postfix, spamd, cupsd all attempting name_bind to 25, 893 etc. as "reserved_port_t"

postfix, spamd, cupsd all attempting name_bind to 25, 893 etc. as "reserved_port_t"

[Luke Kenneth Casson Leighton]

hi, i'm using the latest cvs from sf as policy.

kernel 2.6.8.1-selinux1 also from cvs (last week).

i get cups attempting to bind to port 631 as a "reserved_port_t",
also postfix to 25 likewise
and spamd_t to port 783 - again to reserved_port_t.

i've made absolutely no changes to the strict policy.

help?

-- 
--
Truth, honesty and respect are rare commodities that all spring from
the same well: Love.  If you love yourself and everyone and everything
around you, funnily and coincidentally enough, life gets a lot better.
--
<a href="http://lkcl.net">      lkcl.net      </a> <br />
<a href="mailto:lkcl@lkcl.net"> lkcl@lkcl.net </a> <br />


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: postfix, spamd, cupsd all attempting name_bind to 25, 893 etc. as "reserved_port_t"

[Thomas Bleher]

[-- Attachment #1: Type: text/plain, Size: 710 bytes --]

* Luke Kenneth Casson Leighton <lkcl@lkcl.net> [2004-09-26 20:31]:
> hi, i'm using the latest cvs from sf as policy.
> 
> kernel 2.6.8.1-selinux1 also from cvs (last week).
> 
> i get cups attempting to bind to port 631 as a "reserved_port_t",
> also postfix to 25 likewise
> and spamd_t to port 783 - again to reserved_port_t.
> 
> i've made absolutely no changes to the strict policy.

You need to use checkpolicy from cvs if you want to use the cvs policy.
reserved_port_t as used in the latest policy is only supported by the
cvs checkpolicy.

Thomas

-- 
http://www.cip.ifi.lmu.de/~bleher/selinux/ - my SELinux pages
GPG-Fingerprint: BC4F BB16 30D6 F253 E3EA  D09E C562 2BAE B2F4 ABE7

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: postfix, spamd, cupsd all attempting name_bind to 25, 893 etc. as "reserved_port_t"

[Luke Kenneth Casson Leighton]

On Sun, Sep 26, 2004 at 09:07:37PM +0200, Thomas Bleher wrote:
> * Luke Kenneth Casson Leighton <lkcl@lkcl.net> [2004-09-26 20:31]:
> > hi, i'm using the latest cvs from sf as policy.
> > 
> > kernel 2.6.8.1-selinux1 also from cvs (last week).
> > 
> > i get cups attempting to bind to port 631 as a "reserved_port_t",
> > also postfix to 25 likewise
> > and spamd_t to port 783 - again to reserved_port_t.
> > 
> > i've made absolutely no changes to the strict policy.
> 
> You need to use checkpolicy from cvs if you want to use the cvs policy.

 yes i ended up with those programs.  and libsepol which doesn't have a
 dpkg thing for it so i tarred it up to put onto the test machine.

 etc.

 but thanks for mentioning it.

 l.


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: postfix, spamd, cupsd all attempting name_bind to 25, 893 etc. as "reserved_port_t"

[Russell Coker]

On Mon, 27 Sep 2004 07:03, Luke Kenneth Casson Leighton <lkcl@lkcl.net> wrote:
>  yes i ended up with those programs.  and libsepol which doesn't have a
>  dpkg thing for it so i tarred it up to put onto the test machine.

libsepol is in my Debian repository, just not in main.

-- 
http://www.coker.com.au/selinux/   My NSA Security Enhanced Linux packages
http://www.coker.com.au/bonnie++/  Bonnie++ hard drive benchmark
http://www.coker.com.au/postal/    Postal SMTP/POP benchmark
http://www.coker.com.au/~russell/  My home page

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.