Bug 1703444

Summary:	description of guest_u user says no networking, but reality is different
Product:	Red Hat Enterprise Linux 8	Reporter:	Milos Malik <mmalik>
Component:	selinux-policy	Assignee:	Lukas Vrabec <lvrabec>
Status:	CLOSED ERRATA	QA Contact:	Milos Malik <mmalik>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	---	CC:	lvrabec, mmalik, plautrba, ssekidde, zpytela
Target Milestone:	rc
Target Release:	8.1
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	selinux-policy-3.14.3-6	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-11-05 22:11:27 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1778780

Description Milos Malik 2019-04-26 12:42:01 UTC

Description of problem:
The guest_u user should not be able to do any networking. But the reality shows that guest_u can connect to DNS ports. Is this expected?

# semanage port -l | grep dns
dns_port_t                     tcp      53, 853
dns_port_t                     udp      53, 853
dnssec_port_t                  tcp      8955
#

Version-Release number of selected component (if applicable):
selinux-policy-3.14.3-2.el8.noarch
selinux-policy-targeted-3.14.3-2.el8.noarch

How reproducible:
 * always

Steps to Reproduce:
1. get a RHEL-8.0 machine (targeted policy is active)
2. log in as guest_u user
3. run following commands:
$ id -Z
guest_u:guest_r:guest_t:s0
$ for I in `seq 1 1 ` ; do ssh -l guest-user -p $I localhost 2>&1 | grep -i refused && echo $I ; done
ssh: connect to host localhost port 53: Connection refused
ssh: connect to host localhost port 853: Connection refused
ssh: connect to host localhost port 8955: Connection refused
$

Actual results:
 * guest_u user can connect to ports 53, 853, 8955
 * connection to other ports is denied by SELinux

Expected results:
 * guest_u user cannot connect to any ports because of SELinux

Comment 1 Milos Malik 2019-04-26 12:47:37 UTC

The same reproducer but the named service is running now:

$ for I in `seq 1 1 32000` ; do ssh -l guest-user -p $I localhost 2>&1 | grep -v -i denied ; done
ssh_exchange_identification: Connection closed by remote host
ssh: connect to host localhost port 853: Connection refused
ssh: connect to host localhost port 8955: Connection refused
$

Comment 5 errata-xmlrpc 2019-11-05 22:11:27 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2019:3547