aboutgitcodebugslistschat
path: root/contrib/selinux
diff options
context:
space:
mode:
authorStefano Brivio <sbrivio@redhat.com>2023-03-06 23:05:36 +0000
committerStefano Brivio <sbrivio@redhat.com>2023-03-09 00:36:08 +0100
commitde9b0cb5fee2ea00ed7e7877ef9be8c446bca134 (patch)
tree92e563257bd3d19844fbf9938db7ff66505a29d0 /contrib/selinux
parent41bc669866b9e408d8d4966ee06e01784949b98d (diff)
downloadpasst-de9b0cb5fee2ea00ed7e7877ef9be8c446bca134.tar
passt-de9b0cb5fee2ea00ed7e7877ef9be8c446bca134.tar.gz
passt-de9b0cb5fee2ea00ed7e7877ef9be8c446bca134.tar.bz2
passt-de9b0cb5fee2ea00ed7e7877ef9be8c446bca134.tar.lz
passt-de9b0cb5fee2ea00ed7e7877ef9be8c446bca134.tar.xz
passt-de9b0cb5fee2ea00ed7e7877ef9be8c446bca134.tar.zst
passt-de9b0cb5fee2ea00ed7e7877ef9be8c446bca134.zip
contrib/selinux: Allow binding and connecting to all UDP and TCP ports
Laine reports that with a simple: <portForward proto='tcp'> <range start='2022' to='22'/> </portForward> in libvirt's domain XML, passt won't start as it fails to bind arbitrary ports. That was actually the intention behind passt_port_t: the user or system administrator should have explicitly configured allowed ports on a given machine. But it's probably not realistic, so just allow any port to be bound and forwarded. Also fix up some missing operations on sockets. Reported-by: Laine Stump <laine@redhat.com> Signed-off-by: Stefano Brivio <sbrivio@redhat.com> Tested-by: Laine Stump <laine@redhat.com> Reviewed-by: Laine Stump <laine@redhat.com>
Diffstat (limited to 'contrib/selinux')
-rw-r--r--contrib/selinux/passt.te27
1 files changed, 15 insertions, 12 deletions
diff --git a/contrib/selinux/passt.te b/contrib/selinux/passt.te
index 6cd61f1..438155d 100644
--- a/contrib/selinux/passt.te
+++ b/contrib/selinux/passt.te
@@ -62,9 +62,6 @@ logging_log_file(passt_log_t);
type passt_etc_t;
files_config_file(passt_etc_t);
-type passt_port_t;
-typeattribute passt_port_t port_type;
-
role unconfined_r types passt_t;
allow passt_t passt_exec_t : file { ioctl read getattr lock execute execute_no_trans entrypoint open } ;
@@ -100,16 +97,22 @@ allow passt_t net_conf_t:lnk_file read;
allow passt_t tmp_t:sock_file { create unlink write };
allow passt_t self:netlink_route_socket { bind create nlmsg_read read write setopt };
-allow passt_t self:tcp_socket create_stream_socket_perms;
-corenet_tcp_sendrecv_generic_node(passt_t)
-corenet_tcp_bind_generic_node(passt_t)
-allow passt_t passt_port_t:tcp_socket { name_bind name_connect };
-allow passt_t http_port_t:tcp_socket { name_bind name_connect };
-allow passt_t self:udp_socket create_stream_socket_perms;
-corenet_udp_sendrecv_generic_node(passt_t)
-corenet_udp_bind_generic_node(passt_t)
-allow passt_t passt_port_t:udp_socket { name_bind };
+corenet_tcp_bind_all_nodes(passt_t)
+corenet_udp_bind_all_nodes(passt_t)
+
+corenet_tcp_bind_all_ports(passt_t)
+corenet_udp_bind_all_ports(passt_t)
+
+corenet_tcp_connect_all_ports(passt_t)
+
+corenet_tcp_sendrecv_all_ports(passt_t)
+corenet_udp_sendrecv_all_ports(passt_t)
+
allow passt_t node_t:icmp_socket { name_bind node_bind };
+allow passt_t port_t:icmp_socket name_bind;
+
+allow passt_t self:tcp_socket { create getopt setopt connect bind listen accept shutdown read write };
+allow passt_t self:udp_socket { create getopt setopt connect bind read write };
allow passt_t self:icmp_socket { bind create setopt read write };
allow passt_t user_tmp_t:dir { add_name write };