Re: can_network patch

[James Carter <jwcart2@epoch.ncsc.mil>]

This patch is on the right track.

On Sat, 2004-11-06 at 00:33, Daniel J Walsh wrote:
> This is the patch that eliminates connect from can_network.
> 
> The batch basically does a couple of things
> 
> can_network now calls
> can_tcp_network
> can_udp_network

I think can_network should have the same functionality as before.
There should be new macros for the reduced permissions.
It seems like we should have at least these macros:

can_tcp_client (or can_tcp_out) - connect, etc
can_tcp_server (or can_tcp_in) - bind, listen, accept, etc
can_udp
can_udp_connect - if connect is needed.

This patch has 34 lines adding connect permissions.  We should
definitely seek to reduce the number of lines related to networking
outside of the network macros.  I think Russell made a similar comment a
while back.

> diff --exclude-from=exclude -N -u -r policy-1.18.2/macros/core_macros.te policy-1.18.2.old/macros/core_macros.te
> --- policy-1.18.2/macros/core_macros.te	2004-11-05 23:39:10.000000000 -0500
> +++ policy-1.18.2.old/macros/core_macros.te	2004-11-05 23:57:55.360848660 -0500
> @@ -132,22 +132,32 @@
>  #
>  # Permissions for using sockets.
>  # 
> -define(`rw_socket_perms', `{ ioctl read getattr write setattr append bind connect getopt setopt shutdown }')
> +define(`rw_socket_perms', `{ ioctl read getattr write setattr append bind getopt setopt shutdown }')
>  
>  #
>  # Permissions for creating and using sockets.
>  # 
> -define(`create_socket_perms', `{ create ioctl read getattr write setattr append bind connect getopt setopt shutdown }')
> +define(`connected_socket_perms', `{ create rw_socket_perms }')

This doesn't make sense to me.  Why grant "create", if already
connected?

> +
> +#
> +# Permissions for creating, connecting and using sockets.
> +# 
> +define(`create_socket_perms', `{ connected_socket_perms connect }')
>  
>  #
>  # Permissions for using stream sockets.
>  # 
> -define(`rw_stream_socket_perms', `{ ioctl read getattr write setattr append bind connect getopt setopt shutdown listen accept }')
> +define(`rw_stream_socket_perms', `{ rw_socket_perms listen accept }')
> +
> +#
> +# Permissions for creating and using stream sockets.
> +# 
> +define(`connected_stream_socket_perms', `{ create rw_stream_socket_perms }')
>  

Same thing here.

-- 
James Carter <jwcart2@epoch.ncsc.mil>
National Security Agency

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.