dhclient-script avc error f7

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Tim Fenn wrote:
> On Tue, 2 Oct 2007 11:07:09 -0700 Tim Fenn <fenn at stanford.edu> wrote:
> 
>> I recently dove into policy writing, but will rewrite my policy based
>> on the domain transfer suggestion and report back once I have
>> something working.
>>
> 
> Here is the policy I cooked up:
> 
> <policy>
> policy_module(mydhcp,1.0.0)
> 
> ########################################
> #
> # Declarations
> #
> require {
>         type dhcpc_t;
>         type insmod_t;
>         type iptables_t;
>         class rawip_socket { read write };
> }
> 
> iptables_domtrans(dhcpc_t)
> 
> #============= insmod_t ==============
> allow insmod_t iptables_t:rawip_socket { read write };
> </policy>
> 
> Not sure if it would be best to transfer iptables_t to modutils here?
> 
> -Tim
> 
This looks like iptables is leaking a file descriptor, and the kernel is
checking if insmod_t has access to it.  It does not so the kernel closes
it and replaces it with /dev/null.  So this is not going to affect you
code, but should be reported as a bug in iptables.

fcntl(fd, F_SETFD, FD_CLOEXEC)

should be closed on on open file descriptors before fork/exec.


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org

iD8DBQFHBpH0rlYvE4MpobMRAtwMAKDTSbyTUSeXvaMWafn8lxDQ9JpRLgCgzSNU
KV2dnNk+NphbkQRFeZiWehg=
=OY/M
-----END PGP SIGNATURE-----