Received-SPF: pass (google.com: domain of selinux-refpolicy-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   Dominick Grift <dominick.grift@defensec.nl>
To:     Russell Coker <russell@coker.com.au>
Cc:     selinux-refpolicy@vger.kernel.org
Subject: Re: unreserved_port_t
References: <1956679.fmg26ZhMKt@liv>
Date:   Thu, 04 Mar 2021 15:18:39 +0100
In-Reply-To: <1956679.fmg26ZhMKt@liv> (Russell Coker's message of "Wed, 03 Mar
        2021 21:26:37 +1100")
Message-ID: <ypjl5z27m280.fsf@defensec.nl>
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/27.1 (gnu/linux)
MIME-Version: 1.0
Content-Type: text/plain
Precedence: bulk

Russell Coker <russell@coker.com.au> writes:

> How are we supposed to write policy for programs that bind to random unused 
> ports >1024?  There doesn't seem to be any macro that allows binging to 
> unreserved_port_t except corenet_tcp_bind_all_unreserved_ports() which is too 
> permissive.

Seems like corenet_tcp_bind_unreserved_ports() is currently missing. Please
add. There is a corenet_tcp_bind_reserved_ports().


-- 
gpg --locate-keys dominick.grift@defensec.nl
Key fingerprint = FCD2 3660 5D6B 9D27 7FC6  E0FF DA7E 521F 10F6 4098
https://sks-keyservers.net/pks/lookup?op=get&search=0xDA7E521F10F64098
Dominick Grift