From c0b38cf988df48613209e48007eefd748480d52f Mon Sep 17 00:00:00 2001
From: Zdenek Pytela <zpytela@redhat.com>
Date: Thu, 2 Dec 2021 10:55:46 +0100
Subject: [PATCH] Allow lldpd use an snmp subagent over a tcp socket

Reference: https://gitbub.com/fedora-selinux/selinux-policy/commit/c0b38cf988df48613209e48007eefd748480d52f
Conflict: NA

When lldpd enables an snmp subagent for a tcp socket instead of udp:
LLDPD_OPTIONS="-i -k -X tcp:127.0.0.1:705"

the following permissions are required:
- allow lldpd create and use tcp socket
- name_connect to the agentx_port_t port

Addresses the following AVC denials:

type=PROCTITLE msg=audit(12/02/21 06:16:32.721:425) : proctitle=/usr/sbin/lldpd -i -k -X tcp:127.0.0.1:705
type=SYSCALL msg=audit(12/02/21 06:16:32.721:425) : arch=x86_64 syscall=socket success=yes exit=17 a0=inet a1=SOCK_STREAM a2=ip a3=0x0 items=0 ppid=129230 pid=129232 auid=unset uid=lldpd gid=lldpd euid=lldpd suid=lldpd fsuid=lldpd egid=lldpd sgid=lldpd fsgid=lldpd tty=(none) ses=unset comm=lldpd exe=/usr/sbin/lldpd subj=system_u:system_r:lldpad_t:s0 key=(null)
type=AVC msg=audit(12/02/21 06:16:32.721:425) : avc:  denied  { create } for  pid=129232 comm=lldpd scontext=system_u:system_r:lldpad_t:s0 tcontext=system_u:system_r:lldpad_t:s0 tclass=tcp_socket permissive=1

type=PROCTITLE msg=audit(12/02/21 06:16:32.721:426) : proctitle=/usr/sbin/lldpd -i -k -X tcp:127.0.0.1:705
type=SYSCALL msg=audit(12/02/21 06:16:32.721:426) : arch=x86_64 syscall=connect success=no exit=ECONNREFUSED(Connection refused) a0=0x11 a1=0x7ffff0e22c30 a2=0x10 a3=0x0 items=0 ppid=129230 pid=129232 auid=unset uid=lldpd gid=lldpd euid=lldpd suid=lldpd fsuid=lldpd egid=lldpd sgid=lldpd fsgid=lldpd tty=(none) ses=unset comm=lldpd exe=/usr/sbin/lldpd subj=system_u:system_r:lldpad_t:s0 key=(null)
type=AVC msg=audit(12/02/21 06:16:32.721:426) : avc:  denied  { name_connect } for  pid=129232 comm=lldpd dest=705 scontext=system_u:system_r:lldpad_t:s0 tcontext=system_u:object_r:agentx_port_t:s0 tclass=tcp_socket permissive=1
type=AVC msg=audit(12/02/21 06:16:32.721:426) : avc:  denied  { connect } for  pid=129232 comm=lldpd scontext=system_u:system_r:lldpad_t:s0 tcontext=system_u:system_r:lldpad_t:s0 tclass=tcp_socket permissive=1

Resolves: rhbz#2028379
Signed-off-by: lujie54 <lujie54@huawei.com>
---
 policy/modules/contrib/lldpad.te | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/policy/modules/contrib/lldpad.te b/policy/modules/contrib/lldpad.te
index 000fafb..cccbc09 100644
--- a/policy/modules/contrib/lldpad.te
+++ b/policy/modules/contrib/lldpad.te
@@ -32,6 +32,7 @@ allow lldpad_t self:fifo_file rw_fifo_file_perms;
 allow lldpad_t self:unix_stream_socket { accept connectto listen };
 allow lldpad_t self:netlink_route_socket create_netlink_socket_perms;
 allow lldpad_t self:packet_socket create_socket_perms;
+allow lldpad_t self:tcp_socket create_socket_perms;
 allow lldpad_t self:udp_socket create_socket_perms;
 
 manage_files_pattern(lldpad_t, lldpad_tmpfs_t, lldpad_tmpfs_t)
@@ -54,6 +55,8 @@ auth_read_passwd(lldpad_t)
 
 corecmd_exec_bin(lldpad_t)
 
+corenet_tcp_connect_agentx_port(lldpad_t)
+
 dev_read_sysfs(lldpad_t)
 
 fs_getattr_tmpfs(lldpad_t)
-- 
1.8.3.1