From: pebenito@ieee.org (Chris PeBenito)
Date: Thu, 11 May 2017 19:32:02 -0400
Subject: [refpolicy] [PATCH 4/6] dirmngr: Network rules to connect to
	keyserver
In-Reply-To: <20170507174343.30160-4-jason@perfinion.com>
References: <20170507174343.30160-1-jason@perfinion.com>
	<20170507174343.30160-4-jason@perfinion.com>
Message-ID: <11a613f8-48d4-bcbf-d5ef-746305b8d404@ieee.org>
To: refpolicy@oss.tresys.com
List-Id: refpolicy.oss.tresys.com

On 05/07/2017 01:43 PM, Jason Zaman wrote:
> type=AVC msg=audit(1494163667.921:24917): avc:  denied  { name_bind } for  pid=15683 comm=636F6E6E2066643D36 src=19321 scontext=staff_u:staff_r:dirmngr_t:s0-s0:c0.c1023 tcontext=system_u:object_r:unreserved_port_t:s0 tclass=udp_socket permissive=0
> ---
>  dirmngr.te | 6 ++++++
>  1 file changed, 6 insertions(+)
>
> diff --git a/dirmngr.te b/dirmngr.te
> index 17cce56..b64fc61 100644
> --- a/dirmngr.te
> +++ b/dirmngr.te
> @@ -62,6 +62,12 @@ manage_sock_files_pattern(dirmngr_t, dirmngr_var_run_t, dirmngr_var_run_t)
>  files_pid_filetrans(dirmngr_t, dirmngr_var_run_t, { dir file })
>
>  kernel_read_crypto_sysctls(dirmngr_t)
> +dev_read_rand(dirmngr_t)
> +sysnet_dns_name_resolve(dirmngr_t)
> +
> +corenet_tcp_connect_pgpkeyserver_port(dirmngr_t)
> +corenet_udp_bind_generic_node(dirmngr_t)
> +corenet_udp_bind_all_unreserved_ports(dirmngr_t)
>
>  files_read_etc_files(dirmngr_t)

I'm confused.  If this is for connecting, why are there binding rules?

-- 
Chris PeBenito