-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Paul Howarth wrote:
> Got this one today:
>
> type=AVC msg=audit(1202724149.875:1426): avc: denied { name_bind } for
> pid=2468 comm="named" src=2605 scontext=system_u:system_r:named_t:s0
> tcontext=system_u:object_r:bgp_port_t:s0 tclass=udp_socket
> type=SYSCALL msg=audit(1202724149.875:1426): arch=c000003e syscall=49
> success=no exit=-13 a0=38 a1=41400d70 a2=1c a3=41400b6c items=0 ppid=1
> pid=2468 auid=4294967295 uid=25 gid=25 euid=25 suid=25 fsuid=25 egid=25
> sgid=25 fsgid=25 tty=(none) comm="named" exe="/usr/sbin/named"
> subj=system_u:system_r:named_t:s0 key=(null)
>
>
> I suspect that this snippet from the logwatch report is related:
>
> could not update an IPv6 random query port: permission denied: 1 Time(s)
>
> I guess I need to specify the query-source and query-source-v6 bind
> options to tie this down?
>
> Paul.
>
> --
> fedora-selinux-list mailing list
> fedora-selinux-list@xxxxxxxxxx
> https://www.redhat.com/mailman/listinfo/fedora-selinux-list
This is an interesting bug, well at least to me. SELinux ports are
labeled with a an attribute of port_type. Ports < 1024 are labeled as
reserved_port_type.
So we have a line in bind that says it can name_bind to all unreserved
ports. And this calls into a interface that has this line
allow $1 { port_type -reserved_port_type }:udb_socket name_bind;
Everything looks good. Well not really because we also group a few
ports with a single port type.
network_port(bgp, tcp,179,s0, udp,179,s0, tcp,2605,s0, udp,2605,s0)
The network_port macro assigns the examines the port numbers and if it
finds one < 1024, it assigns the port type as reserved_port_type. As
you can see bgp_port_t includes reserved_port_type ports and non
reserved port types. So you were unlucky enough to hit on one of these
ports.
I have changed the interface to allow all ports > 1024 in todays rawhide.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.8 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org
iEYEARECAAYFAkexrjAACgkQrlYvE4MpobP99QCg2iBmkKDTNNGOTGRuHVzy+ci5
UM4An20zuX0HjAp8uXrmB4Ty8M38u02b
=mArL
-----END PGP SIGNATURE-----
--
fedora-selinux-list mailing list
fedora-selinux-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/fedora-selinux-list
