Skip to contentSkip to conversation

refpolicy: system_iptables changes]

PATCH In review Daniel J Walsh 2 participants 3 messages Aug 2, 2007 – Aug 22, 2007 SELinux security module

lore
Share & tools
lore

Daniel J Walsh

author
#0 lore raw

PATCH 1/1 refpolicy: system_iptables changes]

Switch iptables to use nsswitch

policy/modules/system/iptables.te +0 -0
@@ -44,6 +44,8 @@

corenet_relabelto_all_packets(iptables_t)

+auth_use_nsswitch(iptables_t)
+
dev_read_sysfs(iptables_t)

fs_getattr_xattr_fs(iptables_t)
@@ -62,6 +64,7 @@
init_use_script_ptys(iptables_t)

# to allow rules to be saved on reboot:
init_rw_script_tmp_files(iptables_t)
+init_rw_script_stream_sockets(iptables_t)

libs_use_ld_so(iptables_t)
libs_use_shared_libs(iptables_t)
@@ -96,10 +99,6 @@
')

optional_policy(`
- nscd_socket_use(iptables_t)
-')
-
-optional_policy(`
ppp_dontaudit_use_fds(iptables_t)
')

--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.

#1 lore raw

Review line 48

Quoted 12 lines · Daniel J Walsh

Switch iptables to use nsswitch

--- nsaserefpolicy/policy/modules/system/iptables.te 2007-07-25
10:37:42.000000000 -0400
+++ serefpolicy-3.0.4/policy/modules/system/iptables.te 2007-07-25 12:27:26.000000000 -0400

(quoted diff) +2 -0
@@ -44,6 +44,8 @@
 
 corenet_relabelto_all_packets(iptables_t)
 
+auth_use_nsswitch(iptables_t)
+

I applied this part a few lines down

Review line 67

Quoted 8 lines
(quoted diff) +1 -0
 dev_read_sysfs(iptables_t)
 
 fs_getattr_xattr_fs(iptables_t)

@@ -62,6 +64,7 @@
 init_use_script_ptys(iptables_t)
 # to allow rules to be saved on reboot:
 init_rw_script_tmp_files(iptables_t)
+init_rw_script_stream_sockets(iptables_t)

This is weird, what caused this behavior?

Signature · 9 lines
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to [email protected] with
the words "unsubscribe selinux" without quotes as the message.
author
#2 lore raw

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Quoted 18 lines · Christopher J. PeBenito

Review line 48

Quoted 12 lines · Daniel J Walsh

Switch iptables to use nsswitch

--- nsaserefpolicy/policy/modules/system/iptables.te 2007-07-25
10:37:42.000000000 -0400
+++ serefpolicy-3.0.4/policy/modules/system/iptables.te 2007-07-25 12:27:26.000000000 -0400

(quoted diff) +2 -0
@@ -44,6 +44,8 @@
 
 corenet_relabelto_all_packets(iptables_t)
 
+auth_use_nsswitch(iptables_t)
+

I applied this part a few lines down

Quoted 2 lines
(quoted diff) +0 -0
 dev_read_sysfs(iptables_t)
Quoted 9 lines

Review line 67

Quoted 6 lines
(quoted diff) +1 -0
 fs_getattr_xattr_fs(iptables_t)

@@ -62,6 +64,7 @@
 init_use_script_ptys(iptables_t)
 # to allow rules to be saved on reboot:
 init_rw_script_tmp_files(iptables_t)
+init_rw_script_stream_sockets(iptables_t)

This is weird, what caused this behavior?

Some firewall tool that execs iptables.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org

iD8DBQFGzKkmrlYvE4MpobMRAjVpAJ9fsuWej8tKcqTObJ21bRtIooItuACfcKmg 9ARrzgIfAFMNwxcgvY6yuAE=
=eIl/
-----END PGP SIGNATURE-----

--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.