Hello, all:
I'm trying to write a policy for memcached, but I'm not sure how I'd declare a new memcached_port_t (11211/tcp). Any pointers?
TIA!
Cheers,
You can add ports via semange e.g. "semanage port -a -t memcached_port_t -p tcp 11211"
see semanage(8) for more details
PS: you need to declare the type in your policy before executing the command. look at modules/kernel/corenetwork.te for some examples
On 06.09.2007, at 18:43, Konstantin Ryabitsev wrote:
Hello, all:
I'm trying to write a policy for memcached, but I'm not sure how I'd declare a new memcached_port_t (11211/tcp). Any pointers?
TIA!
Cheers,
Konstantin Ryabitsev Montréal, Québec
-- fedora-selinux-list mailing list fedora-selinux-list@redhat.com https://www.redhat.com/mailman/listinfo/fedora-selinux-list
Stefan Schulze Frielinghaus wrote:
You can add ports via semange e.g. "semanage port -a -t memcached_port_t -p tcp 11211"
see semanage(8) for more details
PS: you need to declare the type in your policy before executing the command. look at modules/kernel/corenetwork.te for some examples
On 06.09.2007, at 18:43, Konstantin Ryabitsev wrote:
Hello, all:
I'm trying to write a policy for memcached, but I'm not sure how I'd declare a new memcached_port_t (11211/tcp). Any pointers?
If you want to manage the port for a daemon that is started/stopped via an init script, then the best place to put the 'semanage port -a ...' command is in the init script itself. This will ensure that the port definition is set and removed when the daemon starts/stops. Putting it in the spec file and running at package install time is not enough because I don't believe that the semanage'd ports persist after a reboot.
start() { ... if selinuxenabled ; then /usr/sbin/semanage port -a -t memcached_port_t -p tcp 12111 &>/dev/null || : fi ... }
stop() { ... if selinuxenabled ; then /usr/sbin/semanage port -d -t memcached_port_t -p tcp 11211 &>/dev/null || : fi ... }
--Wart
On Thu, 2007-09-06 at 14:18 -0700, Michael Thomas wrote:
If you want to manage the port for a daemon that is started/stopped via an init script, then the best place to put the 'semanage port -a ...' command is in the init script itself. This will ensure that the port definition is set and removed when the daemon starts/stops. Putting it in the spec file and running at package install time is not enough because I don't believe that the semanage'd ports persist after a reboot.
Actually, the port does persist across a reboot, because semanage rebuilds the binary policy (that's the reason that it takes so long to run).
Forrest
On 06.09.2007, at 23:18, Michael Thomas wrote:
Stefan Schulze Frielinghaus wrote:
You can add ports via semange e.g. "semanage port -a -t memcached_port_t -p tcp 11211"
see semanage(8) for more details
PS: you need to declare the type in your policy before executing the command. look at modules/kernel/corenetwork.te for some examples
On 06.09.2007, at 18:43, Konstantin Ryabitsev wrote:
Hello, all:
I'm trying to write a policy for memcached, but I'm not sure how I'd declare a new memcached_port_t (11211/tcp). Any pointers?
If you want to manage the port for a daemon that is started/stopped via an init script, then the best place to put the 'semanage port -a ...' command is in the init script itself. This will ensure that the port definition is set and removed when the daemon starts/stops. Putting it in the spec file and running at package install time is not enough because I don't believe that the semanage'd ports persist after a reboot.
start() { ... if selinuxenabled ; then /usr/sbin/semanage port -a -t memcached_port_t -p tcp 12111 &>/dev/null || : fi ... }
stop() { ... if selinuxenabled ; then /usr/sbin/semanage port -d -t memcached_port_t -p tcp 11211 &>/dev/null || : fi ... }
What additional security benefit should this bring if you add and remove the port type via an init script? On the contrary I think this harms rather than hardens the system. Because if you remove the port type by running the init script with the stop option every application with network access can now send data over this port (with no further allow statements). But if you would have led the port type no application with additional allow statements on port xyz could send data over this port. In the end you could trust sooner that data.
Stefan Schulze Frielinghaus wrote:
On 06.09.2007, at 23:18, Michael Thomas wrote:
Stefan Schulze Frielinghaus wrote:
You can add ports via semange e.g. "semanage port -a -t memcached_port_t -p tcp 11211"
see semanage(8) for more details
PS: you need to declare the type in your policy before executing the command. look at modules/kernel/corenetwork.te for some examples
On 06.09.2007, at 18:43, Konstantin Ryabitsev wrote:
Hello, all:
I'm trying to write a policy for memcached, but I'm not sure how I'd declare a new memcached_port_t (11211/tcp). Any pointers?
If you want to manage the port for a daemon that is started/stopped via an init script, then the best place to put the 'semanage port -a ...' command is in the init script itself. This will ensure that the port definition is set and removed when the daemon starts/stops. Putting it in the spec file and running at package install time is not enough because I don't believe that the semanage'd ports persist after a reboot.
start() { ... if selinuxenabled ; then /usr/sbin/semanage port -a -t memcached_port_t -p tcp 12111 &>/dev/null || : fi ... }
stop() { ... if selinuxenabled ; then /usr/sbin/semanage port -d -t memcached_port_t -p tcp 11211 &>/dev/null || : fi ... }
What additional security benefit should this bring if you add and remove the port type via an init script? On the contrary I think this harms rather than hardens the system. Because if you remove the port type by running the init script with the stop option every application with network access can now send data over this port (with no further allow statements). But if you would have led the port type no application with additional allow statements on port xyz could send data over this port. In the end you could trust sooner that data.
You make a good argument: removing the port may not be necessary. But you should still add the port in the init script. If selinux is disabled when the package is installed then the port won't get added, because 'semanage port -a' will fail. If the admin later enables selinux then the port won't have the proper label and the service will fail when using the port.
--Wart
On Thu, 2007-09-06 at 12:43 -0400, Konstantin Ryabitsev wrote:
Hello, all:
I'm trying to write a policy for memcached, but I'm not sure how I'd declare a new memcached_port_t (11211/tcp). Any pointers?
First, you need to build a module and load it into the policy:
Create a file in /root called memcached that contains the following:
module memcached 1.0.0;
require { attribute port_type; };
type memcache_port_t, port_type;
Build it and load it: cd /root make -f /usr/share/selinux/devel/Makefile (if that file doesn't exist, install the selinux-policy-devel package)
semodule -i memcached.pp
Second, use semanage to associate the port with the new port name:
semanage port -a -t memcache_port_t -p tcp 11211
Forrest
selinux@lists.fedoraproject.org