policy/modules/system/iptables.te

   1 policy_module(iptables, 1.11.2)
   2
   3 ########################################
   4 #
   5 # Declarations
   6 #
   7
   8 type iptables_t;
   9 type iptables_exec_t;
  10 init_system_domain(iptables_t, iptables_exec_t)
  11 role system_r types iptables_t;
  12
  13 type iptables_initrc_exec_t;
  14 init_script_file(iptables_initrc_exec_t)
  15
  16 type iptables_tmp_t;
  17 files_tmp_file(iptables_tmp_t)
  18
  19 type iptables_var_run_t;
  20 files_pid_file(iptables_var_run_t)
  21
  22 ########################################
  23 #
  24 # Iptables local policy
  25 #
  26
  27 allow iptables_t self:capability { dac_read_search dac_override net_admin net_raw };
  28 dontaudit iptables_t self:capability sys_tty_config;
  29 allow iptables_t self:fifo_file rw_fifo_file_perms;
  30 allow iptables_t self:process { sigchld sigkill sigstop signull signal };
  31 allow iptables_t self:netlink_socket create_socket_perms;
  32 allow iptables_t self:rawip_socket create_socket_perms;
  33
  34 files_manage_system_conf_files(iptables_t)
  35 files_etc_filetrans_system_conf(iptables_t)
  36
  37 manage_files_pattern(iptables_t, iptables_var_run_t, iptables_var_run_t)
  38 files_pid_filetrans(iptables_t, iptables_var_run_t, file)
  39
  40 can_exec(iptables_t, iptables_exec_t)
  41
  42 allow iptables_t iptables_tmp_t:dir manage_dir_perms;
  43 allow iptables_t iptables_tmp_t:file manage_file_perms;
  44 files_tmp_filetrans(iptables_t, iptables_tmp_t, { file dir })
  45
  46 kernel_getattr_proc(iptables_t)
  47 kernel_request_load_module(iptables_t)
  48 kernel_read_system_state(iptables_t)
  49 kernel_read_network_state(iptables_t)
  50 kernel_read_kernel_sysctls(iptables_t)
  51 kernel_read_modprobe_sysctls(iptables_t)
  52 kernel_use_fds(iptables_t)
  53
  54 # needed by ipvsadm
  55 corecmd_exec_bin(iptables_t)
  56 corecmd_exec_shell(iptables_t)
  57
  58 corenet_relabelto_all_packets(iptables_t)
  59 corenet_dontaudit_rw_tun_tap_dev(iptables_t)
  60
  61 dev_read_sysfs(iptables_t)
  62 ifdef(`hide_broken_symptoms',`
  63         dev_dontaudit_write_mtrr(iptables_t)
  64 ')
  65
  66 fs_getattr_xattr_fs(iptables_t)
  67 fs_search_auto_mountpoints(iptables_t)
  68 fs_list_inotifyfs(iptables_t)
  69
  70 mls_file_read_all_levels(iptables_t)
  71
  72 term_dontaudit_use_console(iptables_t)
  73 term_use_all_inherited_terms(iptables_t)
  74
  75 domain_use_interactive_fds(iptables_t)
  76
  77 files_read_etc_files(iptables_t)
  78 files_rw_etc_runtime_files(iptables_t)
  79 files_read_usr_files(iptables_t)
  80
  81 auth_use_nsswitch(iptables_t)
  82
  83 init_use_fds(iptables_t)
  84 init_use_script_ptys(iptables_t)
  85 # to allow rules to be saved on reboot:
  86 init_rw_script_tmp_files(iptables_t)
  87 init_rw_script_stream_sockets(iptables_t)
  88 init_dontaudit_script_leaks(iptables_t)
  89
  90 logging_send_syslog_msg(iptables_t)
  91
  92 miscfiles_read_localization(iptables_t)
  93
  94 sysnet_domtrans_ifconfig(iptables_t)
  95 sysnet_dns_name_resolve(iptables_t)
  96
  97 userdom_use_inherited_user_terminals(iptables_t)
  98 userdom_use_all_users_fds(iptables_t)
  99
 100 ifdef(`hide_broken_symptoms',`
 101         dev_dontaudit_write_mtrr(iptables_t)
 102 ')
 103
 104 optional_policy(`
 105         fail2ban_append_log(iptables_t)
 106         fail2ban_dontaudit_leaks(iptables_t)
 107         fail2ban_rw_inherited_tmp_files(iptables_t)
 108 ')
 109
 110 optional_policy(`
 111         firstboot_use_fds(iptables_t)
 112         firstboot_rw_pipes(iptables_t)
 113 ')
 114
 115 optional_policy(`
 116         modutils_domtrans_insmod(iptables_t)
 117 ')
 118
 119 optional_policy(`
 120         # for iptables -L
 121         nis_use_ypbind(iptables_t)
 122 ')
 123
 124 optional_policy(`
 125         ppp_dontaudit_use_fds(iptables_t)
 126 ')
 127
 128 optional_policy(`
 129         psad_rw_tmp_files(iptables_t)
 130         psad_write_log(iptables_t)
 131 ')
 132
 133 optional_policy(`
 134         rhgb_dontaudit_use_ptys(iptables_t)
 135 ')
 136
 137 optional_policy(`
 138         seutil_sigchld_newrole(iptables_t)
 139 ')
 140
 141 optional_policy(`
 142         shorewall_read_tmp_files(iptables_t)
 143         shorewall_rw_lib_files(iptables_t)
 144         shorewall_read_tmp_files(iptables_t)
 145         shorewall_read_config(iptables_t)
 146 ')
 147
 148 optional_policy(`
 149         udev_read_db(iptables_t)
 150 ')