On 10/14/2009 03:42 PM, Daniel J Walsh wrote:
On 10/14/2009 01:30 PM, Joshua Roys wrote:
avc: denied { recv } for saddr=1.2.3.4 src=500 daddr=4.3.2.1 dest=500
netif=eth0 scontext=system_u:system_r:racoon_t:s0-s15:c0.c1023
tcontext=system_u:object_r:unlabeled_t:s15:c0.c1023 tclass=peer
On IRC it was mentioned the tcontext=...:s15:... could be an issue...?
Did you run the AVC through audit2why?
It said: Policy constraint violation.
Looking at policy/mls, I see this:
# the peer/packet recv op
mlsconstrain { peer packet } { recv }
(( l1 dom l2 ) or
(( t1 == mlsnetreadtoclr ) and ( h1 dom l2 )) or
( t1 == mlsnetread ));
And here are our contexts:
scontext=system_u:system_r:racoon_t:s0-s15:c0.c1023
tcontext=system_u:object_r:unlabeled_t:s15:c0.c1023
According to:
http://www.patrickmcdaniel.org/pubs/sacmat07.pdf
the mlsconstrain above expands to:
subject = system_u:system_r:racoon_t:s0-s15:c0.c1023
object = system_u:object_r:unlabeled_t:s15-s15:c0.c1023
l1 dom l2 = opl(dom, getl(subject), getl(object))
= opl(dom, s0, s15)
= FALSE
mlsnetreadtoclr appears to only be granted via:
policy/modules/kernel/mls.if: mls_socket_read_to_clearance
which is not granted to racoon_t
and mlsnetread:
policy/modules/kernel/mls.if: mls_socket_read_all_levels
which is also not given to racoon_t.
mlsconstrain { peer packet } { recv }
(( FALSE ) or
(( FALSE ) and ( h1 dom l2 )) or
( FALSE ));
So, does anyone have a pointer to why my traffic is coming in at s15?
Or any other advice would be appreciated!
Thanks for your help so far,
--
Josh
--
fedora-selinux-list mailing list
fedora-selinux-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/fedora-selinux-list
