Red Hat Bugzilla – Bug 591135
'semanage node' does not recognize IPv6 addresses
Last modified: 2016-06-29 14:46:46 EDT
Description of problem: Version-Release number of selected component (if applicable): policycoreutils-2.0.82-14.el6.ppc64 policycoreutils-debuginfo-2.0.82-14.el6.ppc64 policycoreutils-gui-2.0.82-14.el6.ppc64 policycoreutils-newrole-2.0.82-14.el6.ppc64 policycoreutils-python-2.0.82-14.el6.ppc64 policycoreutils-sandbox-2.0.82-14.el6.ppc64 How reproducible: always Steps to Reproduce: # semanage node -l IP Address Netmask Protocol Context # semanage node -a -p ipv6 -t node_t -M ::1 ::1 # semanage node -l IP Address Netmask Protocol Context 0.0.0.0 0.0.0.0 ipv4 system_u:object_r:node_t:s0 # semanage node -d -p ipv6 -t node_t -M ::1 ::1 /usr/sbin/semanage: Addr ::1 is not defined # semanage node -l IP Address Netmask Protocol Context 0.0.0.0 0.0.0.0 ipv4 system_u:object_r:node_t:s0 # semanage node -d -p ipv4 -t node_t -M 0.0.0.0 0.0.0.0 # semanage node -l IP Address Netmask Protocol Context # Actual results: semanage handles IPv6 addresses incorrectly Expected results: semanage handles IPv6 addresses correctly
Strange no data gets written and no error is thrown.
Looks like it is ignoring the protocol specifier (-p ipv6) and just always using ipv4/0. Looking at the code, I see that: seobject.py:nodeRecords:__add calls semanage_node_create() and semanage_node_set_addr(), but not semanage_node_set_proto(). Down in libsepol then, I see that: sepol_node_create() defaults to SEPOL_PROTO_IP4. sepol_node_set_addr() does not check or set the proto value even though it is supplied. Options for fixing: - Change seobject.py to call semanage_node_set_proto(proto), and change sepol_node_set_addr() to assert that node->proto == proto, -or- - Change sepol_node_set_addr() to implicitly set node->proto to the specified value. I don't think anyone has previously tried semanage node with ipv6.
Ok that fixes it so it can be added. There seems to be a bug in semanage_node_query though. It returns 1, None, when I try to modify the ::1 node.
Did you specify the mask and address precisely?
# semanage node -l IP Address Netmask Protocol Context 0.0.0.0 0.0.0.0 ipv4 system_u:object_r:node_t:s0 ::1 ::1 ipv6 system_u:object_r:node_t:s0 semanage node -m -t httpd_t -pipv6 -M ::1 ::1 Segmentation fault def __modify(self, addr, mask, proto, serange, setype): if addr == "": raise ValueError(_("Node Address is required")) if mask == "": raise ValueError(_("Node Netmask is required")) try: proto = self.protocol.index(proto) except: raise ValueError(_("Unknown or missing protocol")) if serange == "" and setype == "": raise ValueError(_("Requires setype or serange")) (rc, k) = semanage_node_key_create(self.sh, addr, mask, proto) if rc < 0: raise ValueError(_("Could not create key for %s") % addr) (rc, exists) = semanage_node_exists(self.sh, k) if rc < 0: raise ValueError(_("Could not check if addr %s is defined") % addr) if not exists: raise ValueError(_("Addr %s is not defined") % addr) (rc, node) = semanage_node_query(self.sh, k) if rc < 0: raise ValueError(_("Could not query addr %s") % addr) con = semanage_node_get_con(node) BLOWS UP HERE because node==None
I can fix the problem by changing (rc, node) = semanage_node_query(self.sh, k) To (rc, node) = semanage_node_query_local(self.sh, k)
Fixed in policycoreutils-2.0.82-21.el6
Red Hat Enterprise Linux 6.0 is now available and should resolve the problem described in this bug report. This report is therefore being closed with a resolution of CURRENTRELEASE. You may reopen this bug report if the solution does not work for you.