ping problems.

ping problems.

[Kurt Roeckx]

ping6 doesn't seem to work to work when pinging localhost (::1).
It does work in case I ping a remote host however.

I get this error:
avc:  denied  { recvfrom } for  pid=1631 exe=/bin/ping6 netif=lo
scontext=kurt:sysadm_r:ping_t tcontext=system_u:system_r:kernel_t
tclass=rawip_socket

I think the tclass should be icmp_socket_t instead, for which is
has permission to use recvfrom.

Then there is a problem for both ping and ping6 if you try to use
the -I parameter.  You get:

avc:  denied  { ioctl } for  pid=1641 exe=/bin/ping6
path=socket:[8429] dev=00:00 ino=8429
scontext=kurt:sysadm_r:ping_t tcontext=kurt:sysadm_r:ping_t
tclass=rawip_socket

avc:  denied  { ioctl } for  pid=1647 exe=/bin/ping
path=socket:[8439] dev=00:00 ino=8439
scontext=kurt:sysadm_r:ping_t tcontext=kurt:sysadm_r:ping_t
tclass=rawip_socket


Kurt


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: ping problems.

[Russell Coker]

On Sat, 22 Mar 2003 21:45, Kurt Roeckx wrote:
> avc:  denied  { ioctl } for  pid=1641 exe=/bin/ping6
> path=socket:[8429] dev=00:00 ino=8429
> scontext=kurt:sysadm_r:ping_t tcontext=kurt:sysadm_r:ping_t
> tclass=rawip_socket

If the following rule is added:
allow ping_t self:rawip_socket create_socket_perms;

Then it'll add the ioctl access, plus the following:
getattr setattr append connect shutdown

I think that those 5 accesses are ok and using the macro allows a simpler rule 
which is a benefit.

I've added the ioctl to my tree for the moment, I'll probably change to the 
macro later.

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.