mirrors/passt
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

contrib/selinux: Allow binding and connecting to all UDP and TCP ports

Browse source 
Laine reports that with a simple:

      <portForward proto='tcp'>
        <range start='2022' to='22'/>
      </portForward>

in libvirt's domain XML, passt won't start as it fails to bind
arbitrary ports. That was actually the intention behind passt_port_t:
the user or system administrator should have explicitly configured
allowed ports on a given machine. But it's probably not realistic, so
just allow any port to be bound and forwarded.

Also fix up some missing operations on sockets.

Reported-by: Laine Stump <laine@redhat.com>
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
Tested-by: Laine Stump <laine@redhat.com>
Reviewed-by: Laine Stump <laine@redhat.com>
This commit is contained in:
Stefano Brivio 2023-03-06 23:05:36 +00:00
parent 41bc669866
commit de9b0cb5fe
1 changed files with 15 additions and 12 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

27
contrib/selinux/passt.te
View file

@ -62,9 +62,6 @@ logging_log_file(passt_log_t);
type passt_etc_t;
files_config_file(passt_etc_t);
type passt_port_t;
typeattribute passt_port_t port_type;
role unconfined_r types passt_t;
allow passt_t passt_exec_t : file { ioctl read getattr lock execute execute_no_trans entrypoint open } ;
@ -100,16 +97,22 @@ allow passt_t net_conf_t:lnk_file read;
allow passt_t tmp_t:sock_file { create unlink write };
allow passt_t self:netlink_route_socket { bind create nlmsg_read read write setopt };
allow passt_t self:tcp_socket create_stream_socket_perms;
corenet_tcp_sendrecv_generic_node(passt_t)
corenet_tcp_bind_generic_node(passt_t)
allow passt_t passt_port_t:tcp_socket { name_bind name_connect };
allow passt_t http_port_t:tcp_socket { name_bind name_connect };
allow passt_t self:udp_socket create_stream_socket_perms;
corenet_udp_sendrecv_generic_node(passt_t)
corenet_udp_bind_generic_node(passt_t)
allow passt_t passt_port_t:udp_socket { name_bind };
corenet_tcp_bind_all_nodes(passt_t)
corenet_udp_bind_all_nodes(passt_t)
corenet_tcp_bind_all_ports(passt_t)
corenet_udp_bind_all_ports(passt_t)
corenet_tcp_connect_all_ports(passt_t)
corenet_tcp_sendrecv_all_ports(passt_t)
corenet_udp_sendrecv_all_ports(passt_t)
allow passt_t node_t:icmp_socket { name_bind node_bind };
allow passt_t port_t:icmp_socket name_bind;
allow passt_t self:tcp_socket { create getopt setopt connect bind listen accept shutdown read write };
allow passt_t self:udp_socket { create getopt setopt connect bind read write };
allow passt_t self:icmp_socket { bind create setopt read write };
allow passt_t user_tmp_t:dir { add_name write };