|
 |
0cec52 |
From 3073efc112929b535f3a832c6f99e0dbe3af29ca Mon Sep 17 00:00:00 2001
|
|
|
0cec52 |
From: Masatake YAMATO <yamato@redhat.com>
|
|
|
0cec52 |
Date: Thu, 14 Dec 2017 15:57:58 +0900
|
|
|
709a1f |
Subject: [PATCH] sepolicy-generate: Handle more reserved port types
|
|
|
0cec52 |
|
|
|
0cec52 |
Currently only reserved_port_t, port_t and hi_reserved_port_t are
|
|
|
0cec52 |
handled as special when making a ports-dictionary. However, as fas as
|
|
|
0cec52 |
corenetwork.te.in of serefpolicy, unreserved_port_t and
|
|
|
0cec52 |
ephemeral_port_t should be handled in the same way, too.
|
|
|
0cec52 |
|
|
|
0cec52 |
(Details) I found the need of this change when I was using
|
|
|
0cec52 |
selinux-polgengui. Though tcp port 12345, which my application may
|
|
|
0cec52 |
use, was given to the gui, selinux-polgengui generates expected te
|
|
|
0cec52 |
file and sh file which didn't utilize the tcp port.
|
|
|
0cec52 |
|
|
|
0cec52 |
selinux-polgengui checks whether a port given via gui is already typed
|
|
|
0cec52 |
or not.
|
|
|
0cec52 |
|
|
|
0cec52 |
If it is already typed, selinux-polgengui generates a te file having
|
|
|
0cec52 |
rules to allow the application to use the port. (A)
|
|
|
0cec52 |
|
|
|
0cec52 |
If not, it seems for me that selinux-polgengui is designed to generate
|
|
|
0cec52 |
a te file having rules to allow the application to own(?) the port;
|
|
|
0cec52 |
and a sh file having a command line to assign the application own type
|
|
|
0cec52 |
to the port. (B)
|
|
|
0cec52 |
|
|
|
0cec52 |
As we can see the output of `semanage port -l' some of ports for
|
|
|
0cec52 |
specified purpose have types already. The important point is that the
|
|
|
0cec52 |
rest of ports also have types already:
|
|
|
0cec52 |
|
|
|
0cec52 |
hi_reserved_port_t tcp 512-1023
|
|
|
0cec52 |
hi_reserved_port_t udp 512-1023
|
|
|
0cec52 |
unreserved_port_t tcp 1024-32767, 61001-65535
|
|
|
0cec52 |
unreserved_port_t udp 1024-32767, 61001-65535
|
|
|
0cec52 |
ephemeral_port_t tcp 32768-61000
|
|
|
0cec52 |
ephemeral_port_t udp 32768-61000
|
|
|
0cec52 |
|
|
|
0cec52 |
As my patch shows, the original selinux-polgengui ignored
|
|
|
0cec52 |
hi_reserved_port_t; though hi_reserved_port_t is assigned,
|
|
|
0cec52 |
selinux-polgengui considered ports 512-1023 are not used. As the
|
|
|
0cec52 |
result selinux-polgengui generates file sets of (B).
|
|
|
0cec52 |
|
|
|
0cec52 |
For the purpose of selinux-polgengui, I think unreserved_port_t and
|
|
|
0cec52 |
ephemeral_port_t are treated as the same as hi_reserved_port_t.
|
|
|
0cec52 |
|
|
|
0cec52 |
Signed-off-by: Masatake YAMATO <yamato@redhat.com>
|
|
|
0cec52 |
|
|
|
0cec52 |
Fedora only patch:
|
|
|
0cec52 |
https://lore.kernel.org/selinux/20150610.190635.1866127952891120915.yamato@redhat.com/
|
|
|
0cec52 |
---
|
|
|
0cec52 |
python/sepolicy/sepolicy/generate.py | 4 +++-
|
|
|
0cec52 |
1 file changed, 3 insertions(+), 1 deletion(-)
|
|
|
0cec52 |
|
|
|
0cec52 |
diff --git a/python/sepolicy/sepolicy/generate.py b/python/sepolicy/sepolicy/generate.py
|
|
|
0cec52 |
index 7175d36b..93caedee 100644
|
|
|
0cec52 |
--- a/python/sepolicy/sepolicy/generate.py
|
|
|
0cec52 |
+++ b/python/sepolicy/sepolicy/generate.py
|
|
|
0cec52 |
@@ -100,7 +100,9 @@ def get_all_ports():
|
|
|
0cec52 |
for p in sepolicy.info(sepolicy.PORT):
|
|
|
0cec52 |
if p['type'] == "reserved_port_t" or \
|
|
|
0cec52 |
p['type'] == "port_t" or \
|
|
|
0cec52 |
- p['type'] == "hi_reserved_port_t":
|
|
|
0cec52 |
+ p['type'] == "hi_reserved_port_t" or \
|
|
|
0cec52 |
+ p['type'] == "ephemeral_port_t" or \
|
|
|
0cec52 |
+ p['type'] == "unreserved_port_t":
|
|
|
0cec52 |
continue
|
|
|
0cec52 |
dict[(p['low'], p['high'], p['protocol'])] = (p['type'], p.get('range'))
|
|
|
0cec52 |
return dict
|
|
|
0cec52 |
--
|
|
|
0cec52 |
2.21.0
|
|
|
0cec52 |
|