selinux-refpolicy/refpolicy/policy/modules/system/iptables.te


policy_module(iptables, 1.0)

########################################
#
# Declarations
#

type iptables_t;
type iptables_exec_t;
init_system_domain(iptables_t,iptables_exec_t)
role system_r types iptables_t;

type iptables_tmp_t;
files_tmp_file(iptables_tmp_t)

type iptables_var_run_t;
files_pid_file(iptables_var_run_t)

########################################
#
# Iptables local policy
#

allow iptables_t self:capability { net_admin net_raw };
dontaudit iptables_t self:capability sys_tty_config;
allow iptables_t self:process { sigchld sigkill sigstop signull signal };

allow iptables_t iptables_var_run_t:dir rw_dir_perms;
files_create_pid(iptables_t,iptables_var_run_t)

can_exec(iptables_t,iptables_exec_t)

allow iptables_t iptables_tmp_t:dir create_dir_perms;
allow iptables_t iptables_tmp_t:file create_file_perms;
files_create_tmp_files(iptables_t, iptables_tmp_t, { file dir })

allow iptables_t self:rawip_socket create_socket_perms;

kernel_read_system_state(iptables_t)
kernel_read_network_state(iptables_t)
kernel_read_kernel_sysctl(iptables_t)
kernel_read_modprobe_sysctl(iptables_t)
kernel_use_fd(iptables_t)

dev_read_sysfs(iptables_t)

fs_getattr_xattr_fs(iptables_t)
fs_search_auto_mountpoints(iptables_t)

term_dontaudit_use_console(iptables_t)

domain_use_wide_inherit_fd(iptables_t)

files_read_etc_files(iptables_t)

init_use_fd(iptables_t)
init_use_script_pty(iptables_t)
# to allow rules to be saved on reboot:
init_rw_script_tmp_files(iptables_t)

libs_use_ld_so(iptables_t)
libs_use_shared_libs(iptables_t)

logging_send_syslog_msg(iptables_t)
# system-config-network appends to /var/log
#logging_append_system_logs(iptables_t)

miscfiles_read_localization(iptables_t)

sysnet_domtrans_ifconfig(iptables_t)
sysnet_dns_name_resolve(iptables_t)

userdom_use_all_user_fd(iptables_t)

ifdef(`targeted_policy', `
	term_dontaudit_use_unallocated_tty(iptables_t)
	term_dontaudit_use_generic_pty(iptables_t)

	files_dontaudit_read_root_file(iptables_t)
')

optional_policy(`firstboot',`
	firstboot_use_fd(iptables_t)
	firstboot_write_pipe(iptables_t)
')

optional_policy(`modutils',`
	corecmd_search_sbin(iptables_t)
	modutils_domtrans_insmod(iptables_t)
')

optional_policy(`nis',`
	# for iptables -L
	nis_use_ypbind(iptables_t)
')

optional_policy(`selinuxutil',`
	seutil_sigchld_newrole(iptables_t)
')

optional_policy(`udev',`
	udev_read_db(iptables_t)
')
initial commit 2005-04-29 20:16:38 +00:00
add in missing policy_module line 2005-05-02 18:36:51 +00:00			`policy_module(iptables, 1.0)`

initial commit 2005-04-29 20:16:38 +00:00			`########################################`
			`#`
			`# Declarations`
			`#`

			`type iptables_t;`
			`type iptables_exec_t;`
renaming insanity 2005-06-13 17:35:46 +00:00			`init_system_domain(iptables_t,iptables_exec_t)`
more conversion 2005-05-04 17:01:46 +00:00			`role system_r types iptables_t;`
initial commit 2005-04-29 20:16:38 +00:00
			`type iptables_tmp_t;`
renaming insanity 2005-06-13 17:35:46 +00:00			`files_tmp_file(iptables_tmp_t)`
initial commit 2005-04-29 20:16:38 +00:00
add make temporary_file and daemon_runtime_file 2005-05-11 19:36:36 +00:00			`type iptables_var_run_t;`
renaming insanity 2005-06-13 17:35:46 +00:00			`files_pid_file(iptables_var_run_t)`
initial commit 2005-04-29 20:16:38 +00:00
			`########################################`
			`#`
			`# Iptables local policy`
			`#`

			`allow iptables_t self:capability { net_admin net_raw };`
more conversion 2005-05-04 17:01:46 +00:00			`dontaudit iptables_t self:capability sys_tty_config;`
			`allow iptables_t self:process { sigchld sigkill sigstop signull signal };`
initial commit 2005-04-29 20:16:38 +00:00
aliases 2005-06-09 14:50:48 +00:00			`allow iptables_t iptables_var_run_t:dir rw_dir_perms;`
renaming insanity 2005-06-13 17:35:46 +00:00			`files_create_pid(iptables_t,iptables_var_run_t)`
initial commit 2005-04-29 20:16:38 +00:00
aliases 2005-06-09 14:50:48 +00:00			`can_exec(iptables_t,iptables_exec_t)`
initial commit 2005-04-29 20:16:38 +00:00
aliases 2005-06-09 14:50:48 +00:00			`allow iptables_t iptables_tmp_t:dir create_dir_perms;`
			`allow iptables_t iptables_tmp_t:file create_file_perms;`
renaming insanity 2005-06-13 17:35:46 +00:00			`files_create_tmp_files(iptables_t, iptables_tmp_t, { file dir })`
initial commit 2005-04-29 20:16:38 +00:00
aliases 2005-06-09 14:50:48 +00:00			`allow iptables_t self:rawip_socket create_socket_perms;`
initial commit 2005-04-29 20:16:38 +00:00
			`kernel_read_system_state(iptables_t)`
			`kernel_read_network_state(iptables_t)`
more conversion 2005-05-04 17:01:46 +00:00			`kernel_read_kernel_sysctl(iptables_t)`
			`kernel_read_modprobe_sysctl(iptables_t)`
renaming insanity 2005-06-10 01:01:13 +00:00			`kernel_use_fd(iptables_t)`
initial commit 2005-04-29 20:16:38 +00:00
add a couple more nfs and cifs interfaces, to cover most of the use_(nfs\|cifs)_home_dirs tunable 2005-06-16 20:33:51 +00:00			`dev_read_sysfs(iptables_t)`

renaming insanity 2005-06-10 01:01:13 +00:00			`fs_getattr_xattr_fs(iptables_t)`
autofs_t and ypbind cleanup 2005-06-27 16:30:55 +00:00			`fs_search_auto_mountpoints(iptables_t)`
initial commit 2005-04-29 20:16:38 +00:00
renaming insanity 2005-06-10 01:01:13 +00:00			`term_dontaudit_use_console(iptables_t)`
more conversion 2005-05-04 17:01:46 +00:00
renaming insanity 2005-06-13 17:35:46 +00:00			`domain_use_wide_inherit_fd(iptables_t)`
more conversion 2005-05-04 17:01:46 +00:00
another round of renaming, for consistency 2005-06-29 14:26:41 +00:00			`files_read_etc_files(iptables_t)`
initial commit 2005-04-29 20:16:38 +00:00
renaming insanity 2005-06-13 17:35:46 +00:00			`init_use_fd(iptables_t)`
			`init_use_script_pty(iptables_t)`
add xml comments to interfaces, convert over userdomain stuff 2005-05-19 21:06:06 +00:00			`# to allow rules to be saved on reboot:`
renaming insanity 2005-06-13 17:35:46 +00:00			`init_rw_script_tmp_files(iptables_t)`
add xml comments to interfaces, convert over userdomain stuff 2005-05-19 21:06:06 +00:00
renaming insanity 2005-06-13 17:35:46 +00:00			`libs_use_ld_so(iptables_t)`
			`libs_use_shared_libs(iptables_t)`
more conversion 2005-05-04 17:01:46 +00:00
renaming insanity 2005-06-13 17:35:46 +00:00			`logging_send_syslog_msg(iptables_t)`
initial commit 2005-04-29 20:16:38 +00:00			`# system-config-network appends to /var/log`
			`#logging_append_system_logs(iptables_t)`

			`miscfiles_read_localization(iptables_t)`

renaming insanity 2005-06-13 17:35:46 +00:00			`sysnet_domtrans_ifconfig(iptables_t)`
more updates 2005-09-15 21:03:29 +00:00			`sysnet_dns_name_resolve(iptables_t)`
more conversion 2005-05-04 17:01:46 +00:00
renaming insanity 2005-06-13 17:35:46 +00:00			`userdom_use_all_user_fd(iptables_t)`
add xml comments to interfaces, convert over userdomain stuff 2005-05-19 21:06:06 +00:00
autofs_t and ypbind cleanup 2005-06-27 16:30:55 +00:00			ifdef(`targeted_policy', `
			`term_dontaudit_use_unallocated_tty(iptables_t)`
			`term_dontaudit_use_generic_pty(iptables_t)`

			`files_dontaudit_read_root_file(iptables_t)`
			`')`

Change optional_policy() to refer to the module name rather than modulename.te. 2005-11-23 20:24:27 +00:00			optional_policy(`firstboot',`
add firstboot 2005-08-17 14:14:07 +00:00			`firstboot_use_fd(iptables_t)`
			`firstboot_write_pipe(iptables_t)`
			`')`

Change optional_policy() to refer to the module name rather than modulename.te. 2005-11-23 20:24:27 +00:00			optional_policy(`modutils',`
renaming insanity 2005-06-13 17:35:46 +00:00			`corecmd_search_sbin(iptables_t)`
			`modutils_domtrans_insmod(iptables_t)`
initial commit 2005-04-29 20:16:38 +00:00			`')`

Change optional_policy() to refer to the module name rather than modulename.te. 2005-11-23 20:24:27 +00:00			optional_policy(`nis',`
autofs_t and ypbind cleanup 2005-06-27 16:30:55 +00:00			`# for iptables -L`
			`nis_use_ypbind(iptables_t)`
			`')`

Change optional_policy() to refer to the module name rather than modulename.te. 2005-11-23 20:24:27 +00:00			optional_policy(`selinuxutil',`
another round of renaming, for consistency 2005-06-29 14:26:41 +00:00			`seutil_sigchld_newrole(iptables_t)`
more conversion 2005-05-04 17:01:46 +00:00			`')`

Change optional_policy() to refer to the module name rather than modulename.te. 2005-11-23 20:24:27 +00:00			optional_policy(`udev',`
renaming insanity 2005-06-13 17:35:46 +00:00			`udev_read_db(iptables_t)`
more conversion 2005-05-04 17:01:46 +00:00			`')`