* Does recvfrom(2) imply { getattr }?
@ 2017-05-06 23:45 Ian Pilcher
2017-05-08 13:53 ` Stephen Smalley
0 siblings, 1 reply; 2+ messages in thread
From: Ian Pilcher @ 2017-05-06 23:45 UTC (permalink / raw)
To: selinux
I'm getting a non-fatal { getattr } denial on a UDP socket (talking to a
DNS server). strace doesn't show any fstat calls on the socket, but it
does show that recvfrom is being called.
Does recvfrom want getattr permission in order to retrieve the message
source? (The other potential system calls are poll and
ioctl(FIONREAD).)
--
========================================================================
Ian Pilcher arequipeno@gmail.com
-------- "I grew up before Mark Zuckerberg invented friendship" --------
========================================================================
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: Does recvfrom(2) imply { getattr }?
2017-05-06 23:45 Does recvfrom(2) imply { getattr }? Ian Pilcher
@ 2017-05-08 13:53 ` Stephen Smalley
0 siblings, 0 replies; 2+ messages in thread
From: Stephen Smalley @ 2017-05-08 13:53 UTC (permalink / raw)
To: Ian Pilcher, selinux
On Sat, 2017-05-06 at 18:45 -0500, Ian Pilcher wrote:
> I'm getting a non-fatal { getattr } denial on a UDP socket (talking
> to a
> DNS server). strace doesn't show any fstat calls on the socket, but
> it
> does show that recvfrom is being called.
>
> Does recvfrom want getattr permission in order to retrieve the
> message
> source? (The other potential system calls are poll and
> ioctl(FIONREAD).)
ioctl(FIONREAD) triggers a getattr permission check because it can be
used to get the file size.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2017-05-08 13:53 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-05-06 23:45 Does recvfrom(2) imply { getattr }? Ian Pilcher
2017-05-08 13:53 ` Stephen Smalley
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.