From: dsugar@tresys.com (David Sugar) Date: Sat, 24 Feb 2018 14:52:17 +0000 Subject: [refpolicy] [PATCH] ntp only uses UDP, remove TCP permissions Message-ID: To: refpolicy@oss.tresys.com List-Id: refpolicy.oss.tresys.com The NTP protocol states it only used UDP for network communication. Remove currently allowed access to TCP that should not be needed. Signed-off-by: Dave Sugar --- ntp.te | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) diff --git a/ntp.te b/ntp.te index f321fb6..c25a3ff 100644 --- a/ntp.te +++ b/ntp.te @@ -58,7 +58,6 @@ allow ntpd_t self:process { signal_perms getcap setcap setsched setrlimit }; allow ntpd_t self:fifo_file rw_fifo_file_perms; allow ntpd_t self:shm create_shm_perms; allow ntpd_t self:socket create; -allow ntpd_t self:tcp_socket { accept listen }; allow ntpd_t self:unix_dgram_socket sendto; allow ntpd_t ntp_conf_t:file read_file_perms; @@ -99,20 +98,15 @@ kernel_request_load_module(ntpd_t) corenet_all_recvfrom_unlabeled(ntpd_t) corenet_all_recvfrom_netlabel(ntpd_t) -corenet_tcp_sendrecv_generic_if(ntpd_t) corenet_udp_sendrecv_generic_if(ntpd_t) -corenet_tcp_sendrecv_generic_node(ntpd_t) corenet_udp_sendrecv_generic_node(ntpd_t) corenet_udp_bind_generic_node(ntpd_t) +corenet_sendrecv_ntp_client_packets(ntpd_t) corenet_sendrecv_ntp_server_packets(ntpd_t) corenet_udp_bind_ntp_port(ntpd_t) corenet_udp_sendrecv_ntp_port(ntpd_t) -corenet_sendrecv_ntp_client_packets(ntpd_t) -corenet_tcp_connect_ntp_port(ntpd_t) -corenet_tcp_sendrecv_ntp_port(ntpd_t) - corecmd_exec_bin(ntpd_t) corecmd_exec_shell(ntpd_t) -- 2.14.3