selinux-policy/mls/domains/program/iptables.te
2005-11-22 19:28:03 +00:00

64 lines
1.7 KiB
Plaintext

#DESC Ipchains - IP packet filter administration
#
# Authors: Justin Smith <jsmith@mcs.drexel.edu>
# Russell Coker <russell@coker.com.au>
# X-Debian-Packages: ipchains iptables
#
#
# Rules for the iptables_t domain.
#
daemon_base_domain(iptables, `, privmodule')
role sysadm_r types iptables_t;
domain_auto_trans(sysadm_t, iptables_exec_t, iptables_t)
ifdef(`modutil.te', `
# for modprobe
allow iptables_t sbin_t:dir search;
allow iptables_t sbin_t:lnk_file read;
')
read_locale(iptables_t)
# to allow rules to be saved on reboot
allow iptables_t initrc_tmp_t:file rw_file_perms;
domain_auto_trans(iptables_t, ifconfig_exec_t, ifconfig_t)
allow iptables_t var_t:dir search;
var_run_domain(iptables)
allow iptables_t self:process { fork signal_perms };
allow iptables_t { sysctl_t sysctl_kernel_t }:dir search;
allow iptables_t sysctl_modprobe_t:file { getattr read };
tmp_domain(iptables)
# for iptables -L
allow iptables_t self:unix_stream_socket create_socket_perms;
can_resolve(iptables_t)
can_ypbind(iptables_t)
allow iptables_t iptables_exec_t:file execute_no_trans;
allow iptables_t self:capability { net_admin net_raw };
allow iptables_t self:rawip_socket create_socket_perms;
allow iptables_t etc_t:file { getattr read };
allow iptables_t fs_t:filesystem getattr;
allow iptables_t { userdomain kernel_t }:fd use;
# Access terminals.
allow iptables_t admin_tty_type:chr_file rw_file_perms;
ifdef(`gnome-pty-helper.te', `allow iptables_t sysadm_gph_t:fd use;')
allow iptables_t proc_t:file { getattr read };
allow iptables_t proc_net_t:dir search;
allow iptables_t proc_net_t:file { read getattr };
# system-config-network appends to /var/log
allow iptables_t var_log_t:file append;
ifdef(`firstboot.te', `
allow iptables_t firstboot_t:fifo_file write;
')