<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=utf-8">
<META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7652.24">
<TITLE>Re: [CentOS] Unable open raw socket in CentOS 5 - SE Linux and kernelcapability interaction?</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/plain format -->
<BR>
<P><FONT SIZE=2>The raw socket option in the kernel only allows privileged processes to open them.<BR>
<BR>
Selinux controls which privileged processes have the right to.<BR>
<BR>
To allow an unprivileged process to access a raw socket you will need to write a proxy daemon that runs privileged and is allowed in selinux to create a raw socket. This daemon can then provide a unix socket to unprivileged processes whose access can be granted with it's security modes and ownership either manually or through udev.<BR>
<BR>
-Ross<BR>
<BR>
<BR>
----- Original Message -----<BR>
From: centos-bounces@centos.org <centos-bounces@centos.org><BR>
To: CentOS mailing list <centos@centos.org><BR>
Sent: Fri Mar 07 17:44:15 2008<BR>
Subject: Re: [CentOS] Unable open raw socket in CentOS 5 - SE Linux and kernelcapability interaction?<BR>
<BR>
What are your current SELinux settings??<BR>
<BR>
cat /etc/selinux/config<BR>
<BR>
S Roderick wrote:<BR>
> Does anyone have any idea on this one? Based on everything we've tried<BR>
> with kernel capabilities and SE Linux parameters, we're missing<BR>
> something. Have tried everything we can find online.<BR>
><BR>
> Thanks<BR>
> Stephen<BR>
><BR>
> On Mar 3, 2008, at 09:14 , S Roderick wrote:<BR>
><BR>
>> I am wondering what is the interaction between SE Linux and the<BR>
>> kernel "capabilities" in CentOS 5.1? I'm trying to open a raw socket<BR>
>> and keep getting permission denied errors. I've tried using the lcap<BR>
>> library to find that CAP_SETPCAP appears to be off in the kernel. For<BR>
>> compliance reasons, I don't want to turn this on. I've also tried a<BR>
>> hand-crafted SE Linux module policy. I have verified that the test<BR>
>> program runs in the correct SE Linux domain and it generates no audit<BR>
>> errors, but it still fails to open the port with permission denied.<BR>
>><BR>
>> It appears that SE Linux is not preventing the socket being created<BR>
>> (as evidenced by the lack of audit messages), so what am I missing?<BR>
>> Do I still need to modify capabilities within the program, even if<BR>
>> I'm using an SE Linux policy?<BR>
>><BR>
>> Thanks<BR>
>> S<BR>
>><BR>
>> Source file<BR>
>><BR>
>> #include <stdio.h><BR>
>> #include <unistd.h><BR>
>> #include <errno.h><BR>
>> #include <string.h><BR>
>> #include <sys/socket.h><BR>
>> #include <sys/types.h><BR>
>> #include <sys/prctl.h><BR>
>> #include <netinet/in.h><BR>
>><BR>
>> int<BR>
>> main(void)<BR>
>> {<BR>
>> int fd = socket(PF_INET, SOCK_RAW, IPPROTO_TCP);<BR>
>> if (-1 == fd)<BR>
>> {<BR>
>> printf("Failed to open raw socket: %d=%s\n", errno,<BR>
>> strerror(errno));<BR>
>> }<BR>
>> else<BR>
>> {<BR>
>> printf("Socket opened successfully\n");<BR>
>> close(fd);<BR>
>> }<BR>
>> return 0;<BR>
>> }<BR>
>><BR>
>><BR>
>> SElinux .te file<BR>
>><BR>
>> policy_module(rawsox,1.0.0)<BR>
>><BR>
>> ########################################<BR>
>> # Declarations<BR>
>><BR>
>> type rawsox_t;<BR>
>> type rawsox_exec_t;<BR>
>> domain_type(rawsox_t)<BR>
>> domain_entry_file(rawsox_t, rawsox_exec_t)<BR>
>> domain_auto_trans(unconfined_t,rawsox_exec_t,rawsox_t)<BR>
>><BR>
>> ########################################<BR>
>> # Rawsox local policy<BR>
>><BR>
>> # these two didn't help<BR>
>> #corenet_raw_sendrecv_all_if( rawsox_t );<BR>
>> #corenet_raw_sendrecv_all_nodes( rawsox_t );<BR>
>><BR>
>> require {<BR>
>> type lib_t;<BR>
>> type ld_so_t;<BR>
>> type ld_so_cache_t;<BR>
>> type usr_t;<BR>
>> type devpts_t;<BR>
>> type rawsox_t;<BR>
>> type etc_t;<BR>
>> class lnk_file read;<BR>
>> class dir search;<BR>
>> class file { read getattr execute };<BR>
>> class chr_file { read write getattr };<BR>
>> class rawip_socket create;<BR>
>> class capability net_raw;<BR>
>> }<BR>
>><BR>
>> #============= rawsox_t ==============<BR>
>> allow rawsox_t devpts_t:chr_file { read write getattr };<BR>
>> allow rawsox_t etc_t:dir search;<BR>
>> allow rawsox_t ld_so_cache_t:file { read getattr };<BR>
>> allow rawsox_t ld_so_t:file read;<BR>
>> allow rawsox_t lib_t:dir search;<BR>
>> allow rawsox_t lib_t:file { read getattr execute };<BR>
>> allow rawsox_t lib_t:lnk_file read;<BR>
>> allow rawsox_t usr_t:dir search;<BR>
>><BR>
>> allow rawsox_t self:capability { net_raw setuid };<BR>
>> allow rawsox_t self:rawip_socket { create ioctl read write bind<BR>
>> getopt setopt };<BR>
>> allow rawsox_t self:unix_stream_socket { create_socket_perms };<BR>
>><BR>
><BR>
> _______________________________________________<BR>
> CentOS mailing list<BR>
> CentOS@centos.org<BR>
> <A HREF="http://lists.centos.org/mailman/listinfo/centos">http://lists.centos.org/mailman/listinfo/centos</A><BR>
_______________________________________________<BR>
CentOS mailing list<BR>
CentOS@centos.org<BR>
<A HREF="http://lists.centos.org/mailman/listinfo/centos">http://lists.centos.org/mailman/listinfo/centos</A><BR>
</FONT>
</P>
<P></P>
<HR WIDTH="100%">
This e-mail, and any attachments thereto, is intended only for use by
the addressee(s) named herein and may contain legally privileged
and/or confidential information. If you are not the intended recipient
of this e-mail, you are hereby notified that any dissemination,
distribution or copying of this e-mail, and any attachments thereto,
is strictly prohibited. If you have received this e-mail in error,
please immediately notify the sender and permanently delete the
original and any copy or printout thereof.
</BODY>
</HTML>