On Mon, 2008-09-29 at 21:17 -0500, Arthur Pemberton wrote:
> On Mon, Sep 29, 2008 at 3:40 PM, Stephen Smalley <sds@xxxxxxxxxxxxx> wrote:
> >
> > On Mon, 2008-09-29 at 15:31 -0500, Arthur Pemberton wrote:
> >> I'm getting an denial when I attempt o use port 23 as an additional
> >> port for sshd. That makes sense. What's the best way to define
> >> alternate SSHd ports?
> >
> > semanage port -m -t ssh_port_t -p tcp 23
>
>
>
> When trying this, I get:
> sealert -l 819f882a-3d08-41da-bc19-4168c9b8b4cb
>
> Even after doing that, I get this on `service sshd restart`:
> sealert -l 82267d8b-d557-4891-bdb0-26e0feb1e986
A workaround until semanage is fixed to correctly support the above
would be to add a local policy module that allows sshd to bind to the
telnetd port, e.g.
$ cat myssh.te
policy_module(myssh, 1.0)
require {
type sshd_t;
type telnetd_port_t;
}
allow sshd_t telnetd_port_t:tcp_socket name_bind;
$ make -f /usr/share/selinux/devel/Makefile myssh.pp
$ semodule -i myssh.pp
audit2allow should have yielded a similar result.
--
Stephen Smalley
National Security Agency
--
fedora-selinux-list mailing list
fedora-selinux-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/fedora-selinux-list
