Re: Denials from newest kernel

[Paul Moore <paul.moore@hp.com>]

Venkat Yekkirala wrote:
> Venkat Yekkirala wrote:
> 
>>Joshua Brindle wrote:
>>
>>>I grabbed Erics new kernel builds and installed them and got some
>>>interesting denials. I started with no secmark rules 
>>
>>whatsoever on the
>>
>>>machine.
>>>
>>
>>Taking a fresh look again...
>>
>>1. What policy (with what patches) were you using when you 
>>saw these errors?
>>
>>2. What is the avahi daemon doing in the below? The reason I 
>>ask is that
>>   if the packet originated on the local machine itself and 
>>some how flowed back in,
>>   we would obviously see the avahi_t context as the target 
>>since that's what the
>>   packet was carrying.
> 
> Seeing that avahi is sending to a multicast address, it seems like
> it's receiving a copy of the message, THAT HAS THE avahi_t originating
> domain still tied to it. I am going to send a patch out shortly that
> will nullout this tie-up to the originating domain in postroute_last.
> This *should* take care of denials 2 &3 below. They will still appear,
> but with network_t (or unlabeled_t in Joshua's case since he seems to
> have his netmsg initsid context set to unlabeled_t:s0 as also the unlabeled
> initsid) in the target.

Just so it's clear in my mind, you're planning to set skb->secmark to
SECSID_NULL/0 *after* the last access check in selinux_ip_postroute_last()?

-- 
paul moore
linux security @ hp

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.