Re: package review?

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Daniel J Walsh wrote:
Wart wrote:
Paul Howarth wrote:
Wart wrote:

Daniel J Walsh wrote:

allow crossfire_t port_t:udp_socket send_msg;
allow crossfire_t port_t:tcp_socket name_bind;
You need to define a port for this socket and only allow name_bind to
that port
I know I'm missing something obvious here, but which macro can I use to add this restriction? I saw references to http_port_t and ntp_port_t in
corenetwork.if, but didn't see anything that actually defined it to be
port 80 (http) or port 123 (ntp).
policy/modules/kernel/corenetwork.te.in:

...
network_port(ntp, udp,123,s0)
...
network_port(http, tcp,80,s0, tcp,443,s0, tcp,488,s0, tcp,8008,s0,
tcp,8009,s0)

Thanks.  This is just what I needed.

I could have sworn that this syntax was working for me earlier today,
but now I keep getting syntax errors on FC5:

+ make -f /usr/share/selinux/devel/Makefile
cat: /selinux/mls: No such file or directory
Compiling targeted  crossfire module
crossfire.te:67:ERROR 'syntax error' at token 'network_port' on line 59707:
## Networking basics (adjust to your needs!)
network_port(crossfire, tcp,13327,s0)
/usr/bin/checkmodule:  error(s) encountered while parsing configuration
/usr/bin/checkmodule: loading policy configuration from tmp/crossfire.tmp
make: *** [tmp/crossfire.mod] Error 1

Is there something else that I need to include to be able to use
network_port()?

This seems to be a bug in Reference policy. You are not allowed to define ports in loadable modules, at least that I can figure.
I am in contact with upstream.  This is a serious bug.

Eh, this is a limitation in the compiler, and a very intentional one at that. Since port ordering is important we chose not to allow them in the module language since a different linking order could result in a different result.

Obviously refpolicy's solution to this is to include every port definition in corenetwork which is non-ideal in some ways but we also have semanage support for setting port contexts so I don't know that the module compiler should (or ever will) support this.

--
fedora-selinux-list mailing list
fedora-selinux-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/fedora-selinux-list

[Index of Archives]     [Fedora Users]     [Fedora Desktop]     [Big List of Linux Books]     [Yosemite News]     [Yosemite Campsites]     [KDE Users]     [Gnome Users]

  Powered by Linux