Re: context of socket passed between processes

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Wed, Sep 7, 2022 at 4:56 PM Dominick Grift
<dominick.grift@xxxxxxxxxxx> wrote:
> Ted Toth <txtoth@xxxxxxxxx> writes:
> > systemd uses a helper process (sd-listen) to create sockets and pass
> > their fds back to its parent. I've patched systemd to call semanage to
> > get the context for the port if it exists and create a context using
> > the returned type when calling setsockcreatecon. Everything looks
> > right i.e. the port type is retrieved, the context is created and
> > setsockcreatecon is called without errors. However 'netstat -Z' shows
> > the listening sockets type as init_t and not the type in the
> > setsockcreatecon call, is this the expected behavior? Can anyone help
> > me understand why this is happening?
>
> It is probably the context of the process listening on the port and not
> the context of the socket that binds to the port

That's a good point, I would have thought it would have looked at the
socket itself but perhaps it is the calling process' label.  Actually,
it might be the fd's label associated with the socket; that would
explain it.  Someone would need to look at the netstat sources to
confirm.

-- 
paul-moore.com



[Index of Archives]     [Selinux Refpolicy]     [Linux SGX]     [Fedora Users]     [Fedora Desktop]     [Yosemite Photos]     [Yosemite Camping]     [Yosemite Campsites]     [KDE Users]     [Gnome Users]

  Powered by Linux