* [refpolicy] [PATCH] ntp only uses UDP, remove TCP permissions
@ 2018-02-24 14:52 David Sugar
2018-02-27 22:26 ` Chris PeBenito
0 siblings, 1 reply; 2+ messages in thread
From: David Sugar @ 2018-02-24 14:52 UTC (permalink / raw)
To: refpolicy
The NTP protocol states it only used UDP for network communication. Remove currently allowed access to TCP that should not be needed.
Signed-off-by: Dave Sugar <dsugar@tresys.com>
---
ntp.te | 8 +-------
1 file changed, 1 insertion(+), 7 deletions(-)
diff --git a/ntp.te b/ntp.te
index f321fb6..c25a3ff 100644
--- a/ntp.te
+++ b/ntp.te
@@ -58,7 +58,6 @@ allow ntpd_t self:process { signal_perms getcap setcap setsched setrlimit };
allow ntpd_t self:fifo_file rw_fifo_file_perms;
allow ntpd_t self:shm create_shm_perms;
allow ntpd_t self:socket create;
-allow ntpd_t self:tcp_socket { accept listen };
allow ntpd_t self:unix_dgram_socket sendto;
allow ntpd_t ntp_conf_t:file read_file_perms;
@@ -99,20 +98,15 @@ kernel_request_load_module(ntpd_t)
corenet_all_recvfrom_unlabeled(ntpd_t)
corenet_all_recvfrom_netlabel(ntpd_t)
-corenet_tcp_sendrecv_generic_if(ntpd_t)
corenet_udp_sendrecv_generic_if(ntpd_t)
-corenet_tcp_sendrecv_generic_node(ntpd_t)
corenet_udp_sendrecv_generic_node(ntpd_t)
corenet_udp_bind_generic_node(ntpd_t)
+corenet_sendrecv_ntp_client_packets(ntpd_t)
corenet_sendrecv_ntp_server_packets(ntpd_t)
corenet_udp_bind_ntp_port(ntpd_t)
corenet_udp_sendrecv_ntp_port(ntpd_t)
-corenet_sendrecv_ntp_client_packets(ntpd_t)
-corenet_tcp_connect_ntp_port(ntpd_t)
-corenet_tcp_sendrecv_ntp_port(ntpd_t)
-
corecmd_exec_bin(ntpd_t)
corecmd_exec_shell(ntpd_t)
--
2.14.3
^ permalink raw reply related [flat|nested] 2+ messages in thread
* [refpolicy] [PATCH] ntp only uses UDP, remove TCP permissions
2018-02-24 14:52 [refpolicy] [PATCH] ntp only uses UDP, remove TCP permissions David Sugar
@ 2018-02-27 22:26 ` Chris PeBenito
0 siblings, 0 replies; 2+ messages in thread
From: Chris PeBenito @ 2018-02-27 22:26 UTC (permalink / raw)
To: refpolicy
On 02/24/2018 09:52 AM, David Sugar via refpolicy wrote:
> The NTP protocol states it only used UDP for network communication. Remove currently allowed access to TCP that should not be needed.
>
> Signed-off-by: Dave Sugar <dsugar@tresys.com>
> ---
> ntp.te | 8 +-------
> 1 file changed, 1 insertion(+), 7 deletions(-)
>
> diff --git a/ntp.te b/ntp.te
> index f321fb6..c25a3ff 100644
> --- a/ntp.te
> +++ b/ntp.te
> @@ -58,7 +58,6 @@ allow ntpd_t self:process { signal_perms getcap setcap setsched setrlimit };
> allow ntpd_t self:fifo_file rw_fifo_file_perms;
> allow ntpd_t self:shm create_shm_perms;
> allow ntpd_t self:socket create;
> -allow ntpd_t self:tcp_socket { accept listen };
> allow ntpd_t self:unix_dgram_socket sendto;
>
> allow ntpd_t ntp_conf_t:file read_file_perms;
> @@ -99,20 +98,15 @@ kernel_request_load_module(ntpd_t)
>
> corenet_all_recvfrom_unlabeled(ntpd_t)
> corenet_all_recvfrom_netlabel(ntpd_t)
> -corenet_tcp_sendrecv_generic_if(ntpd_t)
> corenet_udp_sendrecv_generic_if(ntpd_t)
> -corenet_tcp_sendrecv_generic_node(ntpd_t)
> corenet_udp_sendrecv_generic_node(ntpd_t)
> corenet_udp_bind_generic_node(ntpd_t)
>
> +corenet_sendrecv_ntp_client_packets(ntpd_t)
> corenet_sendrecv_ntp_server_packets(ntpd_t)
> corenet_udp_bind_ntp_port(ntpd_t)
> corenet_udp_sendrecv_ntp_port(ntpd_t)
>
> -corenet_sendrecv_ntp_client_packets(ntpd_t)
> -corenet_tcp_connect_ntp_port(ntpd_t)
> -corenet_tcp_sendrecv_ntp_port(ntpd_t)
> -
> corecmd_exec_bin(ntpd_t)
> corecmd_exec_shell(ntpd_t)
Merged.
--
Chris PeBenito
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2018-02-27 22:26 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-02-24 14:52 [refpolicy] [PATCH] ntp only uses UDP, remove TCP permissions David Sugar
2018-02-27 22:26 ` Chris PeBenito
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.