SELinux and Shorewall with IPSets
Mr Dash Four
mr.dash.four at googlemail.com
Mon Jun 28 23:30:06 UTC 2010
> ipset isn't part of Fedora, right?
Wrong!
It is distributed as rpm in the Fedora Fusion (Free) repo (3 rpms in
fact: kmod-xtables-addons, xtables-addons and one additional package -
optional - xtables addons with metadata for kernel).
> You just built and installed it from source?
>
Please read my initial post - installing the above packages (i.e. the
'standard' distribution) makes NO difference whatsoever - I was getting
the same alerts regardless of whether I compile and install from source
or use the 'standard' distribution packages.
> I think it might be easiest to just label it the same as iptables and
> then shorewall will transition to iptables_t which already has raw IP
> socket access as well as other related permissions. That will be better
> too in that you don't need to directly allow shorewall or anything else
> it runs in-domain to have those permissions.
>
> semanage fcontext -a -t iptables_exec_t /path/to/ipset
> restorecon -v /path/to/ipset
>
An elegant solution ... but unfortunately it does NOT work - I am
getting the same alerts again.
The problem (as evident from my initial post on this thread) is that the
shorewall init file (normally based in /etc/shorewall/init) executes
ipset, which in turn, as you pointed out above, tries to open a raw
socket. I am in no way SELinux expert, but I would assume that the
security context in which this executes is shorewall and not the one set
in ipset.
Anyway, the solution presented by Dominic above works very well, so I
may stick with it.
More information about the selinux
mailing list