Re: Showing port Labels

[Dave Quigley <selinux@davequigley.com>]

On 7/14/2014 8:58 AM, Stephen Smalley wrote:
> On 07/14/2014 05:25 AM, Dominick Grift wrote:
>> On Mon, 2014-07-14 at 02:49 -0400, Dave Quigley wrote:
>>> I am working on some slides for my workshop at oscon and I tried to find
>>> the context of a port a process is listening on. If I do netstat -lZ I
>>> see all the listening ports and a security context. However, it seems
>>> the security context is the context of the process that is listening on
>>> that port not the context of the port itself. Is there a way to see the
>>> context of the port itself? I don't see any other option that might give
>>> that information. Is there a way to get that information from proc? Or
>>> are the only components that know the context of a port the kernel and
>>> the policy store?
>>
>> It is probably not the answer you were looking for but i suppose I would
>> use seinfo --portcon
>
> sepolicy network -p <portnumber>
>
>

Also is there ideological reason why we don't support portcon or 
semanage port statements to override a port definition in the base module?

Dave