Support LDAP backend infrastructure
PATCH v2 1/1 Support LDAP backend infrastructure
The DHCP daemon supports LDAP backends (next to its file-based backend). This patch adds support for this through the dhcp_use_ldap boolean. We also allow the DHCP daemon to bind to generic UDP ports (needed by ISC BIND proper startup).
--- dhcp.te | 11 +++++++++++ 1 files changed, 11 insertions(+), 0 deletions(-)
dhcp.te +11 -0
@@ -4,6 +4,12 @@ policy_module(dhcp, 1.9.0) # # Declarations # +## <desc> +## <p> +## Enable LDAP backend support for DHCP daemon. +## </p> +## </desc> +gen_tunable(dhcp_use_ldap, false) type dhcpd_t; type dhcpd_exec_t;
@@ -68,6 +74,7 @@ corenet_tcp_bind_generic_node(dhcpd_t) corenet_udp_bind_generic_node(dhcpd_t) corenet_tcp_bind_dhcpd_port(dhcpd_t) corenet_udp_bind_dhcpd_port(dhcpd_t) +corenet_udp_bind_generic_port(dhcpd_t) corenet_udp_bind_pxe_port(dhcpd_t) corenet_tcp_connect_all_ports(dhcpd_t) corenet_sendrecv_dhcpd_server_packets(dhcpd_t)
@@ -105,6 +112,10 @@ ifdef(`distro_gentoo',` allow dhcpd_t self:capability { chown dac_override setgid setuid sys_chroot }; ') +tunable_policy(`dhcp_use_ldap',` + sysnet_use_ldap(dhcpd_t) +') + optional_policy(` # used for dynamic DNS bind_read_dnssec_keys(dhcpd_t)
Signature · 1 line
1.7.3.4
PATCH v2 1/1 Support LDAP backend infrastructure
Quoted 28 lines · Sven Vermeulen
The DHCP daemon supports LDAP backends (next to its file-based backend). This patch adds support for this through the
dhcp_use_ldapboolean. We also allow the DHCP daemon to bind to generic UDP ports (needed by ISC BIND proper startup).Signed-off-by Sven Vermeulen <[email protected]>--- dhcp.te | 11 +++++++++++ 1 files changed, 11 insertions(+), 0 deletions(-)dhcp.te +6
-0@@ -4,6 +4,12 @@ policy_module(dhcp, 1.9.0) # # Declarations # +## <desc> +## <p> +## Enable LDAP backend support for DHCP daemon. +## </p> +## </desc> +gen_tunable(dhcp_use_ldap, false) type dhcpd_t; type dhcpd_exec_t;
dhcp.te corenet_tcp_bind_generic_node(dhcpd_t) · line 77
Quoted 4 lines
dhcp.te +1
-0@@ -68,6 +74,7 @@ corenet_tcp_bind_generic_node(dhcpd_t) corenet_udp_bind_generic_node(dhcpd_t) corenet_tcp_bind_dhcpd_port(dhcpd_t) corenet_udp_bind_dhcpd_port(dhcpd_t) +corenet_udp_bind_generic_port(dhcpd_t)
Looks like a port needs to be defined.
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com
PATCH v2 1/1 Support LDAP backend infrastructure
Quoted 5 lines · Christopher J. PeBenito
Quoted 4 lines · Sven Vermeulen
The DHCP daemon supports LDAP backends (next to its file-based backend). This patch adds support for this through the
dhcp_use_ldapboolean. We also allow the DHCP daemon to bind to generic UDP ports (needed by ISC BIND proper startup).
[...]
Quoted 7 lines
dhcp.te corenet_tcp_bind_generic_node(dhcpd_t) · line 77
Quoted 5 lines
dhcp.te +1
-0@@ -68,6 +74,7 @@ corenet_tcp_bind_generic_node(dhcpd_t) corenet_udp_bind_generic_node(dhcpd_t) corenet_tcp_bind_dhcpd_port(dhcpd_t) corenet_udp_bind_dhcpd_port(dhcpd_t) +corenet_udp_bind_generic_port(dhcpd_t)Looks like a port needs to be defined.
Not really, but the call should be corenet_udp_bind_all_unreserved_ports, not corenet_udp_bind_generic_port. Guess I'll have to go for personal testing more than to accept an "it works" on a bugreport :p
Mar 6 20:26:16 testsys kernel: [ 933.044666] type=1400
audit(1331061976.847:95): avc: denied { name_bind } for pid=15054 comm="dhcpd" src=10607 scontext=system_u:system_r:dhcpd_t tcontext=system_u:object_r:unreserved_port_t tclass=udp_socket
Mar 6 20:26:17 testsys kernel: [ 933.484279] type=1400
audit(1331061977.287:100): avc: denied { name_bind } for pid=15065 comm="dhcpd" src=31290 scontext=system_u:system_r:dhcpd_t tcontext=system_u:object_r:unreserved_port_t tclass=udp_socket
Mar 6 20:26:17 testsys kernel: [ 933.484498] type=1400
audit(1331061977.287:101): avc: denied { name_bind } for pid=15065 comm="dhcpd" src=14386 scontext=system_u:system_r:dhcpd_t tcontext=system_u:object_r:unreserved_port_t tclass=udp_socket
Etcetera. But I'm going to revoke this from the patch for now, because it isn't fully reproduceable here: if I restart the DHCP daemon 10 times, it fails 7 times and succeeds 3 times, without any changes to the policy, and denials are not showing much useful info.
Wkr,
Sven Vermeulen
PATCH v2 1/1 Support LDAP backend infrastructure
Quoted 11 lines · Sven Vermeulen
Quoted 7 lines
dhcp.te corenet_tcp_bind_generic_node(dhcpd_t) · line 77
Quoted 5 lines
dhcp.te +1
-0@@ -68,6 +74,7 @@ corenet_tcp_bind_generic_node(dhcpd_t) corenet_udp_bind_generic_node(dhcpd_t) corenet_tcp_bind_dhcpd_port(dhcpd_t) corenet_udp_bind_dhcpd_port(dhcpd_t) +corenet_udp_bind_generic_port(dhcpd_t)Looks like a port needs to be defined.
Not really, but the call should be
corenet_udp_bind_all_unreserved_ports, notcorenet_udp_bind_generic_port. Guess I'll have to go for personal testing more than to accept an "it works" on a bugreport :p
And *poof* there it goes.
Apparently, pre-20120215 policy, the ports were labeled port_t, in 20120215 they are labeled unreserved_port_t, which is why corenet_udp_bind_generic_port was correct previously.
It doesn't bind to a particular port though. The bind is used by DHCP to detect the open number of interfaces (see common/discover.c::begin_iface_scan in the DHCP sources):
ifaces->sock = socket(local_family, SOCK_DGRAM, IPPROTO_UDP);
if (ioctl(ifaces->sock, SIOCGLIFNUM, &lifnum) < 0) {
log_error("Error finding total number of interfaces; %m");
close(ifaces->sock);
ifaces->sock = -1;
return 0;
}Wkr,
Sven Vermeulen
Quoted 22 lines
Mar 6 20:26:16 testsys kernel: [ 933.044666] type=1400audit(1331061976.847:95): avc: denied {
name_bind} for pid=15054 comm="dhcpd" src=10607 scontext=system_u:system_r:dhcpd_t tcontext=system_u:object_r:unreserved_port_t tclass=udp_socketMar 6 20:26:17 testsys kernel: [ 933.484279] type=1400audit(1331061977.287:100): avc: denied {
name_bind} for pid=15065 comm="dhcpd" src=31290 scontext=system_u:system_r:dhcpd_t tcontext=system_u:object_r:unreserved_port_t tclass=udp_socketMar 6 20:26:17 testsys kernel: [ 933.484498] type=1400audit(1331061977.287:101): avc: denied {
name_bind} for pid=15065 comm="dhcpd" src=14386 scontext=system_u:system_r:dhcpd_t tcontext=system_u:object_r:unreserved_port_t tclass=udp_socketEtcetera. But I'm going to revoke this from the patch for now, because it isn't fully reproduceable here: if I restart the DHCP daemon 10 times, it fails 7 times and succeeds 3 times, without any changes to the policy, and denials are not showing much useful info.
Wkr,
Sven Vermeulen
PATCH v2 1/1 Support LDAP backend infrastructure
Quoted 9 lines · Sven Vermeulen
Quoted 8 lines · Sven Vermeulen
Quoted 7 lines
dhcp.te corenet_tcp_bind_generic_node(dhcpd_t) · line 77
Quoted 5 lines
dhcp.te +1
-0@@ -68,6 +74,7 @@ corenet_tcp_bind_generic_node(dhcpd_t) corenet_udp_bind_generic_node(dhcpd_t) corenet_tcp_bind_dhcpd_port(dhcpd_t) corenet_udp_bind_dhcpd_port(dhcpd_t) +corenet_udp_bind_generic_port(dhcpd_t)Looks like a port needs to be defined.
Quoted 3 lines
Quoted 3 lines
Not really, but the call should be
corenet_udp_bind_all_unreserved_ports, notcorenet_udp_bind_generic_port. Guess I'll have to go for personal testing more than to accept an "it works" on a bugreport :p
Sounds like the above is the change we need. Please also add a comment that describes what you found below, so we can remember it next time this comes up.
Quoted 47 lines
And *poof* there it goes.
Apparently, pre-20120215 policy, the ports were labeled
port_t, in 20120215 they are labeledunreserved_port_t, which is whycorenet_udp_bind_generic_portwas correct previously.It doesn't bind to a particular port though. The bind is used by DHCP to detect the open number of interfaces (see common/discover.c::begin_iface_scan in the DHCP sources):
ifaces->sock = socket(local_family, SOCK_DGRAM, IPPROTO_UDP); if (ioctl(ifaces->sock, SIOCGLIFNUM, &lifnum) < 0) { log_error("Error finding total number of interfaces; %m"); close(ifaces->sock); ifaces->sock = -1; return 0; }Wkr,
Sven VermeulenQuoted 15 lines
Mar 6 20:26:16 testsys kernel: [ 933.044666] type=1400audit(1331061976.847:95): avc: denied {
name_bind} for pid=15054 comm="dhcpd" src=10607 scontext=system_u:system_r:dhcpd_t tcontext=system_u:object_r:unreserved_port_t tclass=udp_socketMar 6 20:26:17 testsys kernel: [ 933.484279] type=1400audit(1331061977.287:100): avc: denied {
name_bind} for pid=15065 comm="dhcpd" src=31290 scontext=system_u:system_r:dhcpd_t tcontext=system_u:object_r:unreserved_port_t tclass=udp_socketMar 6 20:26:17 testsys kernel: [ 933.484498] type=1400audit(1331061977.287:101): avc: denied {
name_bind} for pid=15065 comm="dhcpd" src=14386 scontext=system_u:system_r:dhcpd_t tcontext=system_u:object_r:unreserved_port_t tclass=udp_socketQuoted 7 lines
Etcetera. But I'm going to revoke this from the patch for now, because it isn't fully reproduceable here: if I restart the DHCP daemon 10 times, it fails 7 times and succeeds 3 times, without any changes to the policy, and denials are not showing much useful info.
Wkr,
Sven Vermeulen_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com
PATCH v2 1/1 Support LDAP backend infrastructure
Quoted 10 lines · Christopher J. PeBenito
Quoted 9 lines · Sven Vermeulen
Quoted 8 lines · Sven Vermeulen
Quoted 7 lines
dhcp.te corenet_tcp_bind_generic_node(dhcpd_t) · line 77
Quoted 5 lines
dhcp.te +1
-0@@ -68,6 +74,7 @@ corenet_tcp_bind_generic_node(dhcpd_t) corenet_udp_bind_generic_node(dhcpd_t) corenet_tcp_bind_dhcpd_port(dhcpd_t) corenet_udp_bind_dhcpd_port(dhcpd_t) +corenet_udp_bind_generic_port(dhcpd_t)Looks like a port needs to be defined.
Quoted 5 lines
Quoted 3 lines
Quoted 3 lines
Not really, but the call should be
corenet_udp_bind_all_unreserved_ports, notcorenet_udp_bind_generic_port. Guess I'll have to go for personal testing more than to accept an "it works" on a bugreport :pSounds like the above is the change we need. Please also add a comment that describes what you found below, so we can remember it next time this comes up.
To clarify: a comment in the policy, not just in the commit message.
Signature · 3 lines
Chris PeBenito Tresys Technology, LLC www.tresys.com | oss.tresys.com