246 lines
8.8 KiB
Diff
246 lines
8.8 KiB
Diff
diff --git a/policy/modules/apps/mozilla.te b/policy/modules/apps/mozilla.te
|
|
index 68929b9..3370160 100644
|
|
--- a/policy/modules/apps/mozilla.te
|
|
+++ b/policy/modules/apps/mozilla.te
|
|
@@ -116,6 +116,7 @@ corenet_tcp_sendrecv_http_cache_port(mozilla_t)
|
|
corenet_tcp_sendrecv_squid_port(mozilla_t)
|
|
corenet_tcp_connect_flash_port(mozilla_t)
|
|
corenet_tcp_sendrecv_ftp_port(mozilla_t)
|
|
+corenet_tcp_connect_all_ephemeral_ports(mozilla_t)
|
|
corenet_tcp_sendrecv_ipp_port(mozilla_t)
|
|
corenet_tcp_connect_http_port(mozilla_t)
|
|
corenet_tcp_connect_http_cache_port(mozilla_t)
|
|
diff --git a/policy/modules/apps/sandbox.te b/policy/modules/apps/sandbox.te
|
|
index 31c02d2..f61ee10 100644
|
|
--- a/policy/modules/apps/sandbox.te
|
|
+++ b/policy/modules/apps/sandbox.te
|
|
@@ -382,6 +382,7 @@ corenet_tcp_connect_http_cache_port(sandbox_web_type)
|
|
corenet_tcp_connect_squid_port(sandbox_web_type)
|
|
corenet_tcp_connect_flash_port(sandbox_web_type)
|
|
corenet_tcp_connect_ftp_port(sandbox_web_type)
|
|
+corenet_tcp_connect_all_ephemeral_ports(sandbox_web_type)
|
|
corenet_tcp_connect_ipp_port(sandbox_web_type)
|
|
corenet_tcp_connect_streaming_port(sandbox_web_type)
|
|
corenet_tcp_connect_pulseaudio_port(sandbox_web_type)
|
|
diff --git a/policy/modules/kernel/corenetwork.if.in b/policy/modules/kernel/corenetwork.if.in
|
|
index 5a41e58..54e4c81 100644
|
|
--- a/policy/modules/kernel/corenetwork.if.in
|
|
+++ b/policy/modules/kernel/corenetwork.if.in
|
|
@@ -2269,6 +2269,42 @@ interface(`corenet_udp_bind_all_unreserved_ports',`
|
|
|
|
########################################
|
|
## <summary>
|
|
+## Bind TCP sockets to all ports > 32768.
|
|
+## </summary>
|
|
+## <param name="domain">
|
|
+## <summary>
|
|
+## Domain allowed access.
|
|
+## </summary>
|
|
+## </param>
|
|
+#
|
|
+interface(`corenet_tcp_bind_all_ephemeral_ports',`
|
|
+ gen_require(`
|
|
+ attribute ephemeral_port_type;
|
|
+ ')
|
|
+
|
|
+ allow $1 ephemeral_port_type:tcp_socket name_bind;
|
|
+')
|
|
+
|
|
+########################################
|
|
+## <summary>
|
|
+## Bind UDP sockets to all ports > 32768.
|
|
+## </summary>
|
|
+## <param name="domain">
|
|
+## <summary>
|
|
+## Domain allowed access.
|
|
+## </summary>
|
|
+## </param>
|
|
+#
|
|
+interface(`corenet_udp_bind_all_ephemeral_ports',`
|
|
+ gen_require(`
|
|
+ attribute ephemeral_port_type;
|
|
+ ')
|
|
+
|
|
+ allow $1 ephemeral_port_type:udp_socket name_bind;
|
|
+')
|
|
+
|
|
+########################################
|
|
+## <summary>
|
|
## Connect DCCP sockets to reserved ports.
|
|
## </summary>
|
|
## <param name="domain">
|
|
@@ -2341,6 +2377,24 @@ interface(`corenet_tcp_connect_all_unreserved_ports',`
|
|
|
|
########################################
|
|
## <summary>
|
|
+## Connect TCP sockets to all ports > 32768.
|
|
+## </summary>
|
|
+## <param name="domain">
|
|
+## <summary>
|
|
+## Domain allowed access.
|
|
+## </summary>
|
|
+## </param>
|
|
+#
|
|
+interface(`corenet_tcp_connect_all_ephemeral_ports',`
|
|
+ gen_require(`
|
|
+ attribute ephemeral_port_type;
|
|
+ ')
|
|
+
|
|
+ allow $1 ephemeral_port_type:tcp_socket name_connect;
|
|
+')
|
|
+
|
|
+########################################
|
|
+## <summary>
|
|
## Do not audit attempts to connect DCCP sockets
|
|
## all reserved ports.
|
|
## </summary>
|
|
diff --git a/policy/modules/kernel/corenetwork.te.in b/policy/modules/kernel/corenetwork.te.in
|
|
index 5287f7a..f65fb75 100644
|
|
--- a/policy/modules/kernel/corenetwork.te.in
|
|
+++ b/policy/modules/kernel/corenetwork.te.in
|
|
@@ -14,6 +14,7 @@ attribute port_type;
|
|
attribute defined_port_type;
|
|
attribute reserved_port_type;
|
|
attribute unreserved_port_type;
|
|
+attribute ephemeral_port_type;
|
|
attribute rpc_port_type;
|
|
attribute server_packet_type;
|
|
|
|
@@ -66,11 +67,17 @@ type port_t, port_type;
|
|
sid port gen_context(system_u:object_r:port_t,s0)
|
|
|
|
#
|
|
-# port_t is the default type of INET port numbers.
|
|
+# unreserved_port_t is the default type of port numbers > 1024 and non ephemeral
|
|
#
|
|
type unreserved_port_t, port_type, unreserved_port_type;
|
|
|
|
#
|
|
+# ephemeral_port_t is the default type of ephemeral port numbers.
|
|
+# cat /proc/sys/net/ipv4/ip_local_port_range
|
|
+#
|
|
+type ephemeral_port_t, port_type, ephemeral_port_type;
|
|
+
|
|
+#
|
|
# reserved_port_t is the type of INET port numbers below 1024.
|
|
#
|
|
type reserved_port_t, port_type, reserved_port_type;
|
|
@@ -293,9 +300,12 @@ portcon tcp 512-1023 gen_context(system_u:object_r:hi_reserved_port_t, s0)
|
|
portcon udp 512-1023 gen_context(system_u:object_r:hi_reserved_port_t, s0)
|
|
portcon tcp 1-511 gen_context(system_u:object_r:reserved_port_t, s0)
|
|
portcon udp 1-511 gen_context(system_u:object_r:reserved_port_t, s0)
|
|
-portcon udp 1024-65535 gen_context(system_u:object_r:unreserved_port_t, s0)
|
|
-portcon tcp 1024-65535 gen_context(system_u:object_r:unreserved_port_t, s0)
|
|
-
|
|
+portcon tcp 1024-32767 gen_context(system_u:object_r:unreserved_port_t, s0)
|
|
+portcon tcp 32768-61000 gen_context(system_u:object_r:ephemeral_port_t, s0)
|
|
+portcon tcp 61001-65535 gen_context(system_u:object_r:unreserved_port_t, s0)
|
|
+portcon udp 1024-32767 gen_context(system_u:object_r:unreserved_port_t, s0)
|
|
+portcon udp 32768-61000 gen_context(system_u:object_r:ephemeral_port_t, s0)
|
|
+portcon udp 61001-65535 gen_context(system_u:object_r:unreserved_port_t, s0)
|
|
########################################
|
|
#
|
|
# Network nodes
|
|
diff --git a/policy/modules/kernel/corenetwork.te.m4 b/policy/modules/kernel/corenetwork.te.m4
|
|
index 49f27ca..e8acd10 100644
|
|
--- a/policy/modules/kernel/corenetwork.te.m4
|
|
+++ b/policy/modules/kernel/corenetwork.te.m4
|
|
@@ -81,7 +81,13 @@ declare_nodes($1_node_t,shift($*))
|
|
define(`declare_ports',`dnl
|
|
ifelse(eval(range_start($3) < 1024),1,`typeattribute $1 reserved_port_type;
|
|
ifelse(eval(range_start($3) >= 512),1,`typeattribute $1 rpc_port_type;',`dnl')
|
|
-',`typeattribute $1 unreserved_port_type;')
|
|
+',`
|
|
+ifelse(eval(range_start($3) < 32768),1,`typeattribute $1 unreserved_port_type;',`
|
|
+ ifelse(eval(range_start($3) > 61001),1,`typeattribute $1 unreserved_port_type;',`
|
|
+ typeattribute $1 ephemeral_port_type;
|
|
+ ')
|
|
+ ')
|
|
+')
|
|
portcon $2 $3 gen_context(system_u:object_r:$1,$4)
|
|
ifelse(`$5',`',`',`declare_ports($1,shiftn(4,$*))')dnl
|
|
')
|
|
diff --git a/policy/modules/services/apache.te b/policy/modules/services/apache.te
|
|
index 8596b90..9f37c11 100644
|
|
--- a/policy/modules/services/apache.te
|
|
+++ b/policy/modules/services/apache.te
|
|
@@ -137,6 +137,14 @@ gen_tunable(httpd_enable_ftp_server, false)
|
|
|
|
## <desc>
|
|
## <p>
|
|
+## Allow httpd to act as a FTP client
|
|
+## connecting to the ftp port and ephemeral ports
|
|
+## </p>
|
|
+## </desc>
|
|
+gen_tunable(httpd_can_connect_ftp, false)
|
|
+
|
|
+## <desc>
|
|
+## <p>
|
|
## Allow httpd to read home directories
|
|
## </p>
|
|
## </desc>
|
|
@@ -583,6 +591,7 @@ tunable_policy(`httpd_can_network_relay',`
|
|
corenet_sendrecv_http_client_packets(httpd_t)
|
|
corenet_sendrecv_http_cache_client_packets(httpd_t)
|
|
corenet_sendrecv_squid_client_packets(httpd_t)
|
|
+ corenet_tcp_connect_all_ephemeral_ports(httpd_t)
|
|
')
|
|
|
|
tunable_policy(`httpd_execmem',`
|
|
@@ -621,8 +630,14 @@ tunable_policy(`httpd_enable_cgi && httpd_unified && httpd_builtin_scripting',`
|
|
manage_lnk_files_pattern(httpd_t, httpdcontent, httpdcontent)
|
|
')
|
|
|
|
+tunable_policy(`httpd_can_connect_ftp',`
|
|
+ corenet_tcp_connect_ftp_port(httpd_t)
|
|
+ corenet_tcp_connect_all_ephemeral_ports(httpd_t)
|
|
+')
|
|
+
|
|
tunable_policy(`httpd_enable_ftp_server',`
|
|
corenet_tcp_bind_ftp_port(httpd_t)
|
|
+ corenet_tcp_bind_all_ephemeral_ports(httpd_t)
|
|
')
|
|
|
|
tunable_policy(`httpd_tmp_exec && httpd_builtin_scripting',`
|
|
diff --git a/policy/modules/services/cobbler.te b/policy/modules/services/cobbler.te
|
|
index 2607914..cb33e76 100644
|
|
--- a/policy/modules/services/cobbler.te
|
|
+++ b/policy/modules/services/cobbler.te
|
|
@@ -110,6 +110,7 @@ corenet_tcp_sendrecv_generic_port(cobblerd_t)
|
|
corenet_tcp_sendrecv_cobbler_port(cobblerd_t)
|
|
# sync and rsync to ftp and http are permitted by default, for any other media use cobbler_can_network_connect.
|
|
corenet_tcp_connect_ftp_port(cobblerd_t)
|
|
+corenet_tcp_connect_all_ephemeral_ports(cobblerd_t)
|
|
corenet_tcp_sendrecv_ftp_port(cobblerd_t)
|
|
corenet_sendrecv_ftp_client_packets(cobblerd_t)
|
|
corenet_tcp_connect_http_port(cobblerd_t)
|
|
diff --git a/policy/modules/services/ftp.te b/policy/modules/services/ftp.te
|
|
index 9a1355e..f807210 100644
|
|
--- a/policy/modules/services/ftp.te
|
|
+++ b/policy/modules/services/ftp.te
|
|
@@ -218,9 +218,8 @@ corenet_tcp_bind_generic_node(ftpd_t)
|
|
corenet_tcp_bind_ftp_port(ftpd_t)
|
|
corenet_tcp_bind_ftp_data_port(ftpd_t)
|
|
corenet_tcp_bind_generic_port(ftpd_t)
|
|
-corenet_tcp_bind_all_unreserved_ports(ftpd_t)
|
|
-corenet_dontaudit_tcp_bind_all_ports(ftpd_t)
|
|
-corenet_tcp_connect_all_ports(ftpd_t)
|
|
+corenet_tcp_bind_all_ephemeral_ports(ftpd_t)
|
|
+corenet_tcp_connect_all_ephemeral_ports(ftpd_t)
|
|
corenet_sendrecv_ftp_server_packets(ftpd_t)
|
|
|
|
domain_use_interactive_fds(ftpd_t)
|
|
diff --git a/policy/modules/services/mock.te b/policy/modules/services/mock.te
|
|
index 1b9893a..a8eaa4d 100644
|
|
--- a/policy/modules/services/mock.te
|
|
+++ b/policy/modules/services/mock.te
|
|
@@ -87,7 +87,7 @@ corecmd_dontaudit_exec_all_executables(mock_t)
|
|
|
|
corenet_tcp_connect_http_port(mock_t)
|
|
corenet_tcp_connect_ftp_port(mock_t)
|
|
-corenet_tcp_connect_all_unreserved_ports(mock_t)
|
|
+corenet_tcp_connect_all_ephemeral_ports(mock_t)
|
|
|
|
dev_read_urand(mock_t)
|
|
dev_read_sysfs(mock_t)
|