named avc (Fedora 8)

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Paul Howarth wrote:
> Got this one today:
> 
> type=AVC msg=audit(1202724149.875:1426): avc:  denied  { name_bind } for
>  pid=2468 comm="named" src=2605 scontext=system_u:system_r:named_t:s0
> tcontext=system_u:object_r:bgp_port_t:s0 tclass=udp_socket
> type=SYSCALL msg=audit(1202724149.875:1426): arch=c000003e syscall=49
> success=no exit=-13 a0=38 a1=41400d70 a2=1c a3=41400b6c items=0 ppid=1
> pid=2468 auid=4294967295 uid=25 gid=25 euid=25 suid=25 fsuid=25 egid=25
> sgid=25 fsgid=25 tty=(none) comm="named" exe="/usr/sbin/named"
> subj=system_u:system_r:named_t:s0 key=(null)
> 
> 
> I suspect that this snippet from the logwatch report is related:
> 
> could not update an IPv6 random query port: permission denied: 1 Time(s)
> 
> I guess I need to specify the query-source and query-source-v6 bind
> options to tie this down?
> 
> Paul.
> 
> -- 
> fedora-selinux-list mailing list
> fedora-selinux-list at redhat.com
> https://www.redhat.com/mailman/listinfo/fedora-selinux-list
This is an interesting bug, well at least to me.  SELinux ports are
labeled with a an attribute of port_type.  Ports < 1024 are labeled as
reserved_port_type.

So we have a line in bind that says it can name_bind to all unreserved
ports.  And this calls into a interface that has this line

allow $1 { port_type -reserved_port_type }:udb_socket name_bind;

Everything looks good.  Well not really because we also group a few
ports with a single port type.

 network_port(bgp, tcp,179,s0, udp,179,s0, tcp,2605,s0, udp,2605,s0)

The network_port macro assigns the examines the port numbers and if it
finds one < 1024, it assigns the port type as reserved_port_type.  As
you can see bgp_port_t includes reserved_port_type ports and non
reserved port types.  So you were unlucky enough to hit on one of these
ports.

I have changed the interface to allow all ports > 1024 in todays rawhide.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.8 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org

iEYEARECAAYFAkexrjAACgkQrlYvE4MpobP99QCg2iBmkKDTNNGOTGRuHVzy+ci5
UM4An20zuX0HjAp8uXrmB4Ty8M38u02b
=mArL
-----END PGP SIGNATURE-----