Re: Labelling a new port

[Michael Thomas]

Stefan Schulze Frielinghaus wrote:
>  You can add ports via semange e.g. "semanage port -a -t
> memcached_port_t
>  -p tcp 11211"
>  
>  see semanage(8) for more details
>  
>  PS: you need to declare the type in your policy before executing the
>  command. look at modules/kernel/corenetwork.te for some examples
>  
>  On 06.09.2007, at 18:43, Konstantin Ryabitsev wrote:
>  
> > Hello, all:
> >
> > I'm trying to write a policy for memcached, but I'm not sure how I'd
> > declare a new memcached_port_t (11211/tcp). Any pointers? 
If you want to manage the port for a daemon that is started/stopped via
an init script, then the best place to put the 'semanage port -a ...'
command is in the init script itself.  This will ensure that the port
definition is set and removed when the daemon starts/stops.  Putting it
in the spec file and running at package install time is not enough
because I don't believe that the semanage'd ports persist after a reboot.

start() {
...
    if selinuxenabled ; then
        /usr/sbin/semanage port -a -t memcached_port_t -p tcp 12111
&>/dev/null || :
    fi
...
}

stop() {
...
    if selinuxenabled ; then
        /usr/sbin/semanage port -d -t memcached_port_t -p tcp 11211
&>/dev/null || :
    fi
...
}

--Wart