On Wed, Sep 7, 2022 at 4:56 PM Dominick Grift <dominick.grift@xxxxxxxxxxx> wrote: > Ted Toth <txtoth@xxxxxxxxx> writes: > > systemd uses a helper process (sd-listen) to create sockets and pass > > their fds back to its parent. I've patched systemd to call semanage to > > get the context for the port if it exists and create a context using > > the returned type when calling setsockcreatecon. Everything looks > > right i.e. the port type is retrieved, the context is created and > > setsockcreatecon is called without errors. However 'netstat -Z' shows > > the listening sockets type as init_t and not the type in the > > setsockcreatecon call, is this the expected behavior? Can anyone help > > me understand why this is happening? > > It is probably the context of the process listening on the port and not > the context of the socket that binds to the port That's a good point, I would have thought it would have looked at the socket itself but perhaps it is the calling process' label. Actually, it might be the fd's label associated with the socket; that would explain it. Someone would need to look at the netstat sources to confirm. -- paul-moore.com
