Re: Additional rule files

[Erich Schubert <erich@debian.org>]

(this is a repost since i didn't yet get a reply, and the pptp rules
you currently have included will not work)

Hi,

> I made a few cosmetic changes to pptp.te and also removed a couple of network 
> rules that didn't look right.  Please test the network stuff again and send 
> me an update.  I've put the pptp policy in my tree.

-allow pptpd_t { node_t pptpd_t }:rawip_socket { create_socket_perms
node_bind };
-allow pptpd_t { pptpd_t port_t}:tcp_socket { create_socket_perms
name_bind };

The second should better be replaced by:

----
# pptp port 1723
type pptp_port_t, port_type;
allow pptpd_t pptp_port_t:tcp_socket { create_socket_perms name_bind };

and in net_contexts:
ifdef(`pptp.te', `
portcon tcp 1723  system_u:object_r:pptp_port_t
')
----

As for the first line: The pptp daemon does start then, but when
connecting i get the following error:

audit(1094490089.788:0): avc:  denied  { create } for  pid=3524
exe=/usr/sbin/pptpctrl scontext=system_u:system_r:pptpd_t
tcontext=system_u:system_r:pptpd_t tclass=rawip_socket

pptp is IIRC a kind of GRE tunnel. I guess this rawip_socket permission
is needed for that.

The "tightest" set of permissions i found working is by adding

allow pptpd_t self:rawip_socket { create read write bind connect };
allow pptpd_t node_t:rawip_socket node_bind;

So i think the following should be added:
----
allow pptpd_t self:rawip_socket create_socket_perms;
allow pptpd_t node_t:rawip_socket node_bind;
----

Greetings,
Erich Schubert
-- 
   erich@(vitavonni.de|debian.org)    --    GPG Key ID: 4B3A135C    (o_
       The best things in life are free: Friendship and Love.       //\
       Es gibt kein idiotensicheres Programm, weil Idioten so       V_/_
                     genial sind. -- E. Murphy

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.