matchportcon?

[David Quigley]

On 07/15/2013 11:50, Daniel J Walsh wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On 07/14/2013 05:41 PM, David Quigley wrote:
>> On 07/14/2013 11:00, Dominick Grift wrote:
>>> On Sun, 2013-07-14 at 01:26 -0400, Dave Quigley wrote:
>>>> Do we have an equivalent of matchpathcon for ports? Where we can
>>>> specify a protocol and port and see what the policy thinks it 
>>>> labeled?
>>>>
>>>
>>> from man sepolicy-network:
>>>
>>>> sepolicy-network(8)
>>>>
>>>> sepolicy-network(8)
>>>>
>>>> NAME sepolicy-network - Examine the SELinux Policy and generate a
>>>> network report
>>>>
>>>> SYNOPSIS sepolicy network [-h] (-l | -p PORT [PORT ...] | -t TYPE 
>>>> [TYPE
>>>> ...] | -d DOMAIN [DOMAIN ...])
>>>>
>>>> DESCRIPTION Use sepolicy network to examine SELinux Policy and 
>>>> generate
>>>> network reports.
>>>>
>>>> OPTIONS -d, --domain Generate a report listing the ports to which 
>>>> the
>>>> specified domain is allowed to connect and or bind.
>>>>
>>>> -l, --list List all Network Port Types defined in SELinux Policy
>>>>
>>>> -h, --help Display help message
>>>>
>>>> -t, --type Generate a report listing the port numbers associate 
>>>> with
>>>> the specified SELinux port type.
>>>>
>>>> -p, --port Generate a report listing the SELinux port types 
>>>> associate
>>>> with the specified port number.
>>>>
>>>> AUTHOR This man page was written by Daniel Walsh 
>>>> <dwalsh at redhat.com>
>>>>
>>>> SEE ALSO sepolicy(8), selinux(8), semanage(8)
>>>>
>>>>
>>>> 20121005 sepolicy-network(8)
>>>
>>>> Dave -- selinux mailing list selinux at lists.fedoraproject.org
>>>> https://admin.fedoraproject.org/mailman/listinfo/selinux
>>
>> This is exactly what I needed thanks. I normally try looking through
>> semanage port -l but the problem is with ranges you can't just 
>> search for
>> what the port for something like 10234 is. This tool is exactly 
>> that. I can
>> just do sepolicy-network -p 10234. The only thing that seems to be 
>> lacking
>> is a way to specify protocol. However I don't think that's a big 
>> deal since
>> we only support 3 protocol types.
>>
>> Dave
>>
>> -- selinux mailing list selinux at lists.fedoraproject.org
>> https://admin.fedoraproject.org/mailman/listinfo/selinux
>
> sepolicy-network -p 10234 | grep udp
>
> :^)

That somewhat works :) because if you were to do sepolicy network -p 80 
| grep tcp

You still get:

80: tcp http_port_t 80
80: tcp reserved_port_t 1-511

So there is no definitive if you try to access port tcp 80 you need to 
be able to bind to http_port_t.