1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
|
policy_module(iptables)
########################################
#
# Declarations
#
attribute_role iptables_roles;
roleattribute system_r iptables_roles;
type iptables_t;
type iptables_exec_t;
init_system_domain(iptables_t, iptables_exec_t)
role iptables_roles types iptables_t;
type iptables_initrc_exec_t;
init_script_file(iptables_initrc_exec_t)
type iptables_conf_t;
files_config_file(iptables_conf_t)
type iptables_runtime_t alias iptables_var_run_t;
files_runtime_file(iptables_runtime_t)
type iptables_tmp_t;
files_tmp_file(iptables_tmp_t)
type iptables_unit_t;
init_unit_file(iptables_unit_t)
########################################
#
# Iptables local policy
#
allow iptables_t self:capability { dac_override dac_read_search net_admin net_raw };
dontaudit iptables_t self:capability sys_tty_config;
allow iptables_t self:cap_userns { net_admin net_raw };
allow iptables_t self:fifo_file rw_fifo_file_perms;
allow iptables_t self:process { sigchld sigkill signal signull sigstop };
allow iptables_t self:netlink_socket create_socket_perms;
allow iptables_t self:netlink_netfilter_socket create_socket_perms;
allow iptables_t self:rawip_socket create_socket_perms;
manage_files_pattern(iptables_t, iptables_conf_t, iptables_conf_t)
files_etc_filetrans(iptables_t, iptables_conf_t, file)
can_exec(iptables_t, iptables_exec_t)
manage_files_pattern(iptables_t, iptables_runtime_t, iptables_runtime_t)
files_runtime_filetrans(iptables_t, iptables_runtime_t, file)
allow iptables_t iptables_tmp_t:dir manage_dir_perms;
allow iptables_t iptables_tmp_t:file manage_file_perms;
files_tmp_filetrans(iptables_t, iptables_tmp_t, { file dir })
kernel_getattr_proc(iptables_t)
kernel_request_load_module(iptables_t)
kernel_read_system_state(iptables_t)
kernel_read_network_state(iptables_t)
kernel_read_kernel_sysctls(iptables_t)
kernel_read_modprobe_sysctls(iptables_t)
kernel_use_fds(iptables_t)
# needed by ipvsadm
corecmd_exec_bin(iptables_t)
corecmd_exec_shell(iptables_t)
corenet_relabelto_all_packets(iptables_t)
corenet_dontaudit_rw_tun_tap_dev(iptables_t)
dev_read_sysfs(iptables_t)
dev_dontaudit_write_mtrr(iptables_t)
fs_getattr_xattr_fs(iptables_t)
fs_search_auto_mountpoints(iptables_t)
fs_list_cgroup_dirs(iptables_t)
fs_list_inotifyfs(iptables_t)
fs_ioctl_cgroup_dirs(iptables_t)
mls_file_read_all_levels(iptables_t)
domain_use_interactive_fds(iptables_t)
files_read_etc_files(iptables_t)
files_read_etc_runtime_files(iptables_t)
files_read_usr_files(iptables_t)
auth_use_nsswitch(iptables_t)
init_use_fds(iptables_t)
init_use_script_ptys(iptables_t)
init_read_script_pipes(iptables_t)
# to allow rules to be saved on reboot:
init_rw_script_pipes(iptables_t)
init_rw_script_tmp_files(iptables_t)
init_rw_script_stream_sockets(iptables_t)
logging_send_syslog_msg(iptables_t)
miscfiles_read_localization(iptables_t)
sysnet_run_ifconfig(iptables_t, iptables_roles)
sysnet_dns_name_resolve(iptables_t)
userdom_use_inherited_user_terminals(iptables_t)
optional_policy(`
# iptables may try to rw /ptmx in a container
container_dontaudit_rw_chr_files(iptables_t)
# iptables reads firewall rules written to tmp
container_read_engine_tmp_files(iptables_t)
')
optional_policy(`
fail2ban_append_log(iptables_t)
')
optional_policy(`
firewalld_read_config_files(iptables_t)
firewalld_read_var_run_files(iptables_t)
firewalld_dontaudit_rw_tmp_files(iptables_t)
')
optional_policy(`
firstboot_use_fds(iptables_t)
firstboot_rw_pipes(iptables_t)
')
optional_policy(`
# apply firewall rules from multus
kubernetes_rw_container_engine_fifo_files(iptables_t)
')
optional_policy(`
modutils_run(iptables_t, iptables_roles)
')
optional_policy(`
# for iptables -L
nis_use_ypbind(iptables_t)
')
optional_policy(`
ppp_dontaudit_use_fds(iptables_t)
')
optional_policy(`
psad_rw_tmp_files(iptables_t)
')
optional_policy(`
shorewall_read_tmp_files(iptables_t)
shorewall_rw_lib_files(iptables_t)
shorewall_read_config(iptables_t)
')
optional_policy(`
# this is for iptables_t to inherit a file handle from xen vif-bridge
udev_manage_runtime_files(iptables_t)
')
|
GitWeb