From: pebenito@ieee.org (Chris PeBenito)
Date: Tue, 27 Feb 2018 17:26:22 -0500
Subject: [refpolicy] [PATCH] ntp only uses UDP, remove TCP permissions
In-Reply-To: <MWHPR15MB18534F77C1DDF6B5D5CFF92DB9C30@MWHPR15MB1853.namprd15.prod.outlook.com>
References: <MWHPR15MB18534F77C1DDF6B5D5CFF92DB9C30@MWHPR15MB1853.namprd15.prod.outlook.com>
Message-ID: <cf61abe5-d20a-4650-8bc5-4899d46b95ca@ieee.org>
To: refpolicy@oss.tresys.com
List-Id: refpolicy.oss.tresys.com

On 02/24/2018 09:52 AM, David Sugar via refpolicy wrote:
> The NTP protocol states it only used UDP for network communication.  Remove currently allowed access to TCP that should not be needed.
> 
> Signed-off-by: Dave Sugar <dsugar@tresys.com>
> ---
>   ntp.te | 8 +-------
>   1 file changed, 1 insertion(+), 7 deletions(-)
> 
> diff --git a/ntp.te b/ntp.te
> index f321fb6..c25a3ff 100644
> --- a/ntp.te
> +++ b/ntp.te
> @@ -58,7 +58,6 @@ allow ntpd_t self:process { signal_perms getcap setcap setsched setrlimit };
>   allow ntpd_t self:fifo_file rw_fifo_file_perms;
>   allow ntpd_t self:shm create_shm_perms;
>   allow ntpd_t self:socket create;
> -allow ntpd_t self:tcp_socket { accept listen };
>   allow ntpd_t self:unix_dgram_socket sendto;
>   
>   allow ntpd_t ntp_conf_t:file read_file_perms;
> @@ -99,20 +98,15 @@ kernel_request_load_module(ntpd_t)
>   
>   corenet_all_recvfrom_unlabeled(ntpd_t)
>   corenet_all_recvfrom_netlabel(ntpd_t)
> -corenet_tcp_sendrecv_generic_if(ntpd_t)
>   corenet_udp_sendrecv_generic_if(ntpd_t)
> -corenet_tcp_sendrecv_generic_node(ntpd_t)
>   corenet_udp_sendrecv_generic_node(ntpd_t)
>   corenet_udp_bind_generic_node(ntpd_t)
>   
> +corenet_sendrecv_ntp_client_packets(ntpd_t)
>   corenet_sendrecv_ntp_server_packets(ntpd_t)
>   corenet_udp_bind_ntp_port(ntpd_t)
>   corenet_udp_sendrecv_ntp_port(ntpd_t)
>   
> -corenet_sendrecv_ntp_client_packets(ntpd_t)
> -corenet_tcp_connect_ntp_port(ntpd_t)
> -corenet_tcp_sendrecv_ntp_port(ntpd_t)
> -
>   corecmd_exec_bin(ntpd_t)
>   corecmd_exec_shell(ntpd_t)

Merged.

-- 
Chris PeBenito