policy/modules/system/iptables.te

   1
   2 policy_module(iptables, 1.8.1)
   3
   4 ########################################
   5 #
   6 # Declarations
   7 #
   8
   9 type iptables_t;
  10 type iptables_exec_t;
  11 init_system_domain(iptables_t, iptables_exec_t)
  12 role system_r types iptables_t;
  13
  14 type iptables_tmp_t;
  15 files_tmp_file(iptables_tmp_t)
  16
  17 type iptables_var_run_t;
  18 files_pid_file(iptables_var_run_t)
  19
  20 ########################################
  21 #
  22 # Iptables local policy
  23 #
  24
  25 allow iptables_t self:capability { dac_read_search dac_override net_admin net_raw };
  26 dontaudit iptables_t self:capability sys_tty_config;
  27 allow iptables_t self:process { sigchld sigkill sigstop signull signal };
  28 allow iptables_t self:rawip_socket create_socket_perms;
  29
  30 manage_files_pattern(iptables_t, iptables_var_run_t, iptables_var_run_t)
  31 files_pid_filetrans(iptables_t, iptables_var_run_t, file)
  32
  33 can_exec(iptables_t, iptables_exec_t)
  34
  35 allow iptables_t iptables_tmp_t:dir manage_dir_perms;
  36 allow iptables_t iptables_tmp_t:file manage_file_perms;
  37 files_tmp_filetrans(iptables_t, iptables_tmp_t, { file dir })
  38
  39 kernel_read_system_state(iptables_t)
  40 kernel_read_network_state(iptables_t)
  41 kernel_read_kernel_sysctls(iptables_t)
  42 kernel_read_modprobe_sysctls(iptables_t)
  43 kernel_use_fds(iptables_t)
  44
  45 corenet_relabelto_all_packets(iptables_t)
  46
  47 dev_read_sysfs(iptables_t)
  48
  49 fs_getattr_xattr_fs(iptables_t)
  50 fs_search_auto_mountpoints(iptables_t)
  51 fs_list_inotifyfs(iptables_t)
  52
  53 mls_file_read_all_levels(iptables_t)
  54
  55 term_dontaudit_use_console(iptables_t)
  56
  57 domain_use_interactive_fds(iptables_t)
  58
  59 files_read_etc_files(iptables_t)
  60 files_read_etc_runtime_files(iptables_t)
  61
  62 auth_use_nsswitch(iptables_t)
  63
  64 init_use_fds(iptables_t)
  65 init_use_script_ptys(iptables_t)
  66 # to allow rules to be saved on reboot:
  67 init_rw_script_tmp_files(iptables_t)
  68 init_rw_script_stream_sockets(iptables_t)
  69
  70 logging_send_syslog_msg(iptables_t)
  71
  72 miscfiles_read_localization(iptables_t)
  73
  74 sysnet_domtrans_ifconfig(iptables_t)
  75 sysnet_dns_name_resolve(iptables_t)
  76
  77 userdom_use_user_terminals(iptables_t)
  78 userdom_use_all_users_fds(iptables_t)
  79
  80 optional_policy(`
  81         fail2ban_append_log(iptables_t)
  82 ')
  83
  84 optional_policy(`
  85         firstboot_use_fds(iptables_t)
  86         firstboot_rw_pipes(iptables_t)
  87 ')
  88
  89 optional_policy(`
  90         modutils_domtrans_insmod(iptables_t)
  91 ')
  92
  93 optional_policy(`
  94         # for iptables -L
  95         nis_use_ypbind(iptables_t)
  96 ')
  97
  98 optional_policy(`
  99         ppp_dontaudit_use_fds(iptables_t)
 100 ')
 101
 102 optional_policy(`
 103         rhgb_dontaudit_use_ptys(iptables_t)
 104 ')
 105
 106 optional_policy(`
 107         seutil_sigchld_newrole(iptables_t)
 108 ')
 109
 110 optional_policy(`
 111         udev_read_db(iptables_t)
 112 ')