selinux-refpolicy/policy/modules/system/iptables.te

policy_module(iptables, 1.21.0)

########################################
#
# Declarations
#

attribute_role iptables_roles;
roleattribute system_r iptables_roles;

type iptables_t;
type iptables_exec_t;
init_system_domain(iptables_t, iptables_exec_t)
role iptables_roles types iptables_t;

type iptables_initrc_exec_t;
init_script_file(iptables_initrc_exec_t)

type iptables_conf_t;
files_config_file(iptables_conf_t)

type iptables_runtime_t alias iptables_var_run_t;
files_pid_file(iptables_runtime_t)

type iptables_tmp_t;
files_tmp_file(iptables_tmp_t)

type iptables_unit_t;
init_unit_file(iptables_unit_t)

########################################
#
# Iptables local policy
#

allow iptables_t self:capability { dac_override dac_read_search net_admin net_raw };
dontaudit iptables_t self:capability sys_tty_config;
allow iptables_t self:fifo_file rw_fifo_file_perms;
allow iptables_t self:process { sigchld sigkill sigstop signull signal };
allow iptables_t self:netlink_socket create_socket_perms;
allow iptables_t self:netlink_netfilter_socket create_socket_perms;
allow iptables_t self:rawip_socket create_socket_perms;

manage_files_pattern(iptables_t, iptables_conf_t, iptables_conf_t)
files_etc_filetrans(iptables_t, iptables_conf_t, file)

can_exec(iptables_t, iptables_exec_t)

manage_files_pattern(iptables_t, iptables_runtime_t, iptables_runtime_t)
files_pid_filetrans(iptables_t, iptables_runtime_t, file)

allow iptables_t iptables_tmp_t:dir manage_dir_perms;
allow iptables_t iptables_tmp_t:file manage_file_perms;
files_tmp_filetrans(iptables_t, iptables_tmp_t, { file dir })

kernel_getattr_proc(iptables_t)
kernel_request_load_module(iptables_t)
kernel_read_system_state(iptables_t)
kernel_read_network_state(iptables_t)
kernel_read_kernel_sysctls(iptables_t)
kernel_read_modprobe_sysctls(iptables_t)
kernel_use_fds(iptables_t)

# needed by ipvsadm
corecmd_exec_bin(iptables_t)
corecmd_exec_shell(iptables_t)

corenet_relabelto_all_packets(iptables_t)
corenet_dontaudit_rw_tun_tap_dev(iptables_t)

dev_read_sysfs(iptables_t)

fs_getattr_xattr_fs(iptables_t)
fs_search_auto_mountpoints(iptables_t)
fs_list_inotifyfs(iptables_t)

mls_file_read_all_levels(iptables_t)

domain_use_interactive_fds(iptables_t)

files_read_etc_files(iptables_t)
files_read_etc_runtime_files(iptables_t)

auth_use_nsswitch(iptables_t)

init_use_fds(iptables_t)
init_use_script_ptys(iptables_t)
# to allow rules to be saved on reboot:
init_rw_script_tmp_files(iptables_t)
init_rw_script_stream_sockets(iptables_t)

logging_send_syslog_msg(iptables_t)

miscfiles_read_localization(iptables_t)

sysnet_run_ifconfig(iptables_t, iptables_roles)
sysnet_dns_name_resolve(iptables_t)

userdom_use_inherited_user_terminals(iptables_t)

ifdef(`hide_broken_symptoms',`
	dev_dontaudit_write_mtrr(iptables_t)
')

optional_policy(`
	fail2ban_append_log(iptables_t)
')

optional_policy(`
	firewalld_read_config_files(iptables_t)
	firewalld_read_var_run_files(iptables_t)
	firewalld_dontaudit_rw_tmp_files(iptables_t)
')

optional_policy(`
	firstboot_use_fds(iptables_t)
	firstboot_rw_pipes(iptables_t)
')

optional_policy(`
	modutils_run(iptables_t, iptables_roles)
')

optional_policy(`
	# for iptables -L
	nis_use_ypbind(iptables_t)
')

optional_policy(`
	ppp_dontaudit_use_fds(iptables_t)
')

optional_policy(`
	psad_rw_tmp_files(iptables_t)
')

optional_policy(`
	rhgb_dontaudit_use_ptys(iptables_t)
')

optional_policy(`
	shorewall_read_tmp_files(iptables_t)
	shorewall_rw_lib_files(iptables_t)
	shorewall_read_config(iptables_t)
')

optional_policy(`
	udev_read_db(iptables_t)
	# this is for iptables_t to inherit a file hande from xen vif-bridge
	udev_manage_pid_files(iptables_t)
')
Bump module versions for release. 2019-02-01 20:03:42 +00:00			`policy_module(iptables, 1.21.0)`
add in missing policy_module line 2005-05-02 18:36:51 +00:00
initial commit 2005-04-29 20:16:38 +00:00			`########################################`
			`#`
			`# Declarations`
			`#`

Add role attributes in iptables. 2011-08-12 12:10:59 +00:00			`attribute_role iptables_roles;`
			`roleattribute system_r iptables_roles;`

initial commit 2005-04-29 20:16:38 +00:00			`type iptables_t;`
			`type iptables_exec_t;`
trunk: whitespace fixes 2009-06-26 14:40:13 +00:00			`init_system_domain(iptables_t, iptables_exec_t)`
Add role attributes in iptables. 2011-08-12 12:10:59 +00:00			`role iptables_roles types iptables_t;`
initial commit 2005-04-29 20:16:38 +00:00
Iptables and modutils patches from Dan Walsh. 2009-12-01 14:23:11 +00:00			`type iptables_initrc_exec_t;`
			`init_script_file(iptables_initrc_exec_t)`

			`type iptables_conf_t;`
			`files_config_file(iptables_conf_t)`

iptables: update v2: - do not remove interfaces superseded by auth_use_nsswitch() 2017-06-09 13:49:35 +00:00			`type iptables_runtime_t alias iptables_var_run_t;`
			`files_pid_file(iptables_runtime_t)`

initial commit 2005-04-29 20:16:38 +00:00			`type iptables_tmp_t;`
renaming insanity 2005-06-13 17:35:46 +00:00			`files_tmp_file(iptables_tmp_t)`
initial commit 2005-04-29 20:16:38 +00:00
Add systemd units for core refpolicy services. Only for services that already have a named init script. Add rules to init_startstop_service(), with conditional arg until all of refpolicy-contrib callers are updated. 2015-10-20 18:33:56 +00:00			`type iptables_unit_t;`
			`init_unit_file(iptables_unit_t)`

initial commit 2005-04-29 20:16:38 +00:00			`########################################`
			`#`
			`# Iptables local policy`
			`#`

Sort capabilities permissions from Russell Coker. 2017-02-15 23:47:33 +00:00			`allow iptables_t self:capability { dac_override dac_read_search net_admin net_raw };`
more conversion 2005-05-04 17:01:46 +00:00			`dontaudit iptables_t self:capability sys_tty_config;`
Iptables patch from Dan Walsh. 2010-03-18 12:10:21 +00:00			`allow iptables_t self:fifo_file rw_fifo_file_perms;`
more conversion 2005-05-04 17:01:46 +00:00			`allow iptables_t self:process { sigchld sigkill sigstop signull signal };`
Pull in some changes from Fedora policy system layer. 2011-04-14 15:36:56 +00:00			`allow iptables_t self:netlink_socket create_socket_perms;`
Update netlink socket classes. Define new netlink socket security classes introduced by kernel commit 223ae516404a7a65f09e79a1c0291521c233336e. Note that this does not remove the long-since obsolete netlink_firewall_socket and netlink_ip6_fw_socket classes from refpolicy in case they are still needed for legacy distribution policies. Add the new socket classes to socket_class_set. Update ubac and mls constraints for the new socket classes. Add allow rules for a few specific known cases (netutils, iptables, netlabel, ifconfig, udev) in core policy that require access. Further refinement for the contrib tree will be needed. Any allow rule previously written on :netlink_socket may need to be rewritten or duplicated for one of the more specific classes. For now, we retain the existing :netlink_socket rules for compatibility on older kernels. Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> 2015-05-21 17:38:09 +00:00			`allow iptables_t self:netlink_netfilter_socket create_socket_perms;`
merge policy patterns to trunk 2006-12-12 20:08:08 +00:00			`allow iptables_t self:rawip_socket create_socket_perms;`
initial commit 2005-04-29 20:16:38 +00:00
Iptables and modutils patches from Dan Walsh. 2009-12-01 14:23:11 +00:00			`manage_files_pattern(iptables_t, iptables_conf_t, iptables_conf_t)`
			`files_etc_filetrans(iptables_t, iptables_conf_t, file)`

trunk: whitespace fixes 2009-06-26 14:40:13 +00:00			`can_exec(iptables_t, iptables_exec_t)`
initial commit 2005-04-29 20:16:38 +00:00
iptables: update v2: - do not remove interfaces superseded by auth_use_nsswitch() 2017-06-09 13:49:35 +00:00			`manage_files_pattern(iptables_t, iptables_runtime_t, iptables_runtime_t)`
			`files_pid_filetrans(iptables_t, iptables_runtime_t, file)`

merge policy patterns to trunk 2006-12-12 20:08:08 +00:00			`allow iptables_t iptables_tmp_t:dir manage_dir_perms;`
			`allow iptables_t iptables_tmp_t:file manage_file_perms;`
another round of renaming 2006-02-21 18:40:44 +00:00			`files_tmp_filetrans(iptables_t, iptables_tmp_t, { file dir })`
initial commit 2005-04-29 20:16:38 +00:00
xtables-multi wants to getattr of the proc fs 2011-07-19 09:32:07 +00:00			`kernel_getattr_proc(iptables_t)`
Iptables and modutils patches from Dan Walsh. 2009-12-01 14:23:11 +00:00			`kernel_request_load_module(iptables_t)`
initial commit 2005-04-29 20:16:38 +00:00			`kernel_read_system_state(iptables_t)`
			`kernel_read_network_state(iptables_t)`
renaming from 20060131 interface review, round 2 2006-01-31 16:49:43 +00:00			`kernel_read_kernel_sysctls(iptables_t)`
			`kernel_read_modprobe_sysctls(iptables_t)`
make (almost) all interface parameters required. move boot_t, system_map_t, and modules_object_t to files module. fd use interface renames, udp sendto interface renames. 2006-03-02 23:41:11 +00:00			`kernel_use_fds(iptables_t)`
initial commit 2005-04-29 20:16:38 +00:00
Pull in some changes from Fedora policy system layer. 2011-04-14 15:36:56 +00:00			`# needed by ipvsadm`
			`corecmd_exec_bin(iptables_t)`
			`corecmd_exec_shell(iptables_t)`

allow iptables to relabelto all packets 2006-05-23 19:07:22 +00:00			`corenet_relabelto_all_packets(iptables_t)`
Iptables patch from Dan Walsh. 2010-03-18 12:10:21 +00:00			`corenet_dontaudit_rw_tun_tap_dev(iptables_t)`
allow iptables to relabelto all packets 2006-05-23 19:07:22 +00:00
add a couple more nfs and cifs interfaces, to cover most of the use_(nfs\|cifs)_home_dirs tunable 2005-06-16 20:33:51 +00:00			`dev_read_sysfs(iptables_t)`

renaming insanity 2005-06-10 01:01:13 +00:00			`fs_getattr_xattr_fs(iptables_t)`
autofs_t and ypbind cleanup 2005-06-27 16:30:55 +00:00			`fs_search_auto_mountpoints(iptables_t)`
trunk: fix from fedora policy, cherry picked from David Hardeman. 2008-08-12 19:52:29 +00:00			`fs_list_inotifyfs(iptables_t)`
initial commit 2005-04-29 20:16:38 +00:00
trunk: Deprecate mls_file_write_down() and mls_file_read_up(), replaced with mls_write_all_levels() and mls_read_all_levels(), for consistency. 2007-08-20 18:26:08 +00:00			`mls_file_read_all_levels(iptables_t)`
part of dan's mega patch 2006-01-06 22:51:40 +00:00
another round of renaming 2006-02-20 21:33:25 +00:00			`domain_use_interactive_fds(iptables_t)`
more conversion 2005-05-04 17:01:46 +00:00
another round of renaming, for consistency 2005-06-29 14:26:41 +00:00			`files_read_etc_files(iptables_t)`
trunk: 3 patches from dan 2007-06-11 15:43:37 +00:00			`files_read_etc_runtime_files(iptables_t)`
initial commit 2005-04-29 20:16:38 +00:00
trunk: updates from dan on 9 modules 2007-08-22 20:02:41 +00:00			`auth_use_nsswitch(iptables_t)`

make (almost) all interface parameters required. move boot_t, system_map_t, and modules_object_t to files module. fd use interface renames, udp sendto interface renames. 2006-03-02 23:41:11 +00:00			`init_use_fds(iptables_t)`
another slew of renaming 2006-02-02 21:08:12 +00:00			`init_use_script_ptys(iptables_t)`
add xml comments to interfaces, convert over userdomain stuff 2005-05-19 21:06:06 +00:00			`# to allow rules to be saved on reboot:`
renaming insanity 2005-06-13 17:35:46 +00:00			`init_rw_script_tmp_files(iptables_t)`
trunk: 3 patches from dan. 2007-11-05 19:35:08 +00:00			`init_rw_script_stream_sockets(iptables_t)`
add xml comments to interfaces, convert over userdomain stuff 2005-05-19 21:06:06 +00:00
renaming insanity 2005-06-13 17:35:46 +00:00			`logging_send_syslog_msg(iptables_t)`
initial commit 2005-04-29 20:16:38 +00:00
			`miscfiles_read_localization(iptables_t)`

Add role attributes in iptables. 2011-08-12 12:10:59 +00:00			`sysnet_run_ifconfig(iptables_t, iptables_roles)`
more updates 2005-09-15 21:03:29 +00:00			`sysnet_dns_name_resolve(iptables_t)`
more conversion 2005-05-04 17:01:46 +00:00
iptables: update v2: - do not remove interfaces superseded by auth_use_nsswitch() 2017-06-09 13:49:35 +00:00			`userdom_use_inherited_user_terminals(iptables_t)`
add xml comments to interfaces, convert over userdomain stuff 2005-05-19 21:06:06 +00:00
Pull in some changes from Fedora policy system layer. 2011-04-14 15:36:56 +00:00			ifdef(`hide_broken_symptoms',`
			`dev_dontaudit_write_mtrr(iptables_t)`
			`')`

trunk: 3 patches from dan 2007-06-11 15:43:37 +00:00			optional_policy(`
			`fail2ban_append_log(iptables_t)`
			`')`

iptables: calls to firewalld interfaces from Fedora. The firewalld_dontaudit_rw_tmp_files(iptables_t) was confirmed on Debian. Signed-off-by: Dominick Grift <dominick.grift@gmail.com> 2013-11-09 09:44:57 +00:00			optional_policy(`
			`firewalld_read_config_files(iptables_t)`
Allow {eb,ip,ip6}tables-restore to read files in /run/firewalld Since version 0.4.0, firewalld uses *tables-restore to speedup the load of the rules 2016-02-13 09:04:06 +00:00			`firewalld_read_var_run_files(iptables_t)`
iptables: calls to firewalld interfaces from Fedora. The firewalld_dontaudit_rw_tmp_files(iptables_t) was confirmed on Debian. Signed-off-by: Dominick Grift <dominick.grift@gmail.com> 2013-11-09 09:44:57 +00:00			`firewalld_dontaudit_rw_tmp_files(iptables_t)`
			`')`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
make (almost) all interface parameters required. move boot_t, system_map_t, and modules_object_t to files module. fd use interface renames, udp sendto interface renames. 2006-03-02 23:41:11 +00:00			`firstboot_use_fds(iptables_t)`
patch from dan Wed, 29 Nov 2006 17:06:40 -0500 2006-12-04 20:10:56 +00:00			`firstboot_rw_pipes(iptables_t)`
add firstboot 2005-08-17 14:14:07 +00:00			`')`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
modutils: adopt callers to new interfaces 2017-02-18 21:35:45 +00:00			`modutils_run(iptables_t, iptables_roles)`
initial commit 2005-04-29 20:16:38 +00:00			`')`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
autofs_t and ypbind cleanup 2005-06-27 16:30:55 +00:00			`# for iptables -L`
			`nis_use_ypbind(iptables_t)`
			`')`

patch from dan Wed, 29 Nov 2006 17:06:40 -0500 2006-12-04 20:10:56 +00:00			optional_policy(`
			`ppp_dontaudit_use_fds(iptables_t)`
			`')`

Iptables and modutils patches from Dan Walsh. 2009-12-01 14:23:11 +00:00			optional_policy(`
			`psad_rw_tmp_files(iptables_t)`
			`')`

trunk: 3 patches from dan. 2007-11-05 19:35:08 +00:00			optional_policy(`
			`rhgb_dontaudit_use_ptys(iptables_t)`
			`')`

Iptables patch from Dan Walsh. 2010-03-18 12:10:21 +00:00			optional_policy(`
Shorewall patch from Miroslav Grepl. 2011-03-21 13:42:12 +00:00			`shorewall_read_tmp_files(iptables_t)`
Iptables patch from Dan Walsh. 2010-03-18 12:10:21 +00:00			`shorewall_rw_lib_files(iptables_t)`
Pull in some changes from Fedora policy system layer. 2011-04-14 15:36:56 +00:00			`shorewall_read_config(iptables_t)`
Iptables patch from Dan Walsh. 2010-03-18 12:10:21 +00:00			`')`

deprecate module name as first parameter of optional_policy() 2006-03-24 16:13:54 +00:00			optional_policy(`
renaming insanity 2005-06-13 17:35:46 +00:00			`udev_read_db(iptables_t)`
Network daemon patches from Russell Coker. 2017-02-25 16:20:19 +00:00			`# this is for iptables_t to inherit a file hande from xen vif-bridge`
			`udev_manage_pid_files(iptables_t)`
more conversion 2005-05-04 17:01:46 +00:00			`')`