From: jason@perfinion.com (Jason Zaman)
Date: Wed, 17 May 2017 01:00:45 +0800
Subject: [refpolicy] [PATCH 4/6] dirmngr: Network rules to connect to
	keyserver
In-Reply-To: <11a613f8-48d4-bcbf-d5ef-746305b8d404@ieee.org>
References: <20170507174343.30160-1-jason@perfinion.com>
	<20170507174343.30160-4-jason@perfinion.com>
	<11a613f8-48d4-bcbf-d5ef-746305b8d404@ieee.org>
Message-ID: <20170516170045.GC9284@meriadoc.perfinion.com>
To: refpolicy@oss.tresys.com
List-Id: refpolicy.oss.tresys.com

On Thu, May 11, 2017 at 07:32:02PM -0400, Chris PeBenito wrote:
> On 05/07/2017 01:43 PM, Jason Zaman wrote:
> > type=AVC msg=audit(1494163667.921:24917): avc:  denied  { name_bind } for  pid=15683 comm=636F6E6E2066643D36 src=19321 scontext=staff_u:staff_r:dirmngr_t:s0-s0:c0.c1023 tcontext=system_u:object_r:unreserved_port_t:s0 tclass=udp_socket permissive=0
> > ---
> >  dirmngr.te | 6 ++++++
> >  1 file changed, 6 insertions(+)
> >
> > diff --git a/dirmngr.te b/dirmngr.te
> > index 17cce56..b64fc61 100644
> > --- a/dirmngr.te
> > +++ b/dirmngr.te
> > @@ -62,6 +62,12 @@ manage_sock_files_pattern(dirmngr_t, dirmngr_var_run_t, dirmngr_var_run_t)
> >  files_pid_filetrans(dirmngr_t, dirmngr_var_run_t, { dir file })
> >
> >  kernel_read_crypto_sysctls(dirmngr_t)
> > +dev_read_rand(dirmngr_t)
> > +sysnet_dns_name_resolve(dirmngr_t)
> > +
> > +corenet_tcp_connect_pgpkeyserver_port(dirmngr_t)
> > +corenet_udp_bind_generic_node(dirmngr_t)
> > +corenet_udp_bind_all_unreserved_ports(dirmngr_t)
> >
> >  files_read_etc_files(dirmngr_t)
> 
> I'm confused.  If this is for connecting, why are there binding rules?

I dont really know why it needs to bind to random udp ports. It failed
hard for me without them tho :(. I could poke around in the source for
an exact answer if you want tho.

I was testing it with gpg --refresh-keys

-- Jason

> 
> -- 
> Chris PeBenito