On Wed, Sep 7, 2022 at 5:48 PM Paul Moore <paul@xxxxxxxxxxxxxx> wrote: > > On Wed, Sep 7, 2022 at 4:56 PM Dominick Grift > <dominick.grift@xxxxxxxxxxx> wrote: > > Ted Toth <txtoth@xxxxxxxxx> writes: > > > systemd uses a helper process (sd-listen) to create sockets and pass > > > their fds back to its parent. I've patched systemd to call semanage to > > > get the context for the port if it exists and create a context using > > > the returned type when calling setsockcreatecon. Everything looks > > > right i.e. the port type is retrieved, the context is created and > > > setsockcreatecon is called without errors. However 'netstat -Z' shows > > > the listening sockets type as init_t and not the type in the > > > setsockcreatecon call, is this the expected behavior? Can anyone help > > > me understand why this is happening? > > > > It is probably the context of the process listening on the port and not > > the context of the socket that binds to the port > > That's a good point, I would have thought it would have looked at the > socket itself but perhaps it is the calling process' label. Actually, > it might be the fd's label associated with the socket; that would > explain it. Someone would need to look at the netstat sources to > confirm. Is there an API to query the context of a socket fd? > > -- > paul-moore.com
