List members,
I have recently upgraded to the 2.6.30 kernel, and I am now using the
new networking controls. I have noticed difficulties that seem to me to
be similar difficulties in some other recent posts, so I wanted to make
a brief post regarding the matter.
I tested the packet rules by creating packet labels for the local ipv6
(::1), my printer, my router, and general internet addresses. I did not
give my son's user permission to access the printer. When his user
attempted to access the printer, the application being used would hang
and need to be shut down. Allowing local ipv6 packets to be
sent/received by his user prevented the application from hanging, but
also allowed his user to access the printer - with no packet access
allowed to the printer. When this did not restrict his access, I added
a constraint in the constraints file:
constrain packet { recv send }
(
r1 != his_user_name_r
or t2 == allow_packet
);
This constraint prevented access to the local ipv6 packets until I added
the attribute type to those packets, but access to the printer was not
affected.
For now my packet rules for Internet access appear to work and I am
limiting printer access through the print service directly. I do not
presently have time to troubleshoot the matter, so for now this will do
as a solution; but I am curious why the packet controls (especially
combined with the constraint) are not preventing printer access.
I know that there are other controls that are intended to restrict
network access, and I have not yet had the time to explore using these
controls. I am hopeful that by combining these controls with the
SECMARK controls, I will have better control of network traffic; however
one recent post (by Jason on February 2) seems to indicate that there
may still be some difficulty getting these other controls to properly
restrict network traffic as well: "I found that my test app (with the
allow rule below), could still read and display packet data coming in on
any interface even with all interfaces assigned a unique peer_t...."
I really appreciate the efforts of everyone involved in the development
of SELinux, and I hope my comments will help the developers to make the
new controls as effective and easy to implement as the previous controls
were.
-Ken-
--
selinux mailing list
selinux@xxxxxxxxxxxxxxxxxxxxxxx
https://admin.fedoraproject.org/mailman/listinfo/selinux
