From: jason@perfinion.com (Jason Zaman) Date: Mon, 8 Jun 2015 13:29:21 +0400 Subject: [refpolicy] [PATCH 1/3] Introduce iptables_admin Message-ID: <1433755763-30704-1-git-send-email-jason@perfinion.com> To: refpolicy@oss.tresys.com List-Id: refpolicy.oss.tresys.com --- policy/modules/roles/sysadm.te | 2 +- policy/modules/system/iptables.if | 39 +++++++++++++++++++++++++++++++++++++++ 2 files changed, 40 insertions(+), 1 deletion(-) diff --git a/policy/modules/roles/sysadm.te b/policy/modules/roles/sysadm.te index 8219dea..55e0179 100644 --- a/policy/modules/roles/sysadm.te +++ b/policy/modules/roles/sysadm.te @@ -178,7 +178,7 @@ optional_policy(` ') optional_policy(` - iptables_run(sysadm_t, sysadm_r) + iptables_admin(sysadm_t, sysadm_r) ') optional_policy(` diff --git a/policy/modules/system/iptables.if b/policy/modules/system/iptables.if index c42fbc3..26ce647 100644 --- a/policy/modules/system/iptables.if +++ b/policy/modules/system/iptables.if @@ -163,3 +163,42 @@ interface(`iptables_manage_config',` files_search_etc($1) manage_files_pattern($1, iptables_conf_t, iptables_conf_t) ') + +######################################## +## +## All of the rules required to +## administrate an iptables +## environment. +## +## +## +## Domain allowed access. +## +## +## +## +## Role allowed access. +## +## +## +# +interface(`iptables_admin',` + gen_require(` + type iptables_t, iptables_initrc_exec_t, iptables_conf_t; + type iptables_tmp_t, iptables_var_run_t; + ') + + allow $1 iptables_t:process { ptrace signal_perms }; + ps_process_pattern($1, iptables_t) + + init_startstop_service($1, $2, iptables_t, iptables_initrc_exec_t) + + files_list_etc($1) + admin_pattern($1, iptables_conf_t) + + files_list_tmp($1) + admin_pattern($1, iptables_tmp_t) + + files_list_pids($1) + admin_pattern($1, iptables_var_run_t) +') -- 2.3.6