1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
|
policy_module(iptables, 1.20.3)
########################################
#
# Declarations
#
attribute_role iptables_roles;
roleattribute system_r iptables_roles;
type iptables_t;
type iptables_exec_t;
init_system_domain(iptables_t, iptables_exec_t)
role iptables_roles types iptables_t;
type iptables_initrc_exec_t;
init_script_file(iptables_initrc_exec_t)
type iptables_conf_t;
files_config_file(iptables_conf_t)
type iptables_runtime_t alias iptables_var_run_t;
files_pid_file(iptables_runtime_t)
type iptables_tmp_t;
files_tmp_file(iptables_tmp_t)
type iptables_unit_t;
init_unit_file(iptables_unit_t)
########################################
#
# Iptables local policy
#
allow iptables_t self:capability { dac_override dac_read_search net_admin net_raw };
dontaudit iptables_t self:capability sys_tty_config;
allow iptables_t self:fifo_file rw_fifo_file_perms;
allow iptables_t self:process { sigchld sigkill sigstop signull signal };
allow iptables_t self:netlink_socket create_socket_perms;
allow iptables_t self:netlink_netfilter_socket create_socket_perms;
allow iptables_t self:rawip_socket create_socket_perms;
manage_files_pattern(iptables_t, iptables_conf_t, iptables_conf_t)
files_etc_filetrans(iptables_t, iptables_conf_t, file)
can_exec(iptables_t, iptables_exec_t)
manage_files_pattern(iptables_t, iptables_runtime_t, iptables_runtime_t)
files_pid_filetrans(iptables_t, iptables_runtime_t, file)
allow iptables_t iptables_tmp_t:dir manage_dir_perms;
allow iptables_t iptables_tmp_t:file manage_file_perms;
files_tmp_filetrans(iptables_t, iptables_tmp_t, { file dir })
kernel_getattr_proc(iptables_t)
kernel_request_load_module(iptables_t)
kernel_read_system_state(iptables_t)
kernel_read_network_state(iptables_t)
kernel_read_kernel_sysctls(iptables_t)
kernel_read_modprobe_sysctls(iptables_t)
kernel_use_fds(iptables_t)
# needed by ipvsadm
corecmd_exec_bin(iptables_t)
corecmd_exec_shell(iptables_t)
corenet_relabelto_all_packets(iptables_t)
corenet_dontaudit_rw_tun_tap_dev(iptables_t)
dev_read_sysfs(iptables_t)
fs_getattr_xattr_fs(iptables_t)
fs_search_auto_mountpoints(iptables_t)
fs_list_inotifyfs(iptables_t)
mls_file_read_all_levels(iptables_t)
domain_use_interactive_fds(iptables_t)
files_read_etc_files(iptables_t)
files_read_etc_runtime_files(iptables_t)
auth_use_nsswitch(iptables_t)
init_use_fds(iptables_t)
init_use_script_ptys(iptables_t)
# to allow rules to be saved on reboot:
init_rw_script_tmp_files(iptables_t)
init_rw_script_stream_sockets(iptables_t)
logging_send_syslog_msg(iptables_t)
miscfiles_read_localization(iptables_t)
sysnet_run_ifconfig(iptables_t, iptables_roles)
sysnet_dns_name_resolve(iptables_t)
userdom_use_inherited_user_terminals(iptables_t)
ifdef(`hide_broken_symptoms',`
dev_dontaudit_write_mtrr(iptables_t)
')
optional_policy(`
fail2ban_append_log(iptables_t)
')
optional_policy(`
firewalld_read_config_files(iptables_t)
firewalld_read_var_run_files(iptables_t)
firewalld_dontaudit_rw_tmp_files(iptables_t)
')
optional_policy(`
firstboot_use_fds(iptables_t)
firstboot_rw_pipes(iptables_t)
')
optional_policy(`
modutils_run(iptables_t, iptables_roles)
')
optional_policy(`
# for iptables -L
nis_use_ypbind(iptables_t)
')
optional_policy(`
ppp_dontaudit_use_fds(iptables_t)
')
optional_policy(`
psad_rw_tmp_files(iptables_t)
')
optional_policy(`
rhgb_dontaudit_use_ptys(iptables_t)
')
optional_policy(`
shorewall_read_tmp_files(iptables_t)
shorewall_rw_lib_files(iptables_t)
shorewall_read_config(iptables_t)
')
optional_policy(`
udev_read_db(iptables_t)
# this is for iptables_t to inherit a file hande from xen vif-bridge
udev_manage_pid_files(iptables_t)
')
|
GitWeb