| Summary: | sec-policy/selinux-miniupnpd MIA | ||
|---|---|---|---|
| Product: | Gentoo Linux | Reporter: | Nico Baggus <mlspamcb> |
| Component: | Hardened | Assignee: | SE Linux Bugs <selinux> |
| Status: | RESOLVED OBSOLETE | ||
| Severity: | normal | ||
| Priority: | Normal | ||
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Package list: | Runtime testing required: | --- | |
With a restart of miniupnpd involved:
Some extra messages:
avc: denied { getopt } for pid=7658 comm="miniupnpd" lport=255 scontext=system_u:system_r:initrc_t tcontext=system_u:system_r:initrc_t tclass=rawip_socket
avc: denied { name_bind } for pid=7765 comm="miniupnpd" src=81 scontext=system_u:system_r:initrc_t tcontext=system_u:object_r:reserved_port_t tclass=tcp_socket
avc: denied { name_bind } for pid=8070 comm="miniupnpd" src=81 scontext=system_u:system_r:initrc_t tcontext=system_u:object_r:reserved_port_t tclass=tcp_socket
avc: denied { read write } for pid=8393 comm="miniupnpd" name="tty0" dev=tmpfs ino=2195 scontext=root:sysadm_r:run_init_t tcontext=system_u:object_r:tty_device_t tclass=chr_file
avc: denied { name_bind } for pid=8441 comm="miniupnpd" src=81 scontext=system_u:system_r:initrc_t tcontext=system_u:object_r:reserved_port_t tclass=tcp_socket
avc: denied { read write } for pid=8478 comm="miniupnpd" name="tty0" dev=tmpfs ino=2195 scontext=root:sysadm_r:run_init_t tcontext=system_u:object_r:tty_device_t tclass=chr_file
avc: denied { read write } for pid=8537 comm="miniupnpd" name="tty0" dev=tmpfs ino=2195 scontext=root:sysadm_r:run_init_t tcontext=system_u:object_r:tty_device_t tclass=chr_file
avc: denied { name_bind } for pid=8564 comm="miniupnpd" src=81 scontext=system_u:system_r:initrc_t tcontext=system_u:object_r:reserved_port_t tclass=tcp_socket
avc: denied { name_bind } for pid=9177 comm="miniupnpd" src=81 scontext=system_u:system_r:initrc_t tcontext=system_u:object_r:reserved_port_t tclass=tcp_socket
avc: denied { module_request } for pid=9177 comm="miniupnpd" kmod="netdev-ppp0" scontext=system_u:system_r:initrc_t tcontext=system_u:system_r:kernel_t tclass=system
module miniupnpd 1.0;
require {
type kernel_t;
type tty_device_t;
type reserved_port_t;
type initrc_t;
type run_init_t;
class tcp_socket name_bind;
class system module_request;
class chr_file { read write };
class rawip_socket { getopt create };
}
============= initrc_t ==============
allow initrc_t kernel_t:system module_request;
allow initrc_t reserved_port_t:tcp_socket name_bind;
allow initrc_t self:rawip_socket { getopt create };
#============= run_init_t ==============
allow run_init_t tty_device_t:chr_file { read write };
There is no policy for miniupnpd yet, so that one still needs to be created. Anyone up for this? I stopped using selinux, because it caused my system to more & more misbehave. (amongst others vixie-cron) where all solutions i could find didn't help. or broke it further. [ even in permissive mode, which is clearly NOT honorred in dbus & vixie-cron ] Not using permissive mode fails ppp, dibbler, openswan and a lot more ==> no more selinux atm. it causes much more harm than it potentialy solve. Although the question is then still valid, unless someone else steps up, I consider this to be obsolete then. Don't hesitate to reopen if you want to try out SELinux again (and who knows by then, upstream has support for miniupnpd too?) |
Missing ( items? in) a miniupnpd policy? Reproducible: Always Actual Results: avc: denied { getopt } for pid=7658 comm="miniupnpd" lport=255 scontext=system_u:system_r:initrc_t tcontext=system_u:system_r:initrc_t tclass=rawip_socket avc: denied { create } for pid=7658 comm="miniupnpd" scontext=system_u:system_r:initrc_t tcontext=system_u:system_r:initrc_t tclass=rawip_socket avc: denied { getopt } for pid=7658 comm="miniupnpd" lport=255 scontext=system_u:system_r:initrc_t tcontext=system_u:system_r:initrc_t tclass=rawip_socket avc: denied { create } for pid=7658 comm="miniupnpd" scontext=system_u:system_r:initrc_t tcontext=system_u:system_r:initrc_t tclass=rawip_socket avc: denied { getopt } for pid=7658 comm="miniupnpd" lport=255 scontext=system_u:system_r:initrc_t tcontext=system_u:system_r:initrc_t tclass=rawip_socket avc: denied { create } for pid=7658 comm="miniupnpd" scontext=system_u:system_r:initrc_t tcontext=system_u:system_r:initrc_t tclass=rawip_socket avc: denied { getopt } for pid=7658 comm="miniupnpd" lport=255 scontext=system_u:system_r:initrc_t tcontext=system_u:system_r:initrc_t tclass=rawip_socket fi appearantly the miniupnpd is missing in the selinux set.. Proposed fix: ---8<--- module miniupnpd 1.0; require { type initrc_t; class rawip_socket { getopt create }; } #============= initrc_t ============== allow initrc_t self:rawip_socket { getopt create };