From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id 0EE131395E2 for ; Thu, 1 Dec 2016 10:24:33 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id E83D9E0BF0; Thu, 1 Dec 2016 10:24:30 +0000 (UTC) Received: from know-smtprelay-omc-2.server.virginmedia.net (know-smtprelay-omc-2.server.virginmedia.net [80.0.253.66]) by pigeon.gentoo.org (Postfix) with ESMTP id F070FE0BED for ; Thu, 1 Dec 2016 10:24:29 +0000 (UTC) Received: from germanicus.osburn-sharp.ath.cx ([82.21.57.43]) by know-smtprelay-2-imp with bizsmtp id EaQU1u00B0vxDhe01aQU2H; Thu, 01 Dec 2016 10:24:28 +0000 X-Originating-IP: [82.21.57.43] X-Spam: 0 X-Authority: v=2.1 cv=Ya9AnFlf c=1 sm=1 tr=0 a=MNowa69NLX2h0bwGqxd0GA==:117 a=MNowa69NLX2h0bwGqxd0GA==:17 a=L9H7d07YOLsA:10 a=9cW_t1CCXrUA:10 a=s5jvgZ67dGcA:10 a=n5n_aSjo0skA:10 a=r77TgQKjGQsHNAKrUKIA:9 a=wuv4MKHZGaBHpnE87-QA:9 a=QEXdDO2ut3YA:10 a=-LePmAW1_DnK7EMB6DsA:9 a=_W_S_7VecoQA:10 Received: from virgilia.osburn-sharp.ath.cx (virgilia.osburn-sharp.ath.cx [192.168.0.24]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "hadrian.osburn-sharp.ath.cx", Issuer "Osburn Sharp" (verified OK)) by germanicus.osburn-sharp.ath.cx (Postfix) with ESMTPS id 15DD6C0AE2 for ; Thu, 1 Dec 2016 10:24:28 +0000 (GMT) Received: from localhost (localhost [127.0.0.1]) by virgilia.osburn-sharp.ath.cx (Postfix) with ESMTP id D9D6016023E for ; Thu, 1 Dec 2016 10:24:27 +0000 (GMT) X-Virus-Scanned: amavisd-new at osburn-sharp.ath.cx Received: from virgilia.osburn-sharp.ath.cx ([127.0.0.1]) by localhost (virgilia.osburn-sharp.ath.cx [127.0.0.1]) (amavisd-new, port 10024) with LMTP id BDi6nHak9dun for ; Thu, 1 Dec 2016 10:24:21 +0000 (GMT) Received: from hadrian.osburn-sharp.ath.cx (hadrian.osburn-sharp.ath.cx [192.168.0.26]) (using TLSv1.2 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by virgilia.osburn-sharp.ath.cx (Postfix) with ESMTPSA id 6A6001601C3 for ; Thu, 1 Dec 2016 10:24:21 +0000 (GMT) To: gentoo-hardened@lists.gentoo.org From: Robert Sharp Subject: [gentoo-hardened] Policies and Ports - how to define access? Message-ID: <41970e93-0ba9-c417-1fc9-7f6e3baf416b@sharp.homelinux.org> Date: Thu, 1 Dec 2016 10:24:21 +0000 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.5.0 Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-hardened@lists.gentoo.org Reply-to: gentoo-hardened@lists.gentoo.org MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="------------24AE9B7755DD67B9E062EE21" X-Archives-Salt: dcca10d2-efea-4982-a5fe-26da41b6f28a X-Archives-Hash: 0ef01e927fcfa04d6e9d9772b0f33fca This is a multi-part message in MIME format. --------------24AE9B7755DD67B9E062EE21 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Hi, I've looked at the Gentoo SELinux web pages etc, the SELinux Handbook and through the Reference Policy and I cannot find the answer to a simple question. I am writing a small policy for my backup system and I want to be able to a) access a MongoDB running on remote servers, and b) use rsync. I can see two AVCs relating to my port use and I know how I can fix the problem from the command line, but surely I should be able to address this in the policy? I think there is an rsync interface I need to call (rsync_entry_type(mytype_t)) and I assume this will run rsync in the right domain? Mongo has a policy but the only interface is admin. All I need to do locally is connect to the port. Can I use "portcon" in a policy to do this or do I need to do something else? Thanks, Robert Sharp --------------24AE9B7755DD67B9E062EE21 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 7bit

Hi,


I've looked at the Gentoo SELinux web pages etc, the SELinux Handbook and through the Reference Policy and I cannot find the answer to a simple question.

I am writing a small policy for my backup system and I want to be able to a) access a MongoDB running on remote servers, and b) use rsync. I can see two AVCs relating to my port use and I know how I can fix the problem from the command line, but surely I should be able to address this in the policy? I think there is an rsync interface I need to call (rsync_entry_type(mytype_t)) and I assume this will run rsync in the right domain?

Mongo has a policy but the only interface is admin. All I need to do locally is connect to the port. Can I use "portcon" in a policy to do this or do I need to do something else?

Thanks,

Robert Sharp

--------------24AE9B7755DD67B9E062EE21--