From: Daniel J Walsh <dwalsh@redhat.com>
To: "Christopher J. PeBenito" <cpebenito@tresys.com>
Cc: SELinux Mail List <selinux@tycho.nsa.gov>
Subject: Re: reserved_port_type attribute
Date: Mon, 26 Sep 2005 16:20:28 -0400 [thread overview]
Message-ID: <4338580C.4010804@redhat.com> (raw)
In-Reply-To: <1127757038.32172.22.camel@sgc.columbia.tresys.com>
Christopher J. PeBenito wrote:
>According to attrib.te, reserved_port_type is supposed to be for ports
>that are less than 1024. Why is reserved_port_t not included? Also,
>http_cache_port_t, ptal_port_t, clamd_port_t, pyzor_port_t, and
>dbskkd_port_t aren't labeling any ports below 1024 (dbskkd_port_t
>doesn't even have a portcon), so why have they been given this
>attribute?
>
>
>
They should not be. Probably cut and paste errors.
portcon tcp 1-1023 system_u:object_r:reserved_port_t
Since a portmap and friends are allowed to connect to any port that is
not a reserved_port_type, the above rule would
not allow portmap to use any ports less then 1023 I believe.
It probably would not be a bad idea to prevent portmapper and freinds
from connecting to any port that is defined.
--
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
prev parent reply other threads:[~2005-09-26 20:22 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2005-09-26 17:50 reserved_port_type attribute Christopher J. PeBenito
2005-09-26 18:20 ` Stephen Smalley
2005-09-26 18:28 ` Stephen Smalley
2005-09-26 20:20 ` Daniel J Walsh [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4338580C.4010804@redhat.com \
--to=dwalsh@redhat.com \
--cc=cpebenito@tresys.com \
--cc=selinux@tycho.nsa.gov \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.