Hello,
I took another look at this and solved some of my problems.
This one is created as NETOBJ type 0, while it should be 40 if matched with NETLINK_TEMP (but we have seen before that it is stuck with ROUTE as protocol so 51 should be the fallback) : 0000009832|check_comp_rc(): pid 720(dbus-daemon), owner 990, rc_role 0, NETOBJ rc_type 0, request CREATE -> NOT_GRANTED! 0000009834|rsbac_adf_request(): request CREATE, pid 720, ppid 1, prog_name dbus-daemon, prog_file /usr/bin/dbus-daemon, uid 990, audit uid 990, target_type NETOBJ, tid 000000009e5234e2 NETLINK RAW AUDIT, attr sock_type, value RAW, result NOT_GRANTED (Softmode) by RC 0000009836|rsbac_adf_set_attr(): request CREATE, pid 720, uid 990, audit uid 990, target_type NETOBJ, tid 000000009e5234e2 NETLINK RAW AUDIT, new_target_type NONE, new_tid NONE, attr sock_type, value 3, error 0
In this first case, the problem came from the admin tool that did not account for changes on the protocol field when using the NETLINK address family. Using the same NETTEMP, it now matches correctly. However this does not explain why the fallback "ALL" NETTEMP was not matched.
These ones are created as NETOBJ type 0, while they should be 40 when matched with INET6_TEMP or INET_TEMP 0000009875|check_comp_rc(): pid 717(avahi-daemon), owner 102, rc_role 0, NETOBJ rc_type 0, request CREATE -> NOT_GRANTED! 0000009876|rsbac_adf_request(): request CREATE, pid 717, ppid 1, prog_name avahi-daemon, prog_file /usr/sbin/avahi-daemon, uid 102, target_type NETOBJ, tid 00000000befb6839 INET6 DGRAM proto UDP local [::]:0 remote [::]:0, attr sock_type, value DGRAM, result NOT_GRANTED (Softmode) by RC 0000009877|rsbac_adf_set_attr(): request CREATE, pid 717, uid 102, target_type NETOBJ, tid 00000000befb6839 INET6 DGRAM proto UDP local [::]:0 remote [::]:0, new_target_type NONE, new_tid NONE, attr sock_type, value 2, error 0 and 0000009976|check_comp_rc(): pid 717(avahi-daemon), owner 102, rc_role 0, NETOBJ rc_type 0, request SEND -> NOT_GRANTED! 0000009977|rsbac_adf_request(): request SEND, pid 717, ppid 1, prog_name avahi-daemon, prog_file /usr/sbin/avahi-daemon, uid 102, target_type NETOBJ, tid 00000000762e87fb INET DGRAM proto UDP local 0.0.0.0:5353 remote 224.0.0.251:5353, attr sock_type, value DGRAM, result NOT_GRANTED (Softmode) by RC
For this second case, this is on my behalf, as I did not fill in the address field of the NETTEMP. I thought that leaving it empty would match every address, but I saw in rsbac_nettemp_def_menu that it was the opposite : an empty field never matches. So I used values "0.0.0.0/0" for INET_TEMP and "::/0" for INET6_TEMP to always match and it seems to work. But I still have no clue as to why the "ALL" NETTEMP was not matched.
And this one is created as NETOBJ type 50, while it should be 40 when matched with INET_TEMP 0000009844|check_comp_rc(): pid 717(avahi-daemon), owner 102, rc_role 0, NETOBJ rc_type 50, request CREATE -> NOT_GRANTED! 0000009846|rsbac_adf_request(): request CREATE, pid 717, ppid 1, prog_name avahi-daemon, prog_file /usr/sbin/avahi-daemon, uid 102, target_type NETOBJ, tid 00000000762e87fb INET DGRAM proto UDP local 0.0.0.0:0 remote 0.0.0.0:0, attr sock_type, value DGRAM, result NOT_GRANTED (Softmode) by RC 0000009848|rsbac_adf_set_attr(): request CREATE, pid 717, uid 102, target_type NETOBJ, tid 00000000762e87fb INET DGRAM proto UDP local 0.0.0.0:0 remote 0.0.0.0:0, new_target_type NONE, new_tid NONE, attr sock_type, value 2, error 0
This third case is also solved by using "0.0.0.0/0" as value for the address field. But curiously it was matched by one of the other default NETTEMP, though I can't figure out which one, as "Localnet" and "Internal LAN" don't match on the address field, and "Auto-IPv4" should also not match with its "/32" subnet mask in "0.0.0.0/32".
After that, remains the fact that the "ALL" NETTEMP does not matches everything. To test the behaviour, I set up a machine where this template is the only one (deleting the other default ones), and assigned it the NETOBJ type 51. For all roles, I removed all rights to NETOBJ type 51 and 0 (even if no NETTEMP exist to become a NETOBJ type 0). See the configuration : $ net_temp -b -a net_temp -V 66570 new_template 100110 "ALL" net_temp -V 66570 set_name 100110 "ALL" net_temp -V 66570 set_address_family 100110 ANY net_temp -V 66570 set_type 100110 ANY net_temp -V 66570 set_protocol 100110 ANY net_temp -V 66570 set_netdev 100110 "" $ attr_get_net RC NETTEMP rc_type 100110 51
Now, in the logs, I've got both NETOBJ type 51 and NETOBJ type 0. Moreover, the kind of connections that are 0 or 51 seem to be consistent. Based on the tid's in the log, NETOBJ type 0 is used with connections that have these characteristics : - NETLINK RAW KOBJECT_UEVENT - NETLINK RAW NETFILTER - NETLINK RAW AUDIT - NETLINK RAW GENERIC - INET DGRAM proto UDP - INET6 DGRAM proto UDP - INET STREAM proto TCP - INET6 STREAM proto TCP And NETOBJ type 51 is used with these ones : - PACKET DGRAM - NETLINK DGRAM ROUTE - NETLINK RAW ROUTE - DGRAM (The last case is when there are two white spaces between the tid number and "DGRAM", which I think is because the connection uses an address family that is not yet implemented in the RSBAC tools, so instead of "tid <number> <address_family> <socket_type>" there is "tid <number> <socket_type>".)
So, I don't have an explanation but clearly this "ALL" NETTEMP does not matches everything :) That would be great to be able to have a real fallback template.
Terence Gomez