#DESC Ipchains - IP packet filter administration

#

# Authors:  Justin Smith <jsmith@mcs.drexel.edu>

#           Russell Coker <russell@coker.com.au>

# X-Debian-Packages: ipchains iptables

#

#

# Rules for the iptables_t domain.

#

daemon_base_domain(iptables, `, privmodule')

role sysadm_r types iptables_t;

domain_auto_trans(sysadm_t, iptables_exec_t, iptables_t)

ifdef(`modutil.te', `

# for modprobe

allow iptables_t sbin_t:dir search;

allow iptables_t sbin_t:lnk_file read;

')

read_locale(iptables_t)

# to allow rules to be saved on reboot

allow iptables_t initrc_tmp_t:file rw_file_perms;

domain_auto_trans(iptables_t, ifconfig_exec_t, ifconfig_t)

allow iptables_t var_t:dir search;

var_run_domain(iptables)

allow iptables_t self:process { fork signal_perms };

allow iptables_t { sysctl_t sysctl_kernel_t }:dir search;

allow iptables_t sysctl_modprobe_t:file { getattr read };

tmp_domain(iptables)

# for iptables -L

allow iptables_t self:unix_stream_socket create_socket_perms;

can_resolve(iptables_t)

can_ypbind(iptables_t)

allow iptables_t iptables_exec_t:file execute_no_trans;

allow iptables_t self:capability { net_admin net_raw };

allow iptables_t self:rawip_socket create_socket_perms;

allow iptables_t etc_t:file { getattr read };

allow iptables_t fs_t:filesystem getattr;

allow iptables_t { userdomain kernel_t }:fd use;

# Access terminals.

allow iptables_t admin_tty_type:chr_file rw_file_perms;

ifdef(`gnome-pty-helper.te', `allow iptables_t sysadm_gph_t:fd use;')

allow iptables_t proc_t:file { getattr read };

allow iptables_t proc_net_t:dir search;

allow iptables_t proc_net_t:file { read getattr };

# system-config-network appends to /var/log

allow iptables_t var_log_t:file append;

ifdef(`firstboot.te', `

allow iptables_t firstboot_t:fifo_file write;

')