57 lines
3.1 KiB
Diff
57 lines
3.1 KiB
Diff
From c0b38cf988df48613209e48007eefd748480d52f Mon Sep 17 00:00:00 2001
|
|
From: Zdenek Pytela <zpytela@redhat.com>
|
|
Date: Thu, 2 Dec 2021 10:55:46 +0100
|
|
Subject: [PATCH] Allow lldpd use an snmp subagent over a tcp socket
|
|
|
|
Reference: https://gitbub.com/fedora-selinux/selinux-policy/commit/c0b38cf988df48613209e48007eefd748480d52f
|
|
Conflict: NA
|
|
|
|
When lldpd enables an snmp subagent for a tcp socket instead of udp:
|
|
LLDPD_OPTIONS="-i -k -X tcp:127.0.0.1:705"
|
|
|
|
the following permissions are required:
|
|
- allow lldpd create and use tcp socket
|
|
- name_connect to the agentx_port_t port
|
|
|
|
Addresses the following AVC denials:
|
|
|
|
type=PROCTITLE msg=audit(12/02/21 06:16:32.721:425) : proctitle=/usr/sbin/lldpd -i -k -X tcp:127.0.0.1:705
|
|
type=SYSCALL msg=audit(12/02/21 06:16:32.721:425) : arch=x86_64 syscall=socket success=yes exit=17 a0=inet a1=SOCK_STREAM a2=ip a3=0x0 items=0 ppid=129230 pid=129232 auid=unset uid=lldpd gid=lldpd euid=lldpd suid=lldpd fsuid=lldpd egid=lldpd sgid=lldpd fsgid=lldpd tty=(none) ses=unset comm=lldpd exe=/usr/sbin/lldpd subj=system_u:system_r:lldpad_t:s0 key=(null)
|
|
type=AVC msg=audit(12/02/21 06:16:32.721:425) : avc: denied { create } for pid=129232 comm=lldpd scontext=system_u:system_r:lldpad_t:s0 tcontext=system_u:system_r:lldpad_t:s0 tclass=tcp_socket permissive=1
|
|
|
|
type=PROCTITLE msg=audit(12/02/21 06:16:32.721:426) : proctitle=/usr/sbin/lldpd -i -k -X tcp:127.0.0.1:705
|
|
type=SYSCALL msg=audit(12/02/21 06:16:32.721:426) : arch=x86_64 syscall=connect success=no exit=ECONNREFUSED(Connection refused) a0=0x11 a1=0x7ffff0e22c30 a2=0x10 a3=0x0 items=0 ppid=129230 pid=129232 auid=unset uid=lldpd gid=lldpd euid=lldpd suid=lldpd fsuid=lldpd egid=lldpd sgid=lldpd fsgid=lldpd tty=(none) ses=unset comm=lldpd exe=/usr/sbin/lldpd subj=system_u:system_r:lldpad_t:s0 key=(null)
|
|
type=AVC msg=audit(12/02/21 06:16:32.721:426) : avc: denied { name_connect } for pid=129232 comm=lldpd dest=705 scontext=system_u:system_r:lldpad_t:s0 tcontext=system_u:object_r:agentx_port_t:s0 tclass=tcp_socket permissive=1
|
|
type=AVC msg=audit(12/02/21 06:16:32.721:426) : avc: denied { connect } for pid=129232 comm=lldpd scontext=system_u:system_r:lldpad_t:s0 tcontext=system_u:system_r:lldpad_t:s0 tclass=tcp_socket permissive=1
|
|
|
|
Resolves: rhbz#2028379
|
|
Signed-off-by: lujie54 <lujie54@huawei.com>
|
|
---
|
|
policy/modules/contrib/lldpad.te | 3 +++
|
|
1 file changed, 3 insertions(+)
|
|
|
|
diff --git a/policy/modules/contrib/lldpad.te b/policy/modules/contrib/lldpad.te
|
|
index 000fafb..cccbc09 100644
|
|
--- a/policy/modules/contrib/lldpad.te
|
|
+++ b/policy/modules/contrib/lldpad.te
|
|
@@ -32,6 +32,7 @@ allow lldpad_t self:fifo_file rw_fifo_file_perms;
|
|
allow lldpad_t self:unix_stream_socket { accept connectto listen };
|
|
allow lldpad_t self:netlink_route_socket create_netlink_socket_perms;
|
|
allow lldpad_t self:packet_socket create_socket_perms;
|
|
+allow lldpad_t self:tcp_socket create_socket_perms;
|
|
allow lldpad_t self:udp_socket create_socket_perms;
|
|
|
|
manage_files_pattern(lldpad_t, lldpad_tmpfs_t, lldpad_tmpfs_t)
|
|
@@ -54,6 +55,8 @@ auth_read_passwd(lldpad_t)
|
|
|
|
corecmd_exec_bin(lldpad_t)
|
|
|
|
+corenet_tcp_connect_agentx_port(lldpad_t)
|
|
+
|
|
dev_read_sysfs(lldpad_t)
|
|
|
|
fs_getattr_tmpfs(lldpad_t)
|
|
--
|
|
1.8.3.1
|
|
|