auid=4294967295 uid=25 gid=25 euid=25 suid=25 fsuid=25 egid=25
sgid=25 fsgid=25 tty=(none) comm="named" exe="/usr/sbin/named"
subj=system_u:system_r:named_t:s0 key=(null)



I suspect that this snippet from the logwatch report is related:

could not update an IPv6 random query port: permission denied: 1 Time(s)

I guess I need to specify the query-source and query-source-v6 bind
options to tie this down?


Paul.

--
fedora-selinux-list mailing list
fedora-selinux-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-selinux-list
 
Old 02-12-2008, 01:33 PM
Daniel J Walsh
 
Default named avc (Fedora 8)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Paul Howarth wrote:
> Got this one today:
>
> type=AVC msg=audit(1202724149.875:1426): avc: denied { name_bind } for
> pid=2468 comm="named" src=2605 scontext=system_u:system_r:named_t:s0
> tcontext=system_ubject_r:bgp_port_t:s0 tclass=udp_socket
> type=SYSCALL msg=audit(1202724149.875:1426): arch=c000003e syscall=49
> success=no exit=-13 a0=38 a1=41400d70 a2=1c a3=41400b6c items=0 ppid=1
> pid=2468 auid=4294967295 uid=25 gid=25 euid=25 suid=25 fsuid=25 egid=25
> sgid=25 fsgid=25 tty=(none) comm="named" exe="/usr/sbin/named"
> subj=system_u:system_r:named_t:s0 key=(null)
>
>
> I suspect that this snippet from the logwatch report is related:
>
> could not update an IPv6 random query port: permission denied: 1 Time(s)
>
> I guess I need to specify the query-source and query-source-v6 bind
> options to tie this down?
>
> Paul.
>
> --
> fedora-selinux-list mailing list
> fedora-selinux-list@redhat.com
> https://www.redhat.com/mailman/listinfo/fedora-selinux-list
This is an interesting bug, well at least to me. SELinux ports are
labeled with a an attribute of port_type. Ports < 1024 are labeled as
reserved_port_type.

So we have a line in bind that says it can name_bind to all unreserved
ports. And this calls into a interface that has this line

allow $1 { port_type -reserved_port_type }:udb_socket name_bind;

Everything looks good. Well not really because we also group a few
ports with a single port type.

network_port(bgp, tcp,179,s0, udp,179,s0, tcp,2605,s0, udp,2605,s0)

The network_port macro assigns the examines the port numbers and if it
finds one < 1024, it assigns the port type as reserved_port_type. As
you can see bgp_port_t includes reserved_port_type ports and non
reserved port types. So you were unlucky enough to hit on one of these
ports.

I have changed the interface to allow all ports > 1024 in todays rawhide.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.8 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org

iEYEARECAAYFAkexrjAACgkQrlYvE4MpobP99QCg2iBmkKDTNN GOTGRuHVzy+ci5
UM4An20zuX0HjAp8uXrmB4Ty8M38u02b
=mArL
-----END PGP SIGNATURE-----

--
fedora-selinux-list mailing list
fedora-selinux-list@redhat.com
https://www.redhat.com/mailman/listinfo/fedora-selinux-list
 

Thread Tools




All times are GMT. The time now is 08:50 AM.

VBulletin, Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.
Content Relevant URLs by vBSEO ©2007, Crawlability, Inc.
Copyright 2007 - 2008, www.linux-archive.org