Adding local nodecon's through semanage
Hi List,
I had a small conversation with Stephen Smalley on the fedora-selinux-list about an easy way to add
(local) nodecon's on a SELinux enabled system. As this is not implemented in semanage yet
he gave me the advice to revive a discussion[1] on this list from 2006. It began because a patch against
semanage was posted which enabled nodecon support. It seems that the patch never got commited
because it didn't work as expected.
I writing because I would like to know if there's any chance to get that fully working. I played around
with the patch and I could set labels to nodes and my SELinux seems to respect these settings.
f.i
# semanage node -t blacknetwork_node_t -a -p 0 -M 255.255.255.255
192.168.100.54
$ ./socat -u TCP4-LISTEN:5555,bind=192.168.100.54,reuseaddr,fork -
...
type=AVC msg=audit(1215085777.002:689775728): avc: denied { node_bind
} for pid=26627 comm="socat" saddr=192.168.100.54 src=5555
scontext=user_u:user_r:exe_t:s0
tcontext=system_u:object_r:blacknetwork_node_t:s0 tclass=tcp_socketSo, this seems to work. But I run into problems when I told semanage about the
*actual* netmask of this node, which is 255.255.255.0. The tcontext string switched from
"blacknetwork_node_t" to the generic "node_t".
Kind regards,
Chris
[1] http://www.nsa.gov/selinux/list-archive/0609/16754.cfm
Signature · 16 lines
tarent Gesellschaft für Softwareentwicklung und IT-Beratung mbH Heilsbachstr. 24, 53123 Bonn | Poststr. 4-5, 10178 Berlin fon: +49(228) / 52675-0 | fon: +49(30) / 27594853 fax: +49(228) / 52675-25 | fax: +49(30) / 78709617 Geschäftsführer Boris Esser, Elmar Geese HRB AG Bonn 5168 Ust-ID: DE122264941 -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.
Quoted 11 lines · Christian Kuester
Hi List,
I had a small conversation with Stephen Smalley on the fedora-selinux-list about an easy way to add
(local) nodecon's on a SELinux enabled system. As this is not implemented in semanage yet
he gave me the advice to revive a discussion[1] on this list from 2006. It began because a patch against
semanage was posted which enabled nodecon support. It seems that the patch never got commited
because it didn't work as expected.
Hello,
I think the idea of adding network node support to semanage is a good one. Unfortunately I have no experience with python or semanage so I'm probably not the best person to provide coding advice or help.
Who does look after semanage these days?
Signature · 7 lines
paul moore linux @ hp -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.
Quoted 13 lines · Paul Moore
Quoted 11 lines · Christian Kuester
Hi List,
I had a small conversation with Stephen Smalley on the fedora-selinux-list about an easy way to add
(local) nodecon's on a SELinux enabled system. As this is not implemented in semanage yet
he gave me the advice to revive a discussion[1] on this list from 2006. It began because a patch against
semanage was posted which enabled nodecon support. It seems that the patch never got commited
because it didn't work as expected.
Quoted 7 lines
Hello,
I think the idea of adding network node support to semanage is a good one. Unfortunately I have no experience with python or semanage so I'm probably not the best person to provide coding advice or help.
Who does look after semanage these days?
Yes, I agree that we ought to support this functionality, especially as libsemanage already provides the interfaces even if there are lingering issues in the implementation.
Joshua can likely help with the libsemanage/libsepol side and Dan with the semanage front end side.
Christian - do you have a re-based copy of the patch against the svn trunk that you were testing with?
Signature · 8 lines
Stephen Smalley National Security Agency -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.
Quoted 21 lines · Stephen Smalley
Quoted 20 lines · Paul Moore
Quoted 11 lines · Christian Kuester
Hi List,
I had a small conversation with Stephen Smalley on the fedora-selinux-list about an easy way to add
(local) nodecon's on a SELinux enabled system. As this is not implemented in semanage yet
he gave me the advice to revive a discussion[1] on this list from 2006. It began because a patch against
semanage was posted which enabled nodecon support. It seems that the patch never got commited
because it didn't work as expected.Hello,
I think the idea of adding network node support to semanage is a good one. Unfortunately I have no experience with python or semanage so I'm probably not the best person to provide coding advice or help.
Quoted 8 lines
Quoted 1 line
Who does look after semanage these days?
Yes, I agree that we ought to support this functionality, especially as libsemanage already provides the interfaces even if there are lingering issues in the implementation.
Joshua can likely help with the libsemanage/libsepol side and Dan with the semanage front end side.
Great, I'll try to help out as much as I can - this could be motivation to try and learn some python.
Quoted 2 lines
Christian - do you have a re-based copy of the patch against the svn trunk that you were testing with?
Christian, if you do have an updated/re-based patch, would you mind posting it?
Signature · 7 lines
paul moore linux @ hp -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.
Quoted 28 lines · Paul Moore
Quoted 27 lines · Stephen Smalley
Quoted 13 lines · Paul Moore
Quoted 11 lines · Christian Kuester
Hi List,
I had a small conversation with Stephen Smalley on the fedora-selinux-list about an easy way to add
(local) nodecon's on a SELinux enabled system. As this is not implemented in semanage yet
he gave me the advice to revive a discussion[1] on this list from 2006. It began because a patch against
semanage was posted which enabled nodecon support. It seems that the patch never got commited
because it didn't work as expected.Quoted 8 lines
Hello,
I think the idea of adding network node support to semanage is a good one. Unfortunately I have no experience with python or semanage so I'm probably not the best person to provide coding advice or help.
Who does look after semanage these days?
Yes, I agree that we ought to support this functionality, especially as libsemanage already provides the interfaces even if there are lingering issues in the implementation.
Quoted 5 lines
Quoted 2 lines
Joshua can likely help with the libsemanage/libsepol side and Dan with the semanage front end side.
Great, I'll try to help out as much as I can - this could be motivation to try and learn some python.
A few tips:
- checkpolicy presently orders node context entries from most specific to least specific based on netmask, see define_ipv4_node_context and define_ipv6_node_context in checkpolicy/policy_define.c.
- The kernel preserves the order provided in the policy and uses the first match it encounters.
- libsemanage sorts the node contexts in the node dbase (MODE_SORT in libsemanage/src/policy_components.c) using semanage_node_compare2_qsort in libsemanage/src/node_record.c as the ordering function. In turn, this calls sepol_node_compare2 in libsepol/src/node_record.c
- sepol_node_compare2 looks suspect to me - I'm not sure why he is sorting on both mask and addr there.
- Any bugs are Ivan's fault ;)
Quoted 5 lines
Quoted 2 lines
Christian - do you have a re-based copy of the patch against the svn trunk that you were testing with?
Christian, if you do have an updated/re-based patch, would you mind posting it?
Signature · 8 lines
Stephen Smalley National Security Agency -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.
Stephen Smalley schrieb:
Hi List,
Quoted 5 lines · Paul Moore
Quoted 4 lines
Quoted 2 lines
Christian - do you have a re-based copy of the patch against the svn trunk that you were testing with?
Christian, if you do have an updated/re-based patch, would you mind posting it?
I only tried the old patch against policycoreutils 1.32, but I did some effort into making it apply against the SVN trunk. I did not had the time to do the man page fix which was included in the original version of the patch.
Re-based patch is attached.
Christian
Signature · 10 lines
tarent Gesellschaft für Softwareentwicklung und IT-Beratung mbH Heilsbachstr. 24, 53123 Bonn | Poststr. 4-5, 10178 Berlin fon: +49(228) / 52675-0 | fon: +49(30) / 27594853 fax: +49(228) / 52675-25 | fax: +49(30) / 78709617 Geschäftsführer Boris Esser, Elmar Geese HRB AG Bonn 5168 Ust-ID: DE122264941
semanage +23 -2
@@ -49,6 +49,7 @@ semanage user -{a|d|m} [-LrRP] selinux_name semanage port -{a|d|m} [-tr] [ -p proto ] port | port_range semanage interface -{a|d|m} [-tr] interface_spec +semanage node -{a|d|m} [-tr] [ -p protocol ] [-M netmask] addr\n\ semanage fcontext -{a|d|m} [-frst] file_spec semanage translation -{a|d|m} [-T] level semanage boolean -{d|m} boolean
@@ -80,6 +81,7 @@ -p (named pipe) -p, --proto Port protocol (tcp or udp) + -M, --mask Netmask\n\ -P, --prefix Prefix for home directory labeling -L, --level Default SELinux Level (MLS/MCS Systems only) -R, --roles SELinux Roles (ex: "sysadm_r staff_r")
@@ -109,6 +111,8 @@ valid_option["port"] += valid_everyone + [ '-t', '--type', '-r', '--range', '-p', '--proto' ] valid_option["interface"] = [] valid_option["interface"] += valid_everyone + [ '-t', '--type', '-r', '--range'] + valid_option["node"] = [] + valid_option["node"] += valid_everyone + [ '-M', '--mask', '-t', '--type', '-r', '--range', '-p', '--protocol' ] valid_option["fcontext"] = [] valid_option["fcontext"] += valid_everyone + [ '-f', '--ftype', '-s', '--seuser', '-t', '--type', '-r', '--range'] valid_option["translation"] = []
@@ -128,6 +132,7 @@ serange = "" port = "" proto = "" + maske = "" selevel = "" setype = "" ftype = ""
@@ -155,7 +160,7 @@ args = sys.argv[2:] gopts, cmds = getopt.getopt(args, - '01adf:lhmnp:s:CDR:L:r:t:T:P:S:', + '01adf:lhmnp:s:CDR:L:r:t:T:P:S:M:', ['add', 'delete', 'deleteall',
@@ -175,7 +180,8 @@ 'roles=', 'type=', 'trans=', - 'prefix=' + 'prefix=', + 'mask=' ]) for o, a in gopts: if o not in option_dict[object]:
@@ -230,6 +236,9 @@ if o == "-p" or o == '--proto': proto = a + if o == "-M" or o == '--mask': + mask = a + if o == "-P" or o == '--prefix': prefix = a
@@ -261,6 +270,9 @@ if object == "interface": OBJECT = seobject.interfaceRecords(store) + + if object == "node": + OBJECT = seobject.nodeRecords(store) if object == "fcontext": OBJECT = seobject.fcontextRecords(store)
@@ -308,6 +320,9 @@ if object == "interface": OBJECT.add(target, serange, setype) + if object == "node": + OBJECT.add(target, mask, proto, serange, setype) + if object == "fcontext": OBJECT.add(target, setype, ftype, serange, seuser) if object == "permissive":
@@ -335,6 +350,9 @@ if object == "interface": OBJECT.modify(target, serange, setype) + if object == "node": + OBJECT.modify(target, mask, proto, serange, setype) + if object == "fcontext": OBJECT.modify(target, setype, ftype, serange, seuser)
@@ -347,6 +365,9 @@ elif object == "fcontext": OBJECT.delete(target, ftype) + elif object == "node": + OBJECT.delete(target, mask, proto) + else: OBJECT.delete(target)
seobject.py +212 -3
227 lines not on this page · raw message
Quoted 26 lines · Christian Kuester
Hi List,
I had a small conversation with Stephen Smalley on the fedora-selinux-list about an easy way to add
(local) nodecon's on a SELinux enabled system. As this is not implemented in semanage yet
he gave me the advice to revive a discussion[1] on this list from 2006. It began because a patch against
semanage was posted which enabled nodecon support. It seems that the patch never got commited
because it didn't work as expected.I writing because I would like to know if there's any chance to get that fully working. I played around
with the patch and I could set labels to nodes and my SELinux seems to respect these settings.
f.i# semanage node -t blacknetwork_node_t -a -p 0 -M 255.255.255.255 192.168.100.54 $ ./socat -u TCP4-LISTEN:5555,bind=192.168.100.54,reuseaddr,fork - ... type=AVC msg=audit(1215085777.002:689775728): avc: denied { node_bind } for pid=26627 comm="socat" saddr=192.168.100.54 src=5555 scontext=user_u:user_r:exe_t:s0 tcontext=system_u:object_r:blacknetwork_node_t:s0 tclass=tcp_socket
Quoted 5 lines
So, this seems to work. But I run into problems when I told semanage about the
*actual* netmask of this node, which is 255.255.255.0. The tcontext string switched from
"blacknetwork_node_t" to the generic "node_t".
Ok, this isn't actually a bug in the code at all.
The mask is not supposed to be the "netmask" of the host. It is merely the portion of the address that you wish to match against. So you do want it to be 255.255.255.255 if you want to match that exact address in its entirety.
Specifying 255.255.255.0 means that you want to map the entire subnet to that type. But then you should only specify the prefix for the address, i.e. 192.168.100.0, because the matching code does this:
if (c->u.node.addr == (addr & c->u.node.mask)) break;
It presumes that the specified address only has bits set within the specified mask already.
Arguably semanage and checkpolicy should apply the mask to the address as a precaution against misconfiguration by the user. That's easy enough to do.
Other tidbits on the semanage patch that I noticed:
- semanage node -l was broken, requires additional argument that has been added to the list methods subsequently. Also would be nice to support locallist/-C option.
- semanage node -p option should take a string rather than an integer and map it to the proper symbolic constant for ipv4/ipv6.
The ordering issue is a red herring at least for this example as the sort is only applied to the local entries, and then they are merged to the front of the policy-provided definitions. Which may become an issue down the road particularly if we move object contexts to modules.
Signature · 8 lines
Stephen Smalley National Security Agency -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.
Quoted 2 lines · Stephen Smalley
Quoted 1 line
[ netmask semantic in nodecon ]
Ok, this isn't actually a bug in the code at all.
I see. Thanks for clearing that up for me!
Quoted 4 lines
Arguably semanage and checkpolicy should apply the mask to the address as a precaution against misconfiguration by the user. That's easy enough to do.
Quoted 10 lines
Other tidbits on the semanage patch that I noticed:
- semanage node -l was broken, requires additional argument that has been added to the list methods subsequently. Also would be nice to support locallist/-C option.
- semanage node -p option should take a string rather than an integer and map it to the proper symbolic constant for ipv4/ipv6. The ordering issue is a red herring at least for this example as the sort is only applied to the local entries, and then they are merged to the front of the policy-provided definitions. Which may become an issue down the road particularly if we move object contexts to modules.
I think I could do the changes to at least the semanage code, if there is still interest in it.
But I must admit, that my understanding of the "ordering issue" is quiet limited and my list research on an explaination was unsuccessful so far. Is this a blocker for general semanage support of nodecons?
Christian
Signature · 15 lines
tarent Gesellschaft für Softwareentwicklung und IT-Beratung mbH Heilsbachstr. 24, 53123 Bonn | Poststr. 4-5, 10178 Berlin fon: +49(228) / 52675-0 | fon: +49(30) / 27594853 fax: +49(228) / 52675-25 | fax: +49(30) / 78709617 Geschäftsführer Boris Esser, Elmar Geese HRB AG Bonn 5168 Ust-ID: DE122264941 -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.
Quoted 21 lines · Christian Kuester
Quoted 2 lines · Stephen Smalley
Quoted 1 line
[ netmask semantic in nodecon ]
Ok, this isn't actually a bug in the code at all.
I see. Thanks for clearing that up for me!
Quoted 4 lines
Arguably semanage and checkpolicy should apply the mask to the address as a precaution against misconfiguration by the user. That's easy enough to do.
Quoted 10 lines
Other tidbits on the semanage patch that I noticed:
- semanage node -l was broken, requires additional argument that has been added to the list methods subsequently. Also would be nice to support locallist/-C option.
- semanage node -p option should take a string rather than an integer and map it to the proper symbolic constant for ipv4/ipv6. The ordering issue is a red herring at least for this example as the sort is only applied to the local entries, and then they are merged to the front of the policy-provided definitions. Which may become an issue down the road particularly if we move object contexts to modules.
Quoted 6 lines
I think I could do the changes to at least the semanage code, if there is still interest in it.
But I must admit, that my understanding of the "ordering issue" is quiet limited and my list research on an explaination was unsuccessful so far. Is this a blocker for general semanage support of nodecons?
I think it is fine to proceed with merging the semanage support, and then we can further investigate and seek to resolve the ordering issues.
Please be sure to test each of the nodeRecords methods.
Dan and/or Joshua - it would help if you could look it over as well.
Signature · 8 lines
Stephen Smalley National Security Agency -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.
Quoted 25 lines · Stephen Smalley
Quoted 24 lines · Christian Kuester
Quoted 2 lines · Stephen Smalley
Quoted 1 line
[ netmask semantic in nodecon ]
Ok, this isn't actually a bug in the code at all.
I see. Thanks for clearing that up for me!
Quoted 4 lines
Arguably semanage and checkpolicy should apply the mask to the address as a precaution against misconfiguration by the user. That's easy enough to do.
Quoted 10 lines
Other tidbits on the semanage patch that I noticed:
- semanage node -l was broken, requires additional argument that has been added to the list methods subsequently. Also would be nice to support locallist/-C option.
- semanage node -p option should take a string rather than an integer and map it to the proper symbolic constant for ipv4/ipv6. The ordering issue is a red herring at least for this example as the sort is only applied to the local entries, and then they are merged to the front of the policy-provided definitions. Which may become an issue down the road particularly if we move object contexts to modules.I think I could do the changes to at least the semanage code, if there is still interest in it.
Quoted 8 lines
Quoted 3 lines
But I must admit, that my understanding of the "ordering issue" is quiet limited and my list research on an explaination was unsuccessful so far. Is this a blocker for general semanage support of nodecons?
I think it is fine to proceed with merging the semanage support, and then we can further investigate and seek to resolve the ordering issues.
Please be sure to test each of the nodeRecords methods.
Are you still pursuing getting this cleaned up and merged?
Quoted 2 lines
Dan and/or Joshua - it would help if you could look it over as well.
Signature · 8 lines
Stephen Smalley National Security Agency -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.
PATCH 1/1 Revised Patch for local nodecon support in semanage (was: Adding local nodecon's through semanage)
Stephen Smalley schrieb:
Hi List,
Quoted 10 lines · Stephen Smalley
Quoted 8 lines · Christian Kuester
Quoted 6 lines
Quoted 6 lines
Other tidbits on the semanage patch that I noticed:
- semanage node -l was broken, requires additional argument that has been added to the list methods subsequently. Also would be nice to support locallist/-C option.
- semanage node -p option should take a string rather than an integer and map it to the proper symbolic constant for ipv4/ipv6.Please be sure to test each of the nodeRecords methods.
Are you still pursuing getting this cleaned up and merged?
Sorry, it took some time. The revised patch for nodecon support in the semanage tool is attached.
It now takes strings as arguments for the ip protocol. list/locallist work as expected and output is more readable. I also made changes for the semanage.8 man page.
Kind Regards,
Christian
Signature · 10 lines
tarent Gesellschaft für Softwareentwicklung und IT-Beratung mbH Heilsbachstr. 24, 53123 Bonn | Poststr. 4-5, 10178 Berlin fon: +49(228) / 52675-0 | fon: +49(30) / 27594853 fax: +49(228) / 52675-25 | fax: +49(30) / 78709617 Geschäftsführer Boris Esser, Elmar Geese HRB AG Bonn 5168 Ust-ID: DE122264941
semanage +26 -5
@@ -44,11 +44,12 @@ def usage(message = ""): print _(""" -semanage {boolean|login|user|port|interface|fcontext|translation} -{l|D} [-n] +semanage {boolean|login|user|port|interface|node|fcontext|translation} -{l|D} [-n] semanage login -{a|d|m} [-sr] login_name | %groupname semanage user -{a|d|m} [-LrRP] selinux_name semanage port -{a|d|m} [-tr] [ -p proto ] port | port_range semanage interface -{a|d|m} [-tr] interface_spec +semanage node -{a|d|m} [-tr] [ -p protocol ] [-M netmask] addr semanage fcontext -{a|d|m} [-frst] file_spec semanage translation -{a|d|m} [-T] level semanage boolean -{d|m} [--on|--off|-1|-0] -F boolean | boolean_file
@@ -80,7 +81,8 @@ -p (named pipe) -F, --file Treat target as an input file for command, change multiple settings - -p, --proto Port protocol (tcp or udp) + -p, --proto Port protocol (tcp or udp) or internet protocol version of node (ipv4 or ipv6) + -M, --mask Netmask -P, --prefix Prefix for home directory labeling -L, --level Default SELinux Level (MLS/MCS Systems only) -R, --roles SELinux Roles (ex: "sysadm_r staff_r")
@@ -109,7 +111,9 @@ valid_option["port"] = [] valid_option["port"] += valid_everyone + [ '-t', '--type', '-r', '--range', '-p', '--proto' ] valid_option["interface"] = [] - valid_option["interface"] += valid_everyone + [ '-t', '--type', '-r', '--range'] + valid_option["interface"] += valid_everyone + [ '-t', '--type', '-r', '--range'] + valid_option["node"] = [] + valid_option["node"] += valid_everyone + [ '-M', '--mask', '-t', '--type', '-r', '--range', '-p', '--protocol'] valid_option["fcontext"] = [] valid_option["fcontext"] += valid_everyone + [ '-f', '--ftype', '-s', '--seuser', '-t', '--type', '-r', '--range'] valid_option["translation"] = []
@@ -129,6 +133,7 @@ serange = "" port = "" proto = "" + mask = "" selevel = "" setype = "" ftype = ""
@@ -157,7 +162,7 @@ args = sys.argv[2:] gopts, cmds = getopt.getopt(args, - '01adf:lhmnp:s:FCDR:L:r:t:T:P:S:', + '01adf:lhmnp:s:FCDR:L:r:t:T:P:S:M:', ['add', 'delete', 'deleteall',
@@ -178,7 +183,8 @@ 'roles=', 'type=', 'trans=', - 'prefix=' + 'prefix=', + 'mask=' ]) for o, a in gopts: if o not in option_dict[object]:
@@ -245,6 +251,9 @@ if o == "-s" or o == "--seuser": seuser = a + + if o == "-M" or o == '--mask': + mask = a if o == "-t" or o == "--type": setype = a
@@ -268,6 +277,9 @@ if object == "interface": OBJECT = seobject.interfaceRecords(store) + + if object == "node": + OBJECT = seobject.nodeRecords(store) if object == "fcontext": OBJECT = seobject.fcontextRecords(store)
@@ -316,6 +328,9 @@ if object == "interface": OBJECT.add(target, serange, setype) + if object == "node": + OBJECT.add(target, mask, proto, serange, setype) + if object == "fcontext": OBJECT.add(target, setype, ftype, serange, seuser) if object == "permissive":
@@ -342,6 +357,9 @@ if object == "interface": OBJECT.modify(target, serange, setype) + + if object == "node": + OBJECT.modify(target, mask, proto, serange, setype) if object == "fcontext": OBJECT.modify(target, setype, ftype, serange, seuser)
@@ -354,6 +372,9 @@ elif object == "fcontext": OBJECT.delete(target, ftype) + + elif object == "node": + OBJECT.delete(target, mask, proto) else: OBJECT.delete(target)
semanage.8 +4 -2
@@ -3,7 +3,7 @@ semanage \- SELinux Policy Management tool .SH "SYNOPSIS" -.B semanage {boolean|login|user|port|interface|fcontext|translation} \-{l|D} [\-n] [\-S store] +.B semanage {boolean|login|user|port|interface|node|fcontext|translation} \-{l|D} [\-n] [\-S store] .br .B semanage boolean \-{d|m} [\-\-on|\-\-off|\-1|\-0] -F boolean | boolean_file .br
@@ -15,6 +15,8 @@ .br .B semanage interface \-{a|d|m} [\-tr] interface_spec .br +.B semanage node -{a|d|m} [-tr] [ -p protocol ] [-M netmask] address +.br .B semanage fcontext \-{a|d|m} [\-frst] file_spec .br .B semanage permissive \-{a|d} type
@@ -78,7 +80,7 @@ Do not print heading when listing OBJECTS. .TP .I \-p, \-\-proto -Protocol for the specified port (tcp|udp). +Protocol for the specified port (tcp|udp) or internet protocol version for the specified node (ipv4|ipv6). .TP .I \-r, \-\-range MLS/MCS Security Range (MLS/MCS Systems only)
seobject.py +225 -0
231 lines not on this page · raw message
Re: [PATCH] Revised Patch for local nodecon support in semanage (was: Adding local nodecon's through semanage)
Quoted 13 lines · Christian Kuester
Stephen Smalley schrieb:
Hi List,
Quoted 9 lines · Stephen Smalley
Quoted 8 lines · Christian Kuester
Quoted 6 lines
Quoted 6 lines
Other tidbits on the semanage patch that I noticed:
- semanage node -l was broken, requires additional argument that has been added to the list methods subsequently. Also would be nice to support locallist/-C option.
- semanage node -p option should take a string rather than an integer and map it to the proper symbolic constant for ipv4/ipv6.Please be sure to test each of the nodeRecords methods.
Quoted 8 lines
Quoted 1 line
Are you still pursuing getting this cleaned up and merged?
Sorry, it took some time. The revised patch for nodecon support in the semanage tool is attached.
It now takes strings as arguments for the ip protocol. list/locallist work as expected and output is more readable. I also made changes for the semanage.8 man page.
semanage node -lC appears to list all of the entries rather than only the local modifications (i.e. the ones in the nodes.local file). Compare with semanage fcontext -lC or port -lC.
Also the patch should be from the top of the tree, preferably appliable by git-apply.
Thanks.
Signature · 8 lines
Stephen Smalley National Security Agency -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.
Re: [PATCH] Revised Patch for local nodecon support in semanage (was: Adding local nodecon's through semanage)
Quoted 19 lines · Stephen Smalley
Quoted 18 lines · Christian Kuester
Stephen Smalley schrieb:
Hi List,
Quoted 10 lines · Stephen Smalley
Quoted 8 lines · Christian Kuester
Quoted 6 lines
Quoted 6 lines
Other tidbits on the semanage patch that I noticed:
- semanage node -l was broken, requires additional argument that has been added to the list methods subsequently. Also would be nice to support locallist/-C option.
- semanage node -p option should take a string rather than an integer and map it to the proper symbolic constant for ipv4/ipv6.Please be sure to test each of the nodeRecords methods.
Are you still pursuing getting this cleaned up and merged?
Sorry, it took some time. The revised patch for nodecon support in the semanage tool is attached.
Quoted 8 lines
Quoted 3 lines
It now takes strings as arguments for the ip protocol. list/locallist work as expected and output is more readable. I also made changes for the semanage.8 man page.
semanage node -lC appears to list all of the entries rather than only the local modifications (i.e. the ones in the nodes.local file). Compare with semanage fcontext -lC or port -lC.
Ok, this turned out to be trivial - just needed to pass the localist value to the get_all() call. Fixed and committed, thanks.
Signature · 8 lines
Stephen Smalley National Security Agency -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.
Quoted 21 lines · Christian Kuester
Quoted 2 lines · Stephen Smalley
Quoted 1 line
[ netmask semantic in nodecon ]
Ok, this isn't actually a bug in the code at all.
I see. Thanks for clearing that up for me!
Quoted 4 lines
Arguably semanage and checkpolicy should apply the mask to the address as a precaution against misconfiguration by the user. That's easy enough to do.
Quoted 10 lines
Other tidbits on the semanage patch that I noticed:
- semanage node -l was broken, requires additional argument that has been added to the list methods subsequently. Also would be nice to support locallist/-C option.
- semanage node -p option should take a string rather than an integer and map it to the proper symbolic constant for ipv4/ipv6. The ordering issue is a red herring at least for this example as the sort is only applied to the local entries, and then they are merged to the front of the policy-provided definitions. Which may become an issue down the road particularly if we move object contexts to modules.
Quoted 7 lines
I think I could do the changes to at least the semanage code, if there is still interest in it.
But I must admit, that my understanding of the "ordering issue" is quiet limited and my list research on an explaination was unsuccessful so far. Is this a blocker for general semanage support of nodecons?
The ordering issue only comes up when you have overlapping masks. This may not be an issue in practice though, I suppose we'll see.
--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.