Shouldn't this avc message be dontaudited?

Shouldn't this avc message be dontaudited?

[Daniel J Walsh]

How come I am getting this avc message

Oct  6 11:58:44 localhost kernel: audit(1097078324.850:0): avc:  denied  
{ name_bind } for  pid=2471 exe=/usr/sbin/nscd src=953 
scontext=user_u:system_r:nscd_t tcontext=system_u:object_r:rndc_port_t 
tclass=tcp_socket

When I have this rule?

dontaudit nscd_t reserved_port_t:{ tcp_socket udp_socket } name_bind;


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Shouldn't this avc message be dontaudited?

[Stephen Smalley]

On Wed, 2004-10-06 at 12:13, Daniel J Walsh wrote:
> How come I am getting this avc message
> 
> Oct  6 11:58:44 localhost kernel: audit(1097078324.850:0): avc:  denied  
> { name_bind } for  pid=2471 exe=/usr/sbin/nscd src=953 
> scontext=user_u:system_r:nscd_t tcontext=system_u:object_r:rndc_port_t 
> tclass=tcp_socket
> 
> When I have this rule?
> 
> dontaudit nscd_t reserved_port_t:{ tcp_socket udp_socket } name_bind;

Different types - reserved_port_t (covers any otherwise unspecified
reserved ports) vs. rndc_port_t.  Why would nscd try binding to this
port anyway?

-- 
Stephen Smalley <sds@epoch.ncsc.mil>
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Shouldn't this avc message be dontaudited?

[Daniel J Walsh]

Stephen Smalley wrote:

>On Wed, 2004-10-06 at 12:13, Daniel J Walsh wrote:
>  
>
>>How come I am getting this avc message
>>
>>Oct  6 11:58:44 localhost kernel: audit(1097078324.850:0): avc:  denied  
>>{ name_bind } for  pid=2471 exe=/usr/sbin/nscd src=953 
>>scontext=user_u:system_r:nscd_t tcontext=system_u:object_r:rndc_port_t 
>>tclass=tcp_socket
>>
>>When I have this rule?
>>
>>dontaudit nscd_t reserved_port_t:{ tcp_socket udp_socket } name_bind;
>>    
>>
>
>Different types - reserved_port_t (covers any otherwise unspecified
>reserved ports) vs. rndc_port_t.  Why would nscd try binding to this
>port anyway?
>
>  
>
I don't know.  I am seeing this avc on a targeted policy machine.

Dan

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Shouldn't this avc message be dontaudited?

[Luke Kenneth Casson Leighton]

ah, i got exactly the same thing: stephen assures me that this is
because i am using an older version of checkpolicy with a recent version
of everything-else.

by installing checkpolicy from the sf.net cvs he assures me that the
problem goes away.

sure enough, i find that two weeks ago i upgraded everything
but checkpolicy.

l.


On Wed, Oct 06, 2004 at 12:13:25PM -0400, Daniel J Walsh wrote:
> How come I am getting this avc message
> 
> Oct  6 11:58:44 localhost kernel: audit(1097078324.850:0): avc:  denied  
> { name_bind } for  pid=2471 exe=/usr/sbin/nscd src=953 
> scontext=user_u:system_r:nscd_t tcontext=system_u:object_r:rndc_port_t 
> tclass=tcp_socket
> 
> When I have this rule?
> 
> dontaudit nscd_t reserved_port_t:{ tcp_socket udp_socket } name_bind;
> 
> 
> --
> This message was distributed to subscribers of the selinux mailing list.
> If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov 
> with
> the words "unsubscribe selinux" without quotes as the message.

-- 
--
Truth, honesty and respect are rare commodities that all spring from
the same well: Love.  If you love yourself and everyone and everything
around you, funnily and coincidentally enough, life gets a lot better.
--
<a href="http://lkcl.net">      lkcl.net      </a> <br />
<a href="mailto:lkcl@lkcl.net"> lkcl@lkcl.net </a> <br />


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.