Re: socket activation selinux context on create

[Ted Toth <txtoth@xxxxxxxxx>]

I have set the type for the port in question using the 'semanage port'
command so the loaded policy has a type which systemd should use when
calling setsockcreatecon. It is my opinion that
socket_determine_selinux_label function should query policy for the
port type and if it has been set use it and if not fallback to its
current behavior.

Ted

On Thu, Aug 25, 2022 at 4:19 AM Lennart Poettering
<lennart@xxxxxxxxxxxxxx> wrote:
>
> On Mi, 24.08.22 11:50, Ted Toth (txtoth@xxxxxxxxx) wrote:
>
> > I don't see a way to set the context of the socket that systemd
> > listens on. If there is a way to do this please tell me otherwise I'd
> > like to see an option (SELinuxCreateContext?) added to be able to set
> > the context (setsockcreatecon) to be used by systemd when creating the
> > socket. Currently as an extra layer of security I add code called in
> > the socket activation ExecStartPre process to check that the source
> > context (peercon) can connect to the target context (getcon). If a
> > sockets context was set by systemd I would have to perform this
> > additional check as my SELinux policy would do it for me.
>
> This was proposed before, but SELinux maintainers really want that the
> loaded selinux policy picks the label, and not unit files.
>
> i.e. as I understand their philosophy: how labels are assigned should
> be encoded in the database and in the policy but not elsewhere,
> i.e. in unit files. I think that philosophy does make sense.
>
> Lennart
>
> --
> Lennart Poettering, Berlin