Skip to contentSkip to conversation

Grant ping_t getattr on rawip_socket

PATCH New Luis Ressel 2 participants 3 messages Jun 26, 2014 – Aug 18, 2014

lore
Share & tools
lore

Luis Ressel

author
#0 lore raw

PATCH 1/1 Grant ping_t getattr on rawip_socket

If the (sadly nearly undocumented) Linux kernel feature which allows specific user groups to send ICMP echos without CAP_NET_RAW (configurable with the sysctl net.ipv4.ping_group_range, available since 3.0) is used, ping needs the getattr permission of the rawip_socket class in order to work.

---
 policy/modules/admin/netutils.te | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
policy/modules/admin/netutils.te +1 -1
index 7aa7384..570bf2c 100644
@@ -110,7 +110,7 @@ allow ping_t self:capability { setuid net_raw };
 allow ping_t self:process { getcap setcap };
 dontaudit ping_t self:capability sys_tty_config;
 allow ping_t self:tcp_socket create_socket_perms;
-allow ping_t self:rawip_socket { create ioctl read write bind getopt setopt };
+allow ping_t self:rawip_socket { create ioctl read write bind getopt setopt getattr };
 allow ping_t self:packet_socket { create ioctl read write bind getopt setopt };
 allow ping_t self:netlink_route_socket create_netlink_socket_perms;
Signature · 1 line
2.0.0
#2 lore raw

PATCH 1/1 Grant ping_t getattr on rawip_socket

In reply to Luis Ressel
Quoted 14 lines · Luis Ressel

If the (sadly nearly undocumented) Linux kernel feature which allows specific user groups to send ICMP echos without CAP_NET_RAW (configurable with the sysctl net.ipv4.ping_group_range, available since 3.0) is used, ping needs the getattr permission of the rawip_socket class in order to work.

---
 policy/modules/admin/netutils.te | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
policy/modules/admin/netutils.te +0 -0
index 7aa7384..570bf2c 100644

policy/modules/admin/netutils.te allow ping_t self:capability { setuid net_raw }; · line 115

Quoted 7 lines
policy/modules/admin/netutils.te +1 -1
@@ -110,7 +110,7 @@ allow ping_t self:capability { setuid net_raw };
 allow ping_t self:process { getcap setcap };
 dontaudit ping_t self:capability sys_tty_config;
 allow ping_t self:tcp_socket create_socket_perms;
-allow ping_t self:rawip_socket { create ioctl read write bind getopt setopt };
+allow ping_t self:rawip_socket { create ioctl read write bind getopt setopt getattr };
 allow ping_t self:packet_socket { create ioctl read write bind getopt setopt };
 allow ping_t self:netlink_route_socket create_netlink_socket_perms;

Merged.

Signature · 3 lines
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com