RE: SELinux Networking Enhancements

["Christopher J. PeBenito" <cpebenito@tresys.com>]

On Mon, 2006-10-30 at 13:27 -0500, James Morris wrote:
> # Server policy
> allow httpd_server_t httpd_client_t:peer { recv send };
> 
> # Client policy
> allow httpd_client_t httpd_server_t:peer { recv send };

Since we're talking about how policy, here is how I think the policy
should look like ideally, using the server side as example:

# service http requests (ipsec):
allow apache_t self:tcp_socket create_stream_socket_perms;
allow apache_t http_server_packet_t:packet { send recv };
allow apache_t http_spd_t:association polmatch;
allow apache_t mozilla_t:association { sendto recvfrom };
allow http_server_packet_t mozilla_t:association { flow_in flow_out };

# do dns lookups (non ipsec):
allow apache_t self:tcp_socket create_stream_socket_perms;
allow apache_t dns_client_packet_t:packet { send recv };
allow apache_t no_extlabel_t:association { sendto recvfrom };
allow dns_client_packet_t no_extlabel_t:association { flow_in flow_out };

This has the requirement that the type of the association is the same as
the type of the domain on the other side and no_extlabel_t (or
unlabeled_t) for unencrypted communications.

-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.