Allow ntp to bind and connect to ntske port. #1918
Conversation
|
Cockpit tests failed for commit 6f45af1. @martinpitt, @jelly, @mvollmer please check. |
|
cockpit-project/cockpit#19547 landed, so please either retry the rawhide:revdeps test or force-push this PR, or ignore the failure. Sorry for the noise! |
|
@jhamlin96 Please add a note to the commit message, e. g. when this denial appears. |
jhamlin96
force-pushed
the
branch/add-nts-ntpd
branch
from
6f45af1
to
ccd6617
Compare
|
@zpytela Updated, thanks |
|
Cockpit tests failed for commit ccd6617. @martinpitt, @jelly, @mvollmer please check. |
|
@jhamlin96 thank you, can you add one more thing: how to trigger it? some configuration change is needed |
|
@zpytela testing PR exists and is awaiting review here: https://src.fedoraproject.org/tests/selinux/pull-request/445 Do you want the test steps listed in the commit message or PR description? |
|
@jhamlin96 To the commit message please. The point is having the justification together with the changes so that it is more clear why the changes were made. |
The commit addresses the following AVC denial:
type=PROCTITLE msg=audit(10/30/2023 04:46:52.693:699) : proctitle=/usr/sbin/ntpd -g -N -u ntp:ntp
type=SOCKADDR msg=audit(10/30/2023 04:46:52.693:699) : saddr={ saddr_fam=inet6 laddr=2001:67c:2550:d::7 lport=4460 }
type=SYSCALL msg=audit(10/30/2023 04:46:52.693:699) : arch=x86_64 syscall=connect success=no exit=EACCES(Permission denied) a0=0x4 a1=0x7fdc94003570 a2=0x1c a3=0x4000 items=0 ppid=1 pid=4646 auid=unset uid=ntp gid=ntp euid=ntp suid=ntp fsuid=ntp egid=ntp sgid=ntp fsgid=ntp tty=(none) ses=unset comm=ntpd exe=/usr/sbin/ntpd subj=system_u:system_r:ntpd_t:s0 key=(null)
type=AVC msg=audit(10/30/2023 04:46:52.693:699) : avc: denied { name_connect } for pid=4646 comm=ntpd dest=4460 scontext=system_u:system_r:ntpd_t:s0 tcontext=system_u:object_r:ntske_port_t:s0 tclass=tcp_socket permissive=0
The NTP daemon can be configured as a NTS-enabled client or server.
For client, appending "server add.rr.eee.ss nts [other options]" to ntp.conf for connecting to an NTS-enabled server will trigger the above AVC denial.
For server, append "nts enable" "nts key /path/to/key.pem" "nts cert /path/to/cert.pem" lines in ntp.conf to enable NTS server functionality, which triggers a similar AVC denial attempting to bind to TCP port 4460.
Resolves: #2246805, RHEL-15085
jhamlin96
force-pushed
the
branch/add-nts-ntpd
branch
from
ccd6617
to
bc3a72b
Compare
|
@zpytela Updated |
|
Perfect, thank you. |
See: https://bugzilla.redhat.com/show_bug.cgi?id=2246805
https://issues.redhat.com/browse/RHEL-15085