selinux-policy/policy/modules/system/iptables.if

## <summary>Policy for iptables.</summary>

########################################
## <summary>
##	Execute iptables in the iptables domain.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`iptables_domtrans',`
	gen_require(`
		type iptables_t, iptables_exec_t;
	')

	corecmd_search_bin($1)
	domtrans_pattern($1,iptables_exec_t,iptables_t)
')

########################################
## <summary>
##	Execute iptables in the iptables domain, and
##	allow the specified role the iptables domain.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
## <param name="role">
##	<summary>
##	The role to be allowed the iptables domain.
##	</summary>
## </param>
## <param name="terminal">
##	<summary>
##	The type of the terminal allow the iptables domain to use.
##	</summary>
## </param>
## <rolecap/>
#
interface(`iptables_run',`
	gen_require(`
		type iptables_t;
	')

	iptables_domtrans($1)
	role $2 types iptables_t;
	allow iptables_t $3:chr_file rw_term_perms;

	sysnet_run_ifconfig(iptables_t, $2, $3)

	optional_policy(`
		modutils_run_insmod(iptables_t, $2, $3)
	')
')

########################################
## <summary>
##	Execute iptables in the caller domain.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`iptables_exec',`
	gen_require(`
		type iptables_exec_t;
	')

	corecmd_search_bin($1)
	can_exec($1,iptables_exec_t)
')
fix xml 2005-06-01 14:17:43 +00:00			`## <summary>Policy for iptables.</summary>`
initial commit 2005-05-02 19:24:29 +00:00
add xml comments to interfaces, convert over userdomain stuff 2005-05-19 21:06:06 +00:00			`########################################`
finalize desc -> summary xml change 2005-08-11 17:46:39 +00:00			`## <summary>`
update for new documentation method 2005-06-23 21:30:57 +00:00			`## Execute iptables in the iptables domain.`
finalize desc -> summary xml change 2005-08-11 17:46:39 +00:00			`## </summary>`
update for new documentation method 2005-06-23 21:30:57 +00:00			`## <param name="domain">`
xml building changes, add desc tag to booleans, add summary tag to bools 2006-02-10 18:41:53 +00:00			`## <summary>`
cleanup 2006-01-24 21:58:16 +00:00			`## Domain allowed access.`
xml building changes, add desc tag to booleans, add summary tag to bools 2006-02-10 18:41:53 +00:00			`## </summary>`
update for new documentation method 2005-06-23 21:30:57 +00:00			`## </param>`
initial commit 2005-05-02 19:24:29 +00:00			`#`
move all interfaces over to the interface macro. add traceback debugging info 2005-06-22 19:21:31 +00:00			interface(`iptables_domtrans',`
review of system interfaces 2005-06-17 17:59:26 +00:00			gen_require(`
			`type iptables_t, iptables_exec_t;`
			`')`
change over to some perm set macros. add indentation 2005-06-03 12:25:14 +00:00
Merge sbin_t and ls_exec_t into bin_t. 2007-03-23 23:24:59 +00:00			`corecmd_search_bin($1)`
merge policy patterns to trunk 2006-12-12 20:08:08 +00:00			`domtrans_pattern($1,iptables_exec_t,iptables_t)`
initial commit 2005-05-02 19:24:29 +00:00			`')`

add xml comments to interfaces, convert over userdomain stuff 2005-05-19 21:06:06 +00:00			`########################################`
finalize desc -> summary xml change 2005-08-11 17:46:39 +00:00			`## <summary>`
update for new documentation method 2005-06-23 21:30:57 +00:00			`## Execute iptables in the iptables domain, and`
			`## allow the specified role the iptables domain.`
finalize desc -> summary xml change 2005-08-11 17:46:39 +00:00			`## </summary>`
update for new documentation method 2005-06-23 21:30:57 +00:00			`## <param name="domain">`
xml building changes, add desc tag to booleans, add summary tag to bools 2006-02-10 18:41:53 +00:00			`## <summary>`
cleanup 2006-01-24 21:58:16 +00:00			`## Domain allowed access.`
xml building changes, add desc tag to booleans, add summary tag to bools 2006-02-10 18:41:53 +00:00			`## </summary>`
update for new documentation method 2005-06-23 21:30:57 +00:00			`## </param>`
			`## <param name="role">`
xml building changes, add desc tag to booleans, add summary tag to bools 2006-02-10 18:41:53 +00:00			`## <summary>`
update for new documentation method 2005-06-23 21:30:57 +00:00			`## The role to be allowed the iptables domain.`
xml building changes, add desc tag to booleans, add summary tag to bools 2006-02-10 18:41:53 +00:00			`## </summary>`
update for new documentation method 2005-06-23 21:30:57 +00:00			`## </param>`
			`## <param name="terminal">`
xml building changes, add desc tag to booleans, add summary tag to bools 2006-02-10 18:41:53 +00:00			`## <summary>`
update for new documentation method 2005-06-23 21:30:57 +00:00			`## The type of the terminal allow the iptables domain to use.`
xml building changes, add desc tag to booleans, add summary tag to bools 2006-02-10 18:41:53 +00:00			`## </summary>`
update for new documentation method 2005-06-23 21:30:57 +00:00			`## </param>`
add main part of role-o-matic 2006-09-06 22:07:25 +00:00			`## <rolecap/>`
initial commit 2005-05-02 19:24:29 +00:00			`#`
move all interfaces over to the interface macro. add traceback debugging info 2005-06-22 19:21:31 +00:00			interface(`iptables_run',`
review of system interfaces 2005-06-17 17:59:26 +00:00			gen_require(`
			`type iptables_t;`
			`')`
change over to some perm set macros. add indentation 2005-06-03 12:25:14 +00:00
renaming insanity 2005-06-13 17:35:46 +00:00			`iptables_domtrans($1)`
change over to some perm set macros. add indentation 2005-06-03 12:25:14 +00:00			`role $2 types iptables_t;`
review of system interfaces 2005-06-17 17:59:26 +00:00			`allow iptables_t $3:chr_file rw_term_perms;`
trunk: 2 patches from dan. 2008-08-14 15:10:41 +00:00
			`sysnet_run_ifconfig(iptables_t, $2, $3)`

			optional_policy(`
			`modutils_run_insmod(iptables_t, $2, $3)`
			`')`
add xml comments to interfaces, convert over userdomain stuff 2005-05-19 21:06:06 +00:00			`')`

			`########################################`
finalize desc -> summary xml change 2005-08-11 17:46:39 +00:00			`## <summary>`
update for new documentation method 2005-06-23 21:30:57 +00:00			`## Execute iptables in the caller domain.`
finalize desc -> summary xml change 2005-08-11 17:46:39 +00:00			`## </summary>`
update for new documentation method 2005-06-23 21:30:57 +00:00			`## <param name="domain">`
xml building changes, add desc tag to booleans, add summary tag to bools 2006-02-10 18:41:53 +00:00			`## <summary>`
cleanup 2006-01-24 21:58:16 +00:00			`## Domain allowed access.`
xml building changes, add desc tag to booleans, add summary tag to bools 2006-02-10 18:41:53 +00:00			`## </summary>`
update for new documentation method 2005-06-23 21:30:57 +00:00			`## </param>`
initial commit 2005-05-02 19:24:29 +00:00			`#`
move all interfaces over to the interface macro. add traceback debugging info 2005-06-22 19:21:31 +00:00			interface(`iptables_exec',`
review of system interfaces 2005-06-17 17:59:26 +00:00			gen_require(`
			`type iptables_exec_t;`
			`')`
change over to some perm set macros. add indentation 2005-06-03 12:25:14 +00:00
Merge sbin_t and ls_exec_t into bin_t. 2007-03-23 23:24:59 +00:00			`corecmd_search_bin($1)`
aliases 2005-06-09 14:50:48 +00:00			`can_exec($1,iptables_exec_t)`
initial commit 2005-05-02 19:24:29 +00:00			`')`