Selinux in FC4 is blocking SCTP

[James Morris]

On Thu, 29 Sep 2005, Gregory Maxwell wrote:

> type=AVC msg=audit(1128050967.120:12221195): avc:  denied  { name_bind
> } for  pid=10749 comm="sctp_test" src=1234
> scontext=root:system_r:unconfined_t tcontext=system_u:object_r:port_t
> tclass=socket

SELinux has no protocol-level support for SCTP yet, so the SCTP socket is 
being classified by SELInux as a generic socket, but still being checked 
by the protocol-level bind() permissions.

Other parts of the code make assumptions about IP & IPv6 sockets, 
classifying them as either TCP, UDP or 'RAW' (which is a 
catch-all for IP protocols notably including ICMP).

We could add a policy entry for unconfined_t to allow name_bind for the 
socket class, but we'd also hit problems where it defaults to a 'raw' 
socket.

We can't simply classify SCTP as 'raw', as it has some different 
semantics, such as multiple local and remote addresses, which we need to 
investigate and develop proper controls for.

We proably need to rethink the way IP sockets default to 'raw', as new IP 
protocols are sometimes developed (DCCP has just been implemented) and we 
don't know that the 'raw' IP controls always appropriate.


- James
-- 
James Morris
<jmorris at namei.org>