DHCP server and client

[Andreas Schuldei <andreas@schuldei.org>]

when i run a DHCP client or server on an selinux box the
interface dhcp uses is switched to promiscous mode.

as a result i get lots of denies for all the rest of the system,
which clutter up the logs. this is what newrules-selinux -d tells
me:

allow dhcpd_t sshd_t:packet_socket { recvfrom };
allow dhcpd_t courier_tcpd_t:packet_socket { recvfrom };
allow dhcpd_t netmsg_eth1_t:packet_socket { recvfrom };
allow dhcpd_t icmp_socket_t:rawip_socket { recvfrom };
allow dhcpd_t ping_t:rawip_socket { recvfrom };
allow dhcpd_t named_t:packet_socket { recvfrom };
allow dhcpd_t netmsg_eth0_t:packet_socket { recvfrom };
allow dhcpd_t apt_t:packet_socket { recvfrom };
allow dhcpd_t inetd_t:packet_socket { recvfrom };
allow dhcpd_t postfix_master_t:packet_socket { recvfrom };
allow dhcpd_t tcp_socket_t:packet_socket { recvfrom };

i am not sure if i have to allow them or wheather a dontaudit
should suffice. shouldnt one or the other be put in some kind of
dhcp-handling policy? the logging facility is becoming really
useless otherwise, since an avc denied warnings in the logs and
the really importent once get dropped.

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.