SELinux module to allow a single network port?

[Chris Adams]

I originally posted this to the RHEL5 list, but someone pointed me to
this list (I didn't realize there was an SELinux list).

I have done some minor SELinux customizations with a module, and now I'm
trying to do something a little more complicated.

I want to allow a CGI to do a "whois" lookup.  It is a perl script that
is attempting to open a TCP socket to port 43.  I ran audit2allow, but I
think the generated rule allows CGIs to open outbound sockets to any
port.  I'd rather just allow TCP to port 43.

I don't see a defined whois port type, and I don't know quite how to
define it myself in a module.

Help?

-- 
Chris Adams <cmadams(a)hiwaay.net&gt;
Systems and Network Administrator - HiWAAY Internet Services
I don't speak for anybody but myself - that's enough trouble.

[Stephen Smalley]

On Fri, 2008-02-15 at 11:03 -0600, Chris Adams wrote:
>  I originally posted this to the RHEL5 list, but someone pointed me
> to
>  this list (I didn't realize there was an SELinux list).
>  
>  I have done some minor SELinux customizations with a module, and now I'm
>  trying to do something a little more complicated.
>  
>  I want to allow a CGI to do a "whois" lookup.  It is a perl script that
>  is attempting to open a TCP socket to port 43.  I ran audit2allow, but I
>  think the generated rule allows CGIs to open outbound sockets to any
>  port.  I'd rather just allow TCP to port 43.
>  
>  I don't see a defined whois port type, and I don't know quite how to
>  define it myself in a module.
>  
>  Help? 
Possibly something like this:

$ vi whois.te
policy_module(whois, 1.0)
type whois_port_t, port_type;
:wq
$ make -f /usr/share/selinux/devel/Makefile whois.pp
$ su
# semodule -i whois.pp
# semanage port -a -t whois_port_t -p tcp 43

-- 
Stephen Smalley
National Security Agency

[Stephen Smalley]

On Fri, 2008-02-15 at 13:26 -0500, Stephen Smalley wrote:
>  On Fri, 2008-02-15 at 11:03 -0600, Chris Adams wrote:
>  > I originally posted this to the RHEL5 list, but someone pointed me to
>  > this list (I didn't realize there was an SELinux list).
>  > 
>  > I have done some minor SELinux customizations with a module, and now I'm
>  > trying to do something a little more complicated.
>  > 
>  > I want to allow a CGI to do a "whois" lookup.  It is a perl script that
>  > is attempting to open a TCP socket to port 43.  I ran audit2allow, but I
>  > think the generated rule allows CGIs to open outbound sockets to any
>  > port.  I'd rather just allow TCP to port 43.
>  > 
>  > I don't see a defined whois port type, and I don't know quite how to
>  > define it myself in a module.
>  > 
>  > Help?
>  
>  Possibly something like this:
>  
>  $ vi whois.te
>  policy_module(whois, 1.0) 
You'd also need a require statement here, ala:
require {
	attribute port_type;
}

>  type whois_port_t, port_type;
>  :wq
>  $ make -f /usr/share/selinux/devel/Makefile whois.pp
>  $ su
>  # semodule -i whois.pp
>  # semanage port -a -t whois_port_t -p tcp 43
>   
-- 
Stephen Smalley
National Security Agency

[Chris Adams]

Once upon a time, Stephen Smalley <sds(a)tycho.nsa.gov&gt; said:
>  # semanage port -a -t whois_port_t -p tcp 43 
This was the part I was missing; I have it working now.  Thanks!
-- 
Chris Adams <cmadams(a)hiwaay.net&gt;
Systems and Network Administrator - HiWAAY Internet Services
I don't speak for anybody but myself - that's enough trouble.