Merged with some changes.

On Tue, 2004-11-30 at 16:19, Daniel J Walsh wrote:
> Several can_network_clients were wrong
<snip>
> diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/mount.te policy-1.19.7/domains/program/mount.te
> --- nsapolicy/domains/program/mount.te 2004-11-09 13:35:12.000000000 -0500
> +++ policy-1.19.7/domains/program/mount.te 2004-11-30 06:18:45.000000000 -0500
> @@ -64,7 +64,7 @@
>
> ifdef(`portmap.te', `
> # for nfs
> -can_network(mount_t)
> +can_network_server(mount_t)
> can_ypbind(mount_t)
> allow mount_t port_t:{ tcp_socket udp_socket } name_bind;
> allow mount_t reserved_port_t:{ tcp_socket udp_socket } name_bind;

Left it as can_network(), otherwise, I can't mount a NFS partition. May be able to separate the NFS client and server usages, by I haven't looked into it.

<snip>
> diff --exclude-from=exclude -N -u -r nsapolicy/domains/program/unused/howl.te policy-1.19.7/domains/program/unused/howl.te
> --- nsapolicy/domains/program/unused/howl.te 2004-10-13 22:41:57.000000000 -0400
> +++ policy-1.19.7/domains/program/unused/howl.te 2004-11-30 06:18:45.000000000 -0500
> @@ -5,7 +5,7 @@
>
> daemon_domain(howl)
> allow howl_t proc_t:file { getattr read };
> -can_network(howl_t)
> +can_network_server(howl_t)
> can_ypbind(howl_t)
> allow howl_t self:capability { kill net_admin };
>

I used:
-allow howl_t proc_t:file { getattr read }; -can_network(howl_t)

+allow howl_t proc_net_t:dir search;
+allow howl_t proc_net_t:file {getattr read };
+can_network_server(howl_t)

<snip>
> diff --exclude-from=exclude -N -u -r nsapolicy/macros/program/ssh_macros.te policy-1.19.7/macros/program/ssh_macros.te
> --- nsapolicy/macros/program/ssh_macros.te 2004-11-30 05:59:40.000000000 -0500
> +++ policy-1.19.7/macros/program/ssh_macros.te 2004-11-30 06:18:45.000000000 -0500
> @@ -82,7 +82,7 @@
>
> # Grant permissions needed to create TCP and UDP sockets and
> # to access the network.
> -can_network($1_ssh_t)
> +can_network_client_tcp($1_ssh_t)
> can_ypbind($1_ssh_t)
>
> # Use capabilities.

I used can_network_client() instead.

The following was needed by ssh during my normal usage of it (like updating the CVS tree on sourceforge.)

allow user_ssh_t self:udp_socket create

-- 
James Carter <jwcart2@epoch.ncsc.mil>
National Security Agency

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.