On Mon, Aug 29, 2022 at 4:22 PM Paul Moore <paul@xxxxxxxxxxxxxx> wrote: > > On Thu, Aug 25, 2022 at 9:22 AM Ted Toth <txtoth@xxxxxxxxx> wrote: > > I asked on the systemd-devel list about enabling systemd to set the > > context of a socket and got the answer I've included below. I don't > > know how a transition rule can be written to transition tcp sockets to > > multiple different target contexts, is this possible and if so how? > > Ignoring setsockcreatecon(3) as that really isn't an option here, If we determine that policy can't be written to accomplish the transition then maybe systemd will reconsider not wanting to set the socket context using a .socket file option. > sockets created via socket(2) do check to see if there is a type > transition defined in the policy. In the case of a TCP socket the > type transition would look something like this: > > type_transition <domain> <domain>:tcp_socket <new_socket_type> > > ... so you can see there is not much one can select on other than the > socket's object class. The reason is that the socket(2) call itself > is rather spartan, with not even any clue as to if this is a client or > server socket in the case of TCP. Having written many policy modules, some of which use the type_transition statement for tcp_socket objects, I do not see how it can be used to transition sockets created by systemd. And under this circumstance I see that the selinux socket create hook would not be able query the policy database for the port context since the port is not known until the bind occurs but what about having the bind hook set the socket context if it finds a sid for the port? > > Taking a step back, what are you trying to do? Perhaps there is > another approach that would get you where you want to go. I want to create socket activation services using systemd and to have the type of the socket being listened on be one that I've defined so that I can write policy to control which source types can connect to it. Thanks Ted > > > ---------- Forwarded message --------- > > From: Lennart Poettering <lennart@xxxxxxxxxxxxxx> > > Date: Thu, Aug 25, 2022 at 4:19 AM > > Subject: Re: [systemd-devel] socket activation selinux context on create > > To: Ted Toth <txtoth@xxxxxxxxx> > > Cc: <systemd-devel@xxxxxxxxxxxxxxxxxxxxx> > > > > > > On Mi, 24.08.22 11:50, Ted Toth (txtoth@xxxxxxxxx) wrote: > > > > > I don't see a way to set the context of the socket that systemd > > > listens on. If there is a way to do this please tell me otherwise I'd > > > like to see an option (SELinuxCreateContext?) added to be able to set > > > the context (setsockcreatecon) to be used by systemd when creating the > > > socket. Currently as an extra layer of security I add code called in > > > the socket activation ExecStartPre process to check that the source > > > context (peercon) can connect to the target context (getcon). If a > > > sockets context was set by systemd I would have to perform this > > > additional check as my SELinux policy would do it for me. > > > > This was proposed before, but SELinux maintainers really want that the > > loaded selinux policy picks the label, and not unit files. > > > > i.e. as I understand their philosophy: how labels are assigned should > > be encoded in the database and in the policy but not elsewhere, > > i.e. in unit files. I think that philosophy does make sense. > > > > Lennart > > -- > paul-moore.com
