From: cpebenito@tresys.com (Christopher J. PeBenito)
Date: Fri, 6 Dec 2013 09:50:29 -0500
Subject: [refpolicy] [PATCH 16/39] iptables: calls to firewalld
 interfaces from Fedora. The firewalld_dontaudit_rw_tmp_files(iptables_t)
 was confirmed on Debian.
In-Reply-To: <1383990320-3340-16-git-send-email-dominick.grift@gmail.com>
References: <1383990320-3340-1-git-send-email-dominick.grift@gmail.com>
	<1383990320-3340-16-git-send-email-dominick.grift@gmail.com>
Message-ID: <52A1E435.8040802@tresys.com>
To: refpolicy@oss.tresys.com
List-Id: refpolicy.oss.tresys.com

On 11/09/13 04:44, Dominick Grift wrote:
> Signed-off-by: Dominick Grift <dominick.grift@gmail.com>
> ---
>  policy/modules/system/iptables.te | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/policy/modules/system/iptables.te b/policy/modules/system/iptables.te
> index be8ed1e..63eb287 100644
> --- a/policy/modules/system/iptables.te
> +++ b/policy/modules/system/iptables.te
> @@ -49,6 +49,7 @@ allow iptables_t iptables_tmp_t:dir manage_dir_perms;
>  allow iptables_t iptables_tmp_t:file manage_file_perms;
>  files_tmp_filetrans(iptables_t, iptables_tmp_t, { file dir })
>  
> +kernel_getattr_proc(iptables_t)
>  kernel_request_load_module(iptables_t)
>  kernel_read_system_state(iptables_t)
>  kernel_read_network_state(iptables_t)
> @@ -105,6 +106,11 @@ optional_policy(`
>  ')
>  
>  optional_policy(`
> +	firewalld_read_config_files(iptables_t)
> +	firewalld_dontaudit_rw_tmp_files(iptables_t)
> +')
> +
> +optional_policy(`
>  	firstboot_use_fds(iptables_t)
>  	firstboot_rw_pipes(iptables_t)
>  ')
 
Merged.

-- 
Chris PeBenito
Tresys Technology, LLC
www.tresys.com | oss.tresys.com