Changeset 21fdee9dd56a33723c27045a7bd2eaf6607de7d7

Timestamp:

07/19/10 13:22:44 (2 months ago)

Author:

Chris PeBenito <cpebenito@tresys.com>

Committer:

Chris PeBenito <cpebenito@tresys.com> 1279563764 -0400

Parent:

[29f3bfa464fee4f777758e7860b4a773236cbc36]

Message:

Increase bindreservport range to 512-1024 in corenetwork, from Dan Walsh.

We went back and reread the bindreservport code in glibc.

Turns out the range or ports that this will reserve are 512-1024 rather
then 600-1024.

The code actually first tries to reserve a port from 600-1024 and if
they are ALL reserved will try 512-599.

So we need to change corenetwork to reflect this.

Files:

• Changelog (modified) (1 diff)
• policy/modules/kernel/corenetwork.te.in (modified) (3 diffs)
• policy/modules/kernel/corenetwork.te.m4 (modified) (1 diff)

Changelog

@@ +1 @@
+- Increase bindreservport range to 512-1024 in corenetwork, from Dan Walsh.
-- Add JIT usage for freshclam.
-- Remove ethereal module since the application was renamed to wireshark.

policy/modules/kernel/corenetwork.te.in

@@ -1 @@
-0
+1
-
-########################################
@@ -55 +55 @@
-
-#
-600
+512
-#
-type hi_reserved_port_t, port_type, reserved_port_type, rpc_port_type;
@@ -218 +218 @@
-# these entries just cover any remaining reserved ports not otherwise declared.
-
-600
-600
-99
-99
+512
+512
+11
+11
-
-########################################

policy/modules/kernel/corenetwork.te.m4

@@ -78 +78 @@
-')
-
-600
+512
-define(`declare_ports',`dnl
-ifelse(eval(range_start($3) < 1024),1,`typeattribute $1 reserved_port_type;
-600
+512
-',`dnl')
-portcon $2 $3 gen_context(system_u:object_r:$1,$4)