Re: Reissue previous patch

[Daniel J Walsh <dwalsh@redhat.com>]

James Carter wrote:

>Merged with some changes.
>
>On Tue, 2004-11-30 at 16:19, Daniel J Walsh wrote:
>  
>
>>Several can_network_clients were wrong
>>    
>>
><snip>
>  
>
>>diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/mount.te policy-1.19.7/domains/program/mount.te
>>--- nsapolicy/domains/program/mount.te	2004-11-09 13:35:12.000000000 -0500
>>+++ policy-1.19.7/domains/program/mount.te	2004-11-30 06:18:45.000000000 -0500
>>@@ -64,7 +64,7 @@
>> 
>> ifdef(`portmap.te', `
>> # for nfs
>>-can_network(mount_t)
>>+can_network_server(mount_t)
>> can_ypbind(mount_t)
>> allow mount_t port_t:{ tcp_socket udp_socket } name_bind;
>> allow mount_t reserved_port_t:{ tcp_socket udp_socket } name_bind;
>>    
>>
>
>Left it as can_network(), otherwise, I can't mount a NFS partition.  May
>be able to separate the NFS client and server usages, by I haven't
>looked into it.
>
><snip>
>  
>
>>diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/howl.te policy-1.19.7/domains/program/unused/howl.te
>>--- nsapolicy/domains/program/unused/howl.te	2004-10-13 22:41:57.000000000 -0400
>>+++ policy-1.19.7/domains/program/unused/howl.te	2004-11-30 06:18:45.000000000 -0500
>>@@ -5,7 +5,7 @@
>> 
>> daemon_domain(howl)
>> allow howl_t proc_t:file { getattr read };
>>-can_network(howl_t)
>>+can_network_server(howl_t)
>> can_ypbind(howl_t)
>> allow howl_t self:capability { kill net_admin };
>> 
>>    
>>
>
>I used:
>-allow howl_t proc_t:file { getattr read };
>-can_network(howl_t)
>+allow howl_t proc_net_t:dir search;
>+allow howl_t proc_net_t:file {getattr read };
>+can_network_server(howl_t)
>
><snip>
>  
>
>>diff --exclude-from=exclude -N -u -r nsapolicy/macros/program/ssh_macros.te policy-1.19.7/macros/program/ssh_macros.te
>>--- nsapolicy/macros/program/ssh_macros.te	2004-11-30 05:59:40.000000000 -0500
>>+++ policy-1.19.7/macros/program/ssh_macros.te	2004-11-30 06:18:45.000000000 -0500
>>@@ -82,7 +82,7 @@
>> 
>> # Grant permissions needed to create TCP and UDP sockets and
>> # to access the network.
>>-can_network($1_ssh_t)
>>+can_network_client_tcp($1_ssh_t)
>> can_ypbind($1_ssh_t)
>> 
>> # Use capabilities.
>>    
>>
>
>I used can_network_client() instead.
>
>The following was needed by ssh during my normal usage of it (like
>updating the CVS tree on sourceforge.)
>
>allow user_ssh_t self:udp_socket create
>
>  
>
I think this is caused by the resolver.  This is why I would like to get 
to the point of using
can_resolve() where we specify the exact port that you can connect to.

Dan

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.