How to allow vsftpd to listen on other ports?

[Dawid Gajownik]

Hi!

I wanted vsftpd to listen on 750 or 777 port. SELinux does not like this

type=AVC msg=audit(1141840161.184:107): avc:  denied  { name_bind } for 
  pid=5352 comm="vsftpd" src=777 scontext=root:system_r:ftpd_t 
tcontext=system_u:object_r:reserved_port_t tclass=tcp_socket
type=AVC msg=audit(1141840470.444:114): avc:  denied  { name_bind } for 
  pid=5495 comm="vsftpd" src=750 scontext=root:system_r:ftpd_t 
tcontext=system_u:object_r:kerberos_port_t tclass=tcp_socket

I've downloaded selinux-policy-targeted-sources rpm and wanted to add 
this line:

portcon tcp 750 system_u:object_r:ftp_port_t

The problem is that I don't know where should it be placed. It does not 
work in domains/misc/local.te -- `make load' fails ;-)

OS: FC4
selinux-policy-targeted-sources: 1.27.1-2.22

Regards,
	Dawid

-- 

   ^_*

[Stephen Smalley]

On Wed, 2006-03-08 at 19:03 +0100, Dawid Gajownik wrote:
>  Hi!
>  
>  I wanted vsftpd to listen on 750 or 777 port. SELinux does not like this
>  
>  type=AVC msg=audit(1141840161.184:107): avc:  denied  { name_bind } for 
>    pid=5352 comm="vsftpd" src=777 scontext=root:system_r:ftpd_t 
>  tcontext=system_u:object_r:reserved_port_t tclass=tcp_socket
>  type=AVC msg=audit(1141840470.444:114): avc:  denied  { name_bind } for 
>    pid=5495 comm="vsftpd" src=750 scontext=root:system_r:ftpd_t 
>  tcontext=system_u:object_r:kerberos_port_t tclass=tcp_socket
>  
>  I've downloaded selinux-policy-targeted-sources rpm and wanted to add 
>  this line:
>  
>  portcon tcp 750 system_u:object_r:ftp_port_t
>  
>  The problem is that I don't know where should it be placed. It does not 
>  work in domains/misc/local.te -- `make load' fails ;-)
>  
>  OS: FC4
>  selinux-policy-targeted-sources: 1.27.1-2.22 
Needs to go in net_contexts, and put before the catchall cases for
reserved_port_t.

In FC5, you'll have much nicer options for such customization via
semanage without needing policy sources at all.

-- 
Stephen Smalley
National Security Agency

[Dawid Gajownik]

Dnia 03/08/2006 07:11 PM, Użytkownik Stephen Smalley napisał:

>  Needs to go in net_contexts, and put before the catchall cases for
>  reserved_port_t. 
Thanks, it works but I wanted to avoid modifying this file. Does that 
mean that I will need to edit it after every 
selinux-policy-targetes-sources update? (I can use ftp port > 1023 so 
this entry wouldn't need to be placed before reserved_port_t)

>  In FC5, you'll have much nicer options for such customization
> via
>  semanage without needing policy sources at all. 
Yes, it's more user friendly :D I've just tested it on my rawhide box. 
semanage man page sucks a bit (no examples), so it took me few minutes 
to construct this command:

semanage port -a -t ftp_port_t -p tcp 7777

Actually, it was unnecessary on FC5 ;-) It seems that SELinux policy 
does not block vsftpd from binding to other ports (or my system is 
broken?). I'm using selinux-policy-targeted-2.2.23-6 it if makes any 
differance.

I had to modify http_port_t to allow Apache to work on 81 port, though...

-- 

   ^_*

[Stephen Smalley]

On Wed, 2006-03-08 at 20:41 +0100, Dawid Gajownik wrote:
>  Dnia 03/08/2006 07:11 PM, Użytkownik Stephen Smalley napisał:
>  
>  > Needs to go in net_contexts, and put before the catchall cases for
>  > reserved_port_t.
>  
>  Thanks, it works but I wanted to avoid modifying this file. Does that 
>  mean that I will need to edit it after every 
>  selinux-policy-targetes-sources update? (I can use ftp port > 1023 so 
>  this entry wouldn't need to be placed before reserved_port_t) 
I think so.  One of the motivations for semanage in FC5.
refpolicy also makes an improvement in this area even in the source
policy situation IIUC, by allowing you to scatter portcon and similar
statements throughout the policy source files and have the build process
extract them for final processing.

>  Yes, it's more user friendly :D I've just tested it on my
> rawhide box. 
>  semanage man page sucks a bit (no examples), so it took me few minutes 
>  to construct this command:
>  
>  semanage port -a -t ftp_port_t -p tcp 7777
>  
>  Actually, it was unnecessary on FC5 ;-) It seems that SELinux policy 
>  does not block vsftpd from binding to other ports (or my system is 
>  broken?). I'm using selinux-policy-targeted-2.2.23-6 it if makes any 
>  differance. 
Policy (both FC4 and FC5) appear to allow ftpd to bind to generic ports
(port_t) outside of the reserved range plus the ftp data port and the
ftp service port.  Did you mean 777 or 7777?  One would be mapped to
reserved_port_t, the other to port_t.

>  I had to modify http_port_t to allow Apache to work on 81 port,
> though... 
-- 
Stephen Smalley
National Security Agency

[Dawid Gajownik]

Dnia 03/08/2006 08:56 PM, Użytkownik Stephen Smalley napisał:
> > semanage man page sucks a bit (no examples), so it took me few
> minutes 
> > to construct this command:
> >
> > semanage port -a -t ftp_port_t -p tcp 7777 
Heh, I've found today this link → 
http://fedoraproject.org/wiki/SELinux/FAQ/ProposedAdditions#head-b8a7b039...
:-)

>  Policy (both FC4 and FC5) appear to allow ftpd to bind to generic
> ports
>  (port_t) outside of the reserved range plus the ftp data port and the
>  ftp service port. 
I did not know that. I thought that policy blocks binding to any port 
except ftp_port_t. (Yes, I did not read domains/program/ftpd.te :P )

Hmmm... would you be willing to explain me why ftpd is allowed to bind 
to port_t? If it's done on purpose, why 1-1023 ports are so important 
that they cannot be used without policy modification?

>   Did you mean 777 or 7777? 
I used port 777 on FC4 and 7777 one on FC5 - I did not know that it 
would make a difference.

Thanks for your help!

-- 

   ^_*

[Stephen Smalley]

On Thu, 2006-03-09 at 23:44 +0100, Dawid Gajownik wrote:
>  I did not know that. I thought that policy blocks binding to any port
>
>  except ftp_port_t. (Yes, I did not read domains/program/ftpd.te :P )
>  
>  Hmmm... would you be willing to explain me why ftpd is allowed to bind 
>  to port_t? If it's done on purpose, why 1-1023 ports are so important 
>  that they cannot be used without policy modification? 
It has been a while since I've looked at the specifics of that policy,
but I suspect that ftpd wants to bind to arbitrary unreserved ports for
data connections.  Whereas you'd like to keep the reserved port space
clean so that e.g. ftpd doesn't masquerade as some other well-known
service.  OTOH, if we are now keeping all well-defined port types
defined in the base policy regardless of the set of policy modules
included (which wasn't originally the case), then we might not need to
concern ourselves with the reserved_port_t fallback.  cc'd some other
folks who may have an opinion.

-- 
Stephen Smalley
National Security Agency

[Dawid Gajownik]

Dnia 03/10/2006 03:34 PM, Użytkownik Stephen Smalley napisał:
>  It has been a while since I've looked at the specifics of that
> policy,
>  but I suspect that ftpd wants to bind to arbitrary unreserved ports for
>  data connections.  Whereas you'd like to keep the reserved port space
>  clean so that e.g. ftpd doesn't masquerade as some other well-known
>  service. 
Thanks for the explanation!

-- 

   ^_*