## <summary>Policy for iptables.</summary> ######################################## ## <summary> ## Execute iptables in the iptables domain. ## </summary> ## <param name="domain"> ## <summary> ## Domain allowed to transition. ## </summary> ## </param> # interface(`iptables_domtrans',` gen_require(` type iptables_t, iptables_exec_t; ') corecmd_search_bin($1) domtrans_pattern($1, iptables_exec_t, iptables_t) ifdef(`hide_broken_symptoms', ` dontaudit iptables_t $1:socket_class_set { read write }; ') ') ######################################## ## <summary> ## Execute iptables in the iptables domain, and ## allow the specified role the iptables domain. ## </summary> ## <param name="domain"> ## <summary> ## Domain allowed to transition. ## </summary> ## </param> ## <param name="role"> ## <summary> ## Role allowed access. ## </summary> ## </param> ## <rolecap/> # interface(`iptables_run',` gen_require(` type iptables_t; ') iptables_domtrans($1) role $2 types iptables_t; sysnet_run_ifconfig(iptables_t, $2) optional_policy(` modutils_run_insmod(iptables_t, $2) ') ') ######################################## ## <summary> ## Execute iptables in the caller domain. ## </summary> ## <param name="domain"> ## <summary> ## Domain allowed access. ## </summary> ## </param> # interface(`iptables_exec',` gen_require(` type iptables_exec_t; ') corecmd_search_bin($1) can_exec($1, iptables_exec_t) ') ##################################### ## <summary> ## Execute iptables in the iptables domain. ## </summary> ## <param name="domain"> ## <summary> ## Domain allowed to transition. ## </summary> ## </param> # interface(`iptables_initrc_domtrans',` gen_require(` type iptables_initrc_exec_t; ') init_labeled_script_domtrans($1, iptables_initrc_exec_t) ') ##################################### ## <summary> ## Set the attributes of iptables config files. ## </summary> ## <param name="domain"> ## <summary> ## Domain allowed access. ## </summary> ## </param> # interface(`iptables_setattr_config',` gen_require(` type iptables_conf_t; ') files_search_etc($1) allow $1 iptables_conf_t:file setattr; ') ##################################### ## <summary> ## Read iptables config files. ## </summary> ## <param name="domain"> ## <summary> ## Domain allowed access. ## </summary> ## </param> # interface(`iptables_read_config',` gen_require(` type iptables_conf_t; ') files_search_etc($1) allow $1 iptables_conf_t:dir list_dir_perms; read_files_pattern($1, iptables_conf_t, iptables_conf_t) ') ##################################### ## <summary> ## Create files in /etc with the type used for ## the iptables config files. ## </summary> ## <param name="domain"> ## <summary> ## Domain allowed access. ## </summary> ## </param> # interface(`iptables_etc_filetrans_config',` gen_require(` type iptables_conf_t; ') files_etc_filetrans($1, iptables_conf_t, file) ') ################################### ## <summary> ## Manage iptables config files. ## </summary> ## <param name="domain"> ## <summary> ## Domain allowed access. ## </summary> ## </param> # interface(`iptables_manage_config',` gen_require(` type iptables_conf_t; type etc_t; ') files_search_etc($1) manage_files_pattern($1, iptables_conf_t, iptables_conf_t) ')