<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div><blockquote type="cite"><div><p><font size="2"><font class="Apple-style-span" color="#000000" size="3"><span class="Apple-style-span" style="font-size: 12px;"><br></span></font>The raw socket option in the kernel only allows privileged processes to open them.</font></p></div></blockquote><blockquote type="cite"><div><p><font size="2"> <br> Selinux controls which privileged processes have the right to.<br> <br> To allow an unprivileged process to access a raw socket you will need to write a proxy daemon that runs privileged and is allowed in selinux to create a raw socket. This daemon can then provide a unix socket to unprivileged processes whose access can be granted with it's security modes and ownership either manually or through udev.</font></p></div></blockquote><div>I thought that both the kernel capability approach and SE Linux were designed to do just this: allow a typically "unpriviledged" process access to a restricted subset of capabilities that normally require rootpriviledge. Is this not correct?</div><div><br class="webkit-block-placeholder"></div><div>In your last paragraph above, when you say "unprivileged process" do you mean a standard unix process (ie an "unconfined_t" process in CentOS SE Linux) or do you mean any non-root process? My understanding was (and please correct me if I'm wrong), is that I can take a known process (eg many online examples use 'ping') and provide it with additional priviledges (eg raw socket access) that a non-root (in that sense, unprivileged) process normally wouldn't have.</div><blockquote type="cite"><div><p><font size="2"><br> ----- Original Message -----<br> From: <a href="mailto:centos-bounces@centos.org">centos-bounces@centos.org</a> <<a href="mailto:centos-bounces@centos.org">centos-bounces@centos.org</a>><br> To: CentOS mailing list <<a href="mailto:centos@centos.org">centos@centos.org</a>><br> Sent: Fri Mar 07 17:44:15 2008<br> Subject: Re: [CentOS] Unable open raw socket in CentOS 5 - SE Linux and kernelcapability interaction?<br> <br> What are your current SELinux settings??<br> <br> cat /etc/selinux/config<br></font></p></div></blockquote></div><br><div><div># This file controls the state of SELinux on the system.</div><div># SELINUX= can take one of these three values:</div><div>#<span class="Apple-tab-span" style="white-space:pre"> </span>enforcing - SELinux security policy is enforced.</div><div>#<span class="Apple-tab-span" style="white-space:pre"> </span>permissive - SELinux prints warnings instead of enforcing.</div><div>#<span class="Apple-tab-span" style="white-space:pre"> </span>disabled - SELinux is fully disabled.</div><div>SELINUX=permissive</div><div># SELINUXTYPE= type of policy in use. Possible values are:</div><div>#<span class="Apple-tab-span" style="white-space:pre"> </span>targeted - Only targeted network daemons are protected.</div><div>#<span class="Apple-tab-span" style="white-space:pre"> </span>strict - Full SELinux protection.</div><div>SELINUXTYPE=targeted</div><div><br class="webkit-block-placeholder"></div><div># SETLOCALDEFS= Check local definition changes</div><div>SETLOCALDEFS=0 </div><div><br class="webkit-block-placeholder"></div></div></body></html>