From c0b38cf988df48613209e48007eefd748480d52f Mon Sep 17 00:00:00 2001 From: Zdenek Pytela Date: Thu, 2 Dec 2021 10:55:46 +0100 Subject: [PATCH] Allow lldpd use an snmp subagent over a tcp socket Reference: https://gitbub.com/fedora-selinux/selinux-policy/commit/c0b38cf988df48613209e48007eefd748480d52f Conflict: NA When lldpd enables an snmp subagent for a tcp socket instead of udp: LLDPD_OPTIONS="-i -k -X tcp:127.0.0.1:705" the following permissions are required: - allow lldpd create and use tcp socket - name_connect to the agentx_port_t port Addresses the following AVC denials: type=PROCTITLE msg=audit(12/02/21 06:16:32.721:425) : proctitle=/usr/sbin/lldpd -i -k -X tcp:127.0.0.1:705 type=SYSCALL msg=audit(12/02/21 06:16:32.721:425) : arch=x86_64 syscall=socket success=yes exit=17 a0=inet a1=SOCK_STREAM a2=ip a3=0x0 items=0 ppid=129230 pid=129232 auid=unset uid=lldpd gid=lldpd euid=lldpd suid=lldpd fsuid=lldpd egid=lldpd sgid=lldpd fsgid=lldpd tty=(none) ses=unset comm=lldpd exe=/usr/sbin/lldpd subj=system_u:system_r:lldpad_t:s0 key=(null) type=AVC msg=audit(12/02/21 06:16:32.721:425) : avc: denied { create } for pid=129232 comm=lldpd scontext=system_u:system_r:lldpad_t:s0 tcontext=system_u:system_r:lldpad_t:s0 tclass=tcp_socket permissive=1 type=PROCTITLE msg=audit(12/02/21 06:16:32.721:426) : proctitle=/usr/sbin/lldpd -i -k -X tcp:127.0.0.1:705 type=SYSCALL msg=audit(12/02/21 06:16:32.721:426) : arch=x86_64 syscall=connect success=no exit=ECONNREFUSED(Connection refused) a0=0x11 a1=0x7ffff0e22c30 a2=0x10 a3=0x0 items=0 ppid=129230 pid=129232 auid=unset uid=lldpd gid=lldpd euid=lldpd suid=lldpd fsuid=lldpd egid=lldpd sgid=lldpd fsgid=lldpd tty=(none) ses=unset comm=lldpd exe=/usr/sbin/lldpd subj=system_u:system_r:lldpad_t:s0 key=(null) type=AVC msg=audit(12/02/21 06:16:32.721:426) : avc: denied { name_connect } for pid=129232 comm=lldpd dest=705 scontext=system_u:system_r:lldpad_t:s0 tcontext=system_u:object_r:agentx_port_t:s0 tclass=tcp_socket permissive=1 type=AVC msg=audit(12/02/21 06:16:32.721:426) : avc: denied { connect } for pid=129232 comm=lldpd scontext=system_u:system_r:lldpad_t:s0 tcontext=system_u:system_r:lldpad_t:s0 tclass=tcp_socket permissive=1 Resolves: rhbz#2028379 Signed-off-by: lujie54 --- policy/modules/contrib/lldpad.te | 3 +++ 1 file changed, 3 insertions(+) diff --git a/policy/modules/contrib/lldpad.te b/policy/modules/contrib/lldpad.te index 000fafb..cccbc09 100644 --- a/policy/modules/contrib/lldpad.te +++ b/policy/modules/contrib/lldpad.te @@ -32,6 +32,7 @@ allow lldpad_t self:fifo_file rw_fifo_file_perms; allow lldpad_t self:unix_stream_socket { accept connectto listen }; allow lldpad_t self:netlink_route_socket create_netlink_socket_perms; allow lldpad_t self:packet_socket create_socket_perms; +allow lldpad_t self:tcp_socket create_socket_perms; allow lldpad_t self:udp_socket create_socket_perms; manage_files_pattern(lldpad_t, lldpad_tmpfs_t, lldpad_tmpfs_t) @@ -54,6 +55,8 @@ auth_read_passwd(lldpad_t) corecmd_exec_bin(lldpad_t) +corenet_tcp_connect_agentx_port(lldpad_t) + dev_read_sysfs(lldpad_t) fs_getattr_tmpfs(lldpad_t) -- 1.8.3.1