From: dominick.grift@gmail.com (Dominick Grift) Date: Sat, 9 Nov 2013 10:44:57 +0100 Subject: [refpolicy] [PATCH 16/39] iptables: calls to firewalld interfaces from Fedora. The firewalld_dontaudit_rw_tmp_files(iptables_t) was confirmed on Debian. In-Reply-To: <1383990320-3340-1-git-send-email-dominick.grift@gmail.com> References: <1383990320-3340-1-git-send-email-dominick.grift@gmail.com> Message-ID: <1383990320-3340-16-git-send-email-dominick.grift@gmail.com> To: refpolicy@oss.tresys.com List-Id: refpolicy.oss.tresys.com Signed-off-by: Dominick Grift --- policy/modules/system/iptables.te | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/policy/modules/system/iptables.te b/policy/modules/system/iptables.te index be8ed1e..63eb287 100644 --- a/policy/modules/system/iptables.te +++ b/policy/modules/system/iptables.te @@ -49,6 +49,7 @@ allow iptables_t iptables_tmp_t:dir manage_dir_perms; allow iptables_t iptables_tmp_t:file manage_file_perms; files_tmp_filetrans(iptables_t, iptables_tmp_t, { file dir }) +kernel_getattr_proc(iptables_t) kernel_request_load_module(iptables_t) kernel_read_system_state(iptables_t) kernel_read_network_state(iptables_t) @@ -105,6 +106,11 @@ optional_policy(` ') optional_policy(` + firewalld_read_config_files(iptables_t) + firewalld_dontaudit_rw_tmp_files(iptables_t) +') + +optional_policy(` firstboot_use_fds(iptables_t) firstboot_rw_pipes(iptables_t) ') -- 1.8.3.1