Question regarding port usage in respect to the tomcat policy

Question regarding port usage in respect to the tomcat policy

[Nick Gray]

In net_contexts I found this

ifdef(`use_http_cache', `
portcon tcp 3128  system_u:object_r:http_cache_port_t
portcon tcp 8080  system_u:object_r:http_cache_port_t
portcon udp 3130  system_u:object_r:http_cache_port_t
')

I needed 8080 for my tomcat tests so I stole it
by taking it out and creating my own


ifdef(`tomcat.te', `
portcon tcp 8080  system_u:object_r:tomcat_port_t
')

And I added this to the tomcat.te

allow tomcat_t tomcat_port_t:tcp_socket name_bind;

The question is why can I access port 8443 as well?

**

I think I figured it out. While doing the start/fix/restart, I found
that I needed this line as well (probably when I tried to access 8443)

allow tomcat_t port_t:tcp_socket name_bind;

So I am guessing that anything not labeled specifically must belong to
this type.

Nix


-- 
Nick Gray
Senior Systems Engineer
Bruzenak Inc
Office: 512-331-7998
Cell: 512-630-7009

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: Question regarding port usage in respect to the tomcat policy

[Daniel J Walsh]

Nick Gray wrote:

>In net_contexts I found this
>
>ifdef(`use_http_cache', `
>portcon tcp 3128  system_u:object_r:http_cache_port_t
>portcon tcp 8080  system_u:object_r:http_cache_port_t
>portcon udp 3130  system_u:object_r:http_cache_port_t
>')
>
>I needed 8080 for my tomcat tests so I stole it
>by taking it out and creating my own
>
>
>ifdef(`tomcat.te', `
>portcon tcp 8080  system_u:object_r:tomcat_port_t
>')
>
>And I added this to the tomcat.te
>
>allow tomcat_t tomcat_port_t:tcp_socket name_bind;
>
>The question is why can I access port 8443 as well?
>
>**
>
>I think I figured it out. While doing the start/fix/restart, I found
>that I needed this line as well (probably when I tried to access 8443)
>
>allow tomcat_t port_t:tcp_socket name_bind;
>  
>
No this says that you can bind to any port.
A better solution would be

ifdef(`tomcat.te', `
portcon tcp 8080  system_u:object_r:tomcat_port_t
portcon tcp 8083  system_u:object_r:tomcat_port_t
')


>So I am guessing that anything not labeled specifically must belong to
>this type.
>
>Nix
>
>
>  
>


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.