Re: semanage

[Dominick Grift <domg472@gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 3689 bytes --]

On 08/01/2010 11:06 PM, Ralph Blach wrote:
> Ok, you said
> 
> cat <<D_G >mysshd.te
> 
> is D_G a file someplace?

No it is a way to echo multiple lines into a file (mysshd.te)

you could also:

mkdir ~/mysshd; cd ~/mysshd;
echo "policy_module(mysshd, 1.0.0) > mysshd.te;
echo "gen_require(\`" >> mysshd.te;
echo "type sshd_t;" >> mysshd.te;
echo "')" >> mysshd.te;
echo "corenet_tcp_bind_http_port(sshd_t)" >> mysshd.te;
make -f /usr/share/selinux/devel/Makefile mysshd.pp
sudo semodule -i mysshd.pp


> Thanks
> 
> Chip
> 
> 
> On 08/01/2010 12:43 PM, Dominick Grift wrote:
>> On 08/01/2010 06:41 PM, Dominick Grift wrote:
>>> On 08/01/2010 06:35 PM, Dominick Grift wrote:
>>>> On 08/01/2010 06:22 PM, Ralph Blach wrote:
>>>>> To be specific, I want to run sshd on port 443, and not port 22, because
>>>>> of all the hackers probe port 22.
>>>>>
>>>>> port 443 looks like httpd traffic and therefore is not really supicious.
>>>>>
>>>>> That is what I need to achieve so i need to modify the corenetwork
>>>>> module to do this.
>>>>>
>>>>> How is this done and where is the source for the core network module?
>>>>
>>>> Try this:
>>>>
>>>> mkdir ~/mysshd; cd ~/mysshd;
>>>>
>>>> cat <<D_G >mysshd.te
>>>> policy_module(mysshd, 1.0.0)
>>>> gen_require(`
> 
>>>> type shorewall_t;
> 
>> And this needs to be ..
> 
>> type sshd_t;
> 
>> .. instead
> 
>>>> ')
>>>> corenet_tcp_bind_http_ports(sshd_t)
>>>> D_G
>>>>
>>>> That custom policy module should allow sshd to bind tcp sockets to http
>>>> ports (including tcp:443)
>>>
>>> Ofcourse you also have to build and install the custom module:
>>>
>>> ( below is how that is done in Fedora (RHEL5 requires that you also
>>> install selinux-policy-devel to build a module)
>>>
>>> make -f /usr/share/selinux/devel/Makefile mysshd.pp
>>> sudo semodule -i mysshd.pp
>>>
>>>
>>>>
>>>> You can find source policy in the source package for your policy.
>>>>
>>>> Here is the policy browser from upstream:
>>>> http://oss.tresys.com/projects/refpolicy/browser
>>>>
>>>>
>>>>> Thanks
>>>>>
>>>>> Chip
>>>>>
>>>>>
>>>>>
>>>>> On 08/01/2010 12:02 PM, Dominick Grift wrote:
>>>>>> On 08/01/2010 05:43 PM, Ralph Blach wrote:
>>>>>>> I have discovered that ports 443 and 22 are in module tcp.
>>>>>>>
>>>>>>> How do i rewrite module tcp so that I can configure as I want it.
>>>>>>>
>>>>>>> Where do I find module tcp?
>>>>>>>
>>>>>>> I did a semanage port -l | grep 22 and module tcp was listed.
>>>>>>> I did the same for port 443
>>>>>>>
>>>>>>> Thanks
>>>>>
>>>>>> ports are declared (defined) in the corenetwork module. This module is
>>>>>> part of the base module. modules that are part of the base module are
>>>>>> not listed with semodule -l.
>>>>>
>>>>>> What exactly do you want to achieve? If you are specific about your
>>>>>> requirements we can try to help you implement it.
>>>>>
>>>>>>> Chip
>>>>>>>
>>>>>>> On 07/27/2010 08:29 PM, Jason Axelson wrote:
>>>>>>>> On Tue, Jul 27, 2010 at 2:20 PM, Ralph Blach <chipper19522@gmail.com> wrote:
>>>>>>>>> how do I use semanage to list the policy modules.
>>>>>>>
>>>>>>>> Hi Chip,
>>>>>>>
>>>>>>>> Perhaps you are looking for "semodule -l"? That will list out all the
>>>>>>>> installed policy modules (besides base).
>>>>>>>
>>>>>>>> Jason
>>>>>>>
>>>>>>>
>>>>>
>>>>>> --
>>>>>> This message was distributed to subscribers of the selinux mailing list.
>>>>>> If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov
>>>>>> with
>>>>>> the words "unsubscribe selinux" without quotes as the message.
>>>>>
>>>>>
>>>>>
>>>>
>>>
>>>
> 
> 
> 


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 261 bytes --]