-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 03/13/2011 07:15 PM, Mark Montague wrote:
> On March 11, 2011 13:38 , Dominick Grift <domg472@xxxxxxxxx> wrote:
>> On 03/11/2011 07:08 PM, Mark Montague wrote:
>>> Fedora 14, httpd is working correctly, however the
>>> httpd_can_network_connect boolean grants more access than I want. I'd
>>> like httpd to be able to open connections on any port, but only via a
>>> specific network interface (lo0) and no others (eth0, etc.), while still
>>> accepting HTTP connections on all interfaces.
>>>
>>>
>>>
>>>
>>> So you could maybe declare one or more new network interface object types.
>>>
>>> label your network interfaces with the new types using semanage interface
>>>
>>> then use the tcp_send tcp_recv egress ingress permissions to achieve
>>> what you want ( i am guessing you can use egress / ingress to allow
>>> input /output)
>
> Thanks for the reply, Dominic. I added the following as a local module:
>
> type loopbackif_t;
> allow httpd_t loopbackif_t : netif {tcp_send tcp_recv egress ingress };
> allow httpd_sys_script_t loopbackif_t : netif {tcp_send tcp_recv egress
> ingress};
>
> And then ran:
>
> semanage interface -a -t loopbackif_t lo
>
> Unfortunately, the result is the same as for labeling packets on the
> interface: No traffic is allowed through because httpd does not have
> permission for name_connect. And if I add a rule to permit this
> (equivalent to setting the httpd_can_network_connect boolean) then httpd
> can connect via ALL interfaces, not just via the loopback interface.
Yes but can it also use the connection? I mean if it can name_connect
but not really use the connection because it cant egress, ingress or
whatever then you may be able to achieve your goals also.
not sure though.
> Does anyone have any other ideas or suggestions? In the meantime, I'll
> investigate whether it might be possible to change the targeted policy
> for httpd to use only packet labels for controlling network traffic
> instead of limiting system calls and ports.
>
> --
> Mark Montague
> mark@xxxxxxxxxxx
>
> --
> selinux mailing list
> selinux@xxxxxxxxxxxxxxxxxxxxxxx
> https://admin.fedoraproject.org/mailman/listinfo/selinux
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.16 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAk19Cm8ACgkQMlxVo39jgT979wCfV+GmwAfFRRQ3LVaR7QVDLBsY
qpcAoK+ccfrKmseIWRgGLq/kyKJ/QDNw
=Cj7h
-----END PGP SIGNATURE-----
--
selinux mailing list
selinux@xxxxxxxxxxxxxxxxxxxxxxx
https://admin.fedoraproject.org/mailman/listinfo/selinux
