From: pebenito@ieee.org (Chris PeBenito)
Date: Wed, 17 May 2017 17:57:19 -0400
Subject: [refpolicy] [PATCH 4/6] dirmngr: Network rules to connect to
 keyserver
In-Reply-To: <20170516172332.GA20929@julius.enp8s0.d30>
References: <20170507174343.30160-1-jason@perfinion.com>
	<20170507174343.30160-4-jason@perfinion.com>
	<11a613f8-48d4-bcbf-d5ef-746305b8d404@ieee.org>
	<20170516170045.GC9284@meriadoc.perfinion.com>
	<20170516172332.GA20929@julius.enp8s0.d30>
Message-ID: <1188eeb4-f9ab-530a-6fb0-8544f246b651@ieee.org>
To: refpolicy@oss.tresys.com
List-Id: refpolicy.oss.tresys.com

On 05/16/2017 01:23 PM, Dominick Grift via refpolicy wrote:
> On Wed, May 17, 2017 at 01:00:45AM +0800, Jason Zaman via refpolicy wrote:
>> On Thu, May 11, 2017 at 07:32:02PM -0400, Chris PeBenito wrote:
>>> On 05/07/2017 01:43 PM, Jason Zaman wrote:
>>>> type=AVC msg=audit(1494163667.921:24917): avc:  denied  { name_bind } for  pid=15683 comm=636F6E6E2066643D36 src=19321 scontext=staff_u:staff_r:dirmngr_t:s0-s0:c0.c1023 tcontext=system_u:object_r:unreserved_port_t:s0 tclass=udp_socket permissive=0
>>>> ---
>>>>  dirmngr.te | 6 ++++++
>>>>  1 file changed, 6 insertions(+)
>>>>
>>>> diff --git a/dirmngr.te b/dirmngr.te
>>>> index 17cce56..b64fc61 100644
>>>> --- a/dirmngr.te
>>>> +++ b/dirmngr.te
>>>> @@ -62,6 +62,12 @@ manage_sock_files_pattern(dirmngr_t, dirmngr_var_run_t, dirmngr_var_run_t)
>>>>  files_pid_filetrans(dirmngr_t, dirmngr_var_run_t, { dir file })
>>>>
>>>>  kernel_read_crypto_sysctls(dirmngr_t)
>>>> +dev_read_rand(dirmngr_t)
>>>> +sysnet_dns_name_resolve(dirmngr_t)
>>>> +
>>>> +corenet_tcp_connect_pgpkeyserver_port(dirmngr_t)
>>>> +corenet_udp_bind_generic_node(dirmngr_t)
>>>> +corenet_udp_bind_all_unreserved_ports(dirmngr_t)
>>>>
>>>>  files_read_etc_files(dirmngr_t)
>>>
>>> I'm confused.  If this is for connecting, why are there binding rules?
>>
>> I dont really know why it needs to bind to random udp ports. It failed
>> hard for me without them tho :(. I could poke around in the source for
>> an exact answer if you want tho.
>
> dns AFAIK

If that can be confirmed (makes sense to me, especially due to the UDP), 
then the sysnet DNS interface makes more sense to cover the binds..

-- 
Chris PeBenito