Re: context of socket passed between processes

[Ondrej Mosnacek <omosnace@redhat.com>]

On Thu, Sep 8, 2022 at 4:15 PM Ted Toth <txtoth@gmail.com> wrote:
>
> On Thu, Sep 8, 2022 at 8:43 AM Ted Toth <txtoth@gmail.com> wrote:
> >
> > On Wed, Sep 7, 2022 at 5:48 PM Paul Moore <paul@paul-moore.com> wrote:
> > >
> > > On Wed, Sep 7, 2022 at 4:56 PM Dominick Grift
> > > <dominick.grift@defensec.nl> wrote:
> > > > Ted Toth <txtoth@gmail.com> writes:
> > > > > systemd uses a helper process (sd-listen) to create sockets and pass
> > > > > their fds back to its parent. I've patched systemd to call semanage to
> > > > > get the context for the port if it exists and create a context using
> > > > > the returned type when calling setsockcreatecon. Everything looks
> > > > > right i.e. the port type is retrieved, the context is created and
> > > > > setsockcreatecon is called without errors. However 'netstat -Z' shows
> > > > > the listening sockets type as init_t and not the type in the
> > > > > setsockcreatecon call, is this the expected behavior? Can anyone help
> > > > > me understand why this is happening?
> > > >
> > > > It is probably the context of the process listening on the port and not
> > > > the context of the socket that binds to the port
> > >
> > > That's a good point, I would have thought it would have looked at the
> > > socket itself but perhaps it is the calling process' label.  Actually,
> > > it might be the fd's label associated with the socket; that would
> > > explain it.  Someone would need to look at the netstat sources to
> > > confirm.
> >
> > Is there an API to query the context of a socket fd?
>
> I wrote a client which connects and calls getpeercon and indeed the
> context is what was set via setsockcreatecon so that's reassuring.
> Unfortunately it seems that netstat, ss and lsof don't have a way to
> query the context of the listening socket :( I'd like to see a
> getsockcon function (taking an fd as its argument) added to libselinux
> if it can be written.

There is a way to see a socket's context, though it's a bit obscure:

ls -ZL /proc/<PID>/fd/<FD>

-- 
Ondrej Mosnacek
Senior Software Engineer, Linux Security - SELinux kernel
Red Hat, Inc.