Commit Graph

21 Commits

Author SHA1 Message Date
Jason Zaman 6bf506ec68 iptables: fcontexts for 1.8.0
The binary changed from /sbin/xtables-multi to xtables-legacy-multi and
xtables-nft-multi
2018-07-10 17:25:11 -04:00
cgzones ce7aa47ff5 iptables: update
v2:
 - do not remove interfaces superseded by auth_use_nsswitch()
2017-06-12 18:42:53 -04:00
cgzones 4d22001265 iptables: align file contexts 2017-06-08 18:43:48 -04:00
Nicolas Iooss 69c742f11b
Support systems with a single /usr/bin directory
On systems such as Arch Linux, all programs which are usually located in
/bin, /sbin, /usr/bin and /usr/sbin are present in /usr/bin and the
other locations are symbolic links to this directory.  With such a
configuration, the file contexts which define types for files in
/bin, /sbin and /usr/sbin need to be duplicated to provide definitions
for /usr/bin/...

As the "/bin vs. /usr/bin" part of the needed definitions has already
been done with the "usr merge" patches, the next step consists in
duplicating file contexts for /usr/sbin. This is what this patch does
for all modules which are not in contrib.

This is the second iteration of an idea I have previously posted on
http://oss.tresys.com/pipermail/refpolicy/2017-March/009176.html
2017-04-15 20:49:07 +02:00
Chris PeBenito 2e7553db63 Create / to /usr equivalence for bin, sbin, and lib, from Russell Coker. 2017-02-04 15:19:35 -05:00
Nicolas Iooss 85d678bd2f
Add file contexts in /usr for /bin, /usr/sbin and /usr/lib
Some policy modules define file contexts in /bin, /sbin and /lib without
defining similar file contexts in the same directory under /usr.

Add these missing file contexts when there are outside ifdef blocks.
2016-12-27 17:06:54 +01:00
cgzones 7d376d7e4d transition file contexts to /run
Remove file context aliases and update file context paths to use the /run filesystem path.
Add backward compatibility file context alias for /var/run using applications like https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=783321
Lock files are still seated at /var/lock
2016-12-17 18:32:39 +01:00
Jason Zaman d85ff7f0b9 iptables: add fcontext for nftables 2016-05-16 09:13:30 -04:00
Chris PeBenito 35baa47094 Whitespace fix in iptables.fc. 2016-02-10 10:34:51 -05:00
Laurent Bigonville 8f19ffbde8 Label /var/run/ebtables.lock as iptables_var_run_t.
This lock file is used on debian since version 2.0.10.4-3.2. This is
also used on Fedora.
2016-02-08 22:51:30 +01:00
Lukas Vrabec e16f8a18fd Label /var/run/xtables.lock as iptables_var_run_t. 2016-02-08 22:43:27 +01:00
Laurent Bigonville 958cb89462 Add label for /sbin/ipset 2016-02-05 01:14:30 +01:00
Chris PeBenito f7286189b3 Add systemd units for core refpolicy services.
Only for services that already have a named init script.

Add rules to init_startstop_service(), with conditional arg until
all of refpolicy-contrib callers are updated.
2015-10-23 10:17:46 -04:00
Chris PeBenito f1aa23dc47 Add conntrack fc entry.
This tool is for maintaining the netfilter connection tracking.
2013-04-05 09:45:04 -04:00
Sven Vermeulen a2317f3820 Run ipset in iptables domain
The ipset command is used to manage ip sets, used by iptables for a more
flexible management of firewall rules. It has very similar requirements as
iptables for accessing and working with the Linux kernel, so marking ipset as
iptables_exec_t to have it run in the iptables domain.

Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
2012-11-27 08:35:57 -05:00
Sven Vermeulen 2ebb974006 ip6?tables-multi is combined in xtables-multi
Since april, the *-multi applications offered through iptables are combined
through a single binary called xtables-multi. The previous commands are now
symbolic links towards this application.

Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
2011-08-24 08:35:57 -04:00
Chris PeBenito 127d617b31 Pull in some changes from Fedora policy system layer. 2011-04-14 11:36:56 -04:00
Chris PeBenito 7491a9ed62 Iptables and modutils patches from Dan Walsh. 2009-12-01 09:23:11 -05:00
Chris PeBenito 625be1b4e6 add shorewall from dan. 2009-09-02 08:58:52 -04:00
Chris PeBenito d6605bc48b trunk: 3 patches from dan. 2009-04-03 14:14:43 +00:00
Chris PeBenito 17de1b790b remove extra level of directory 2006-07-12 20:32:27 +00:00