On Thu, 29 Sep 2005, Gregory Maxwell wrote:
> type=AVC msg=audit(1128050967.120:12221195): avc: denied { name_bind
> } for pid=10749 comm="sctp_test" src=1234
> scontext=root:system_r:unconfined_t tcontext=system_u:object_r:port_t
> tclass=socket
SELinux has no protocol-level support for SCTP yet, so the SCTP socket is
being classified by SELInux as a generic socket, but still being checked
by the protocol-level bind() permissions.
Other parts of the code make assumptions about IP & IPv6 sockets,
classifying them as either TCP, UDP or 'RAW' (which is a
catch-all for IP protocols notably including ICMP).
We could add a policy entry for unconfined_t to allow name_bind for the
socket class, but we'd also hit problems where it defaults to a 'raw'
socket.
We can't simply classify SCTP as 'raw', as it has some different
semantics, such as multiple local and remote addresses, which we need to
investigate and develop proper controls for.
We proably need to rethink the way IP sockets default to 'raw', as new IP
protocols are sometimes developed (DCCP has just been implemented) and we
don't know that the 'raw' IP controls always appropriate.
- James
--
James Morris
<jmorris@xxxxxxxxx>
|
