netstat -Z

netstat -Z

[Russell Coker]

The command "netstat -Z -t" will show two entries for a localhost connection 
and thus show the context of each end of the socket.

The command "netstat -Z -x" seems to only show a single entry for the 
connection which will be from the server end.

http://wiki.postgresql.org/wiki/SEPostgreSQL

The above wiki page mentions "netstat -Z" and my personal interpretation of 
this was that I could use "netstat -Z" to find the context of a client end of 
a socket.  But it seems that I can only get the server end.

Is this what is desired?

-- 
russell@coker.com.au
http://etbe.coker.com.au/          My Main Blog
http://doc.coker.com.au/           My Documents Blog


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: netstat -Z

[KaiGai Kohei]

Russell Coker wrote:
> The command "netstat -Z -t" will show two entries for a localhost connection 
> and thus show the context of each end of the socket.
> 
> The command "netstat -Z -x" seems to only show a single entry for the 
> connection which will be from the server end.
> 
> http://wiki.postgresql.org/wiki/SEPostgreSQL
> 
> The above wiki page mentions "netstat -Z" and my personal interpretation of 
> this was that I could use "netstat -Z" to find the context of a client end of 
> a socket.  But it seems that I can only get the server end.
> 
> Is this what is desired?

Please note that the above wiki entry is on "postgresql.org".
It assumes PostgreSQL folds (not SELinux specialist) as audiences.
The purpose of description about "netstat -Z" is to make clear
the fact security context can be assigned to various kind of
objects (like socket), except for filesystem also.

Thanks,
-- 
OSS Platform Development Division, NEC
KaiGai Kohei <kaigai@ak.jp.nec.com>

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: netstat -Z

[Justin P. Mattock]

KaiGai Kohei wrote:
> Russell Coker wrote:
>> The command "netstat -Z -t" will show two entries for a localhost 
>> connection and thus show the context of each end of the socket.
>>
>> The command "netstat -Z -x" seems to only show a single entry for the 
>> connection which will be from the server end.
>>
>> http://wiki.postgresql.org/wiki/SEPostgreSQL
>>
>> The above wiki page mentions "netstat -Z" and my personal 
>> interpretation of this was that I could use "netstat -Z" to find the 
>> context of a client end of a socket.  But it seems that I can only 
>> get the server end.
>>
>> Is this what is desired?
>
> Please note that the above wiki entry is on "postgresql.org".
> It assumes PostgreSQL folds (not SELinux specialist) as audiences.
> The purpose of description about "netstat -Z" is to make clear
> the fact security context can be assigned to various kind of
> objects (like socket), except for filesystem also.
>
> Thanks,
Well; it's nice issuing:
ps auxZ to achieve some stats,
as opposed to ps au*;
In any case -Z would be nice to see,

regards;

Justin P. Mattock
 

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: netstat -Z

[Justin P. Mattock]

Russell Coker wrote:
> The command "netstat -Z -t" will show two entries for a localhost connection 
> and thus show the context of each end of the socket.
>
> The command "netstat -Z -x" seems to only show a single entry for the 
> connection which will be from the server end.
>
> http://wiki.postgresql.org/wiki/SEPostgreSQL
>
> The above wiki page mentions "netstat -Z" and my personal interpretation of 
> this was that I could use "netstat -Z" to find the context of a client end of 
> a socket.  But it seems that I can only get the server end.
>
> Is this what is desired?
>
>   
I think this is a good idea considering
the new policy_capability option.
(unfortunately if -Z is an option already, ubuntu jaunty
doesn't offer that yet);

regards;

Justin P. Mattock




--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: netstat -Z

[Paul Moore]

On Sunday 18 January 2009 3:32:36 am Russell Coker wrote:
> The command "netstat -Z -t" will show two entries for a localhost
> connection and thus show the context of each end of the socket.
>
> The command "netstat -Z -x" seems to only show a single entry for the
> connection which will be from the server end.
>
> http://wiki.postgresql.org/wiki/SEPostgreSQL
>
> The above wiki page mentions "netstat -Z" and my personal
> interpretation of this was that I could use "netstat -Z" to find the
> context of a client end of a socket.  But it seems that I can only
> get the server end.
>
> Is this what is desired?

I would think that we would want to see both the client and server unix 
sockets for the same reasons that we would want to see both client and 
server inet sockets.  However, it looks like that might be the case on 
my Fedora Rawhide system (I could be wrong, I don't mess with AF_UNIX 
much)?

Looking at my system with "netstat -x -Z -p" (columns removed for 
readability) I see what looks like a unix socket server and client for 
the ACPI daemon socket:
Active UNIX domain sockets (w/o servers)

Type       State         PID/Program name    Security Context
STREAM     CONNECTED     1994/acpid          system_u:system_r:apmd_t:s0
STREAM     CONNECTED     2139/acpid.socket   system_u:system_r:hald_t:s0

... and checking to see the actual programs with "ps 1994; ps 2139" 
(columns removed for readability) I see the following:

  PID COMMAND
 1994 /usr/sbin/acpid
 2139 hald-addon-acpi: listening on acpid socket /var/run/acpid.socket

I'm pretty sure that acpid (pid 1994) open the /var/run/acpid.socket and 
writes to it (acting as server) and that hald-addon-acpi opens the 
sockets and listens for events (acting as client).  If this is in fact 
the case, everything appears okay on Rawhide.

-- 
paul moore
linux @ hp

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.