From: Nicolas Iooss <nicolas.iooss@m4x.org>
To: Russell Coker <russell@coker.com.au>
Cc: Chris PeBenito <pebenito@ieee.org>, selinux-refpolicy@vger.kernel.org
Subject: Re: [PATCH misc 3/3] networkmanager apt bootloader dpkg raid modutils tor devicekit dicts irqbalance policykit and postfix
Date: Sat, 5 Jan 2019 16:18:13 +0100 [thread overview]
Message-ID: <CAJfZ7=kRgTuVELRGMXpOFLsiKFuND3ughioEgVZD1LTRdDBVVw@mail.gmail.com> (raw)
In-Reply-To: <2798399.SdR9s7MnL5@xev>
On Thu, Jan 3, 2019 at 2:19 AM Russell Coker <russell@coker.com.au> wrote:
>
> On Thursday, 3 January 2019 11:14:06 AM AEDT Chris PeBenito wrote:
> > On 1/2/19 4:20 AM, Russell Coker wrote:
> > > Trivial stuff.
> > >
> > >
> > > Index: refpolicy-2.20180701/policy/modules/services/networkmanager.te
> > > ===================================================================
> > > --- refpolicy-2.20180701.orig/policy/modules/services/networkmanager.te
> > > +++ refpolicy-2.20180701/policy/modules/services/networkmanager.te
> > > @@ -57,6 +57,7 @@ allow NetworkManager_t self:tcp_socket {
> > >
> > > allow NetworkManager_t self:tun_socket { create_socket_perms relabelfrom
> > > relabelto }; allow NetworkManager_t self:packet_socket
> > > create_socket_perms;
> > > allow NetworkManager_t self:socket create_socket_perms;
> > >
> > > +allow NetworkManager_t self:rawip_socket { create setopt getattr write
> > > read };
> > This seems odd. Can you provide any more details on this?
>
> From memory it appeared to be some sort of ping functionality built in. Feel
> free to drop that section and apply the rest, I can do more testing on it if
> you like.
For information, I have a patch in my policy (that I never found the
time to send) which adds "allow NetworkManager_t self:rawip_socket
create_socket_perms;" with the following description:
Allow NetworkManager to use raw IP sockets
NetworkManager uses raw sockets to send and receive ICMPv6 paquets.
"ss --raw -lpn" shows:
State Recv-Q Send-Q Local Address:Port Peer Address:Port
UNCONN 0 0 :::ipv6-icmp :::*
users:(("NetworkManager",pid=31474,fd=22))
and audit.log reports AVC denials from NetworkManager for create,
setopt, getattr and write in rawip_socket class. Here is an excerpt for
a denied write ("lport=58" means "ipv6-icmp", cf. /etc/protocols):
type=AVC msg=audit(1414245913.538:386): avc: denied { write } for
pid=31474 comm="NetworkManager" lport=58
scontext=system_u:system_r:NetworkManager_t
tcontext=system_u:system_r:NetworkManager_t tclass=rawip_socket
I agree with adding the required permissions to NetworkManager (ICMPv6
is used for Router Solicitation/Router Advertisement packets).
Nicolas
prev parent reply other threads:[~2019-01-05 15:18 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-01-02 9:20 [PATCH misc 3/3] networkmanager apt bootloader dpkg raid modutils tor devicekit dicts irqbalance policykit and postfix Russell Coker
2019-01-03 0:14 ` Chris PeBenito
2019-01-03 1:19 ` Russell Coker
2019-01-05 15:18 ` Nicolas Iooss [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAJfZ7=kRgTuVELRGMXpOFLsiKFuND3ughioEgVZD1LTRdDBVVw@mail.gmail.com' \
--to=nicolas.iooss@m4x.org \
--cc=pebenito@ieee.org \
--cc=russell@coker.com.au \
--cc=selinux-refpolicy@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.