#######################################

#

# corenetwork_send_tcp_on_general_interface(domain,[`optional'])

#

define(`corenetwork_send_tcp_on_general_interface',`

requires_block_template(`corenetwork_send_tcp_on_general_interface_depend',$2)

allow $1 netif_t:netif tcp_send;

')

define(`corenetwork_send_tcp_on_general_interface_depend',`

type netif_t;

class netif tcp_send;

')

#######################################

#

# corenetwork_send_udp_on_general_interface(domain,[`optional'])

#

define(`corenetwork_send_udp_on_general_interface',`

requires_block_template(`corenetwork_send_udp_on_general_interface_depend',$2)

allow $1 netif_t:netif udp_send;

')

define(`corenetwork_send_udp_on_general_interface_depend',`

type netif_t;

class netif udp_send;

')

#######################################

#

# corenetwork_send_raw_on_general_interface(domain,[`optional'])

#

define(`corenetwork_send_raw_on_general_interface',`

requires_block_template(`corenetwork_send_raw_on_general_interface_depend',$2)

allow $1 netif_t:netif rawip_send;

allow $1 self:capability net_raw;

')

define(`corenetwork_send_raw_on_general_interface_depend',`

type netif_t;

class netif rawip_send;

class capability net_raw;

')

#######################################

#

# corenetwork_receive_tcp_on_general_interface(domain,[`optional'])

#

define(`corenetwork_receive_tcp_on_general_interface',`

requires_block_template(`corenetwork_receive_tcp_on_general_interface_depend',$2)

allow $1 netif_t:netif tcp_recv;

')

define(`corenetwork_receive_tcp_on_general_interface_depend',`

type netif_t;

class netif tcp_recv;

')

#######################################

#

# corenetwork_receive_udp_on_general_interface(domain,[`optional'])

#

define(`corenetwork_receive_udp_on_general_interface',`

requires_block_template(`corenetwork_receive_udp_on_general_interface_depend',$2)

allow $1 netif_t:netif udp_recv;

')

define(`corenetwork_receive_udp_on_general_interface_depend',`

type netif_t;

class netif udp_recv;

')

#######################################

#

# corenetwork_receive_raw_on_general_interface(domain,[`optional'])

#

define(`corenetwork_receive_raw_on_general_interface',`

requires_block_template(`corenetwork_receive_raw_on_general_interface_depend',$2)

allow $1 netif_t:netif rawip_recv;

')

define(`corenetwork_receive_raw_on_general_interface_depend',`

type netif_t;

class netif rawip_recv;

')

#######################################

#

# corenetwork_send_tcp_on_all_interfaces(domain,[`optional'])

#

define(`corenetwork_send_tcp_on_all_interfaces',`

requires_block_template(`corenetwork_send_tcp_on_all_interfaces_depend',$2)

allow $1 netif_type:netif tcp_send;

')

define(`corenetwork_send_tcp_on_all_interfaces_depend',`

attribute all_netif_type;

class netif tcp_send;

')

#######################################

#

# corenetwork_send_udp_on_all_interfaces(domain,[`optional'])

#

define(`corenetwork_send_udp_on_all_interfaces',`

requires_block_template(`corenetwork_send_udp_on_all_interfaces_depend',$2)

allow $1 netif_type:netif udp_send;

')

define(`corenetwork_send_udp_on_all_interfaces_depend',`

attribute netif_type;

class netif udp_send;

')

#######################################

#

# corenetwork_send_raw_on_all_interfaces(domain,[`optional'])

#

define(`corenetwork_send_raw_on_all_interfaces',`

requires_block_template(`corenetwork_send_raw_on_all_interfaces_depend',$2)

allow $1 netif_type:netif rawip_send;

allow $1 self:capability net_raw;

')

define(`corenetwork_send_raw_on_all_interfaces_depend',`

attribute netif_type;

class netif rawip_send;

class capability net_raw;

')

#######################################

#

# corenetwork_receive_tcp_on_all_interfaces(domain,[`optional'])

#

define(`corenetwork_receive_tcp_on_all_interfaces',`

requires_block_template(`corenetwork_receive_tcp_on_all_interfaces_depend',$2)

allow $1 netif_type:netif tcp_recv;

')

define(`corenetwork_receive_tcp_on_all_interfaces_depend',`

attribute netif_type;

class netif tcp_recv;

')

#######################################

#

# corenetwork_receive_udp_on_all_interfaces(domain,[`optional'])

#

define(`corenetwork_receive_udp_on_all_interfaces',`

requires_block_template(`corenetwork_receive_udp_on_all_interfaces_depend',$2)

allow $1 netif_type:netif udp_recv;

')

define(`corenetwork_receive_udp_on_all_interfaces_depend',`

attribute netif_type;

class netif udp_recv;

')

#######################################

#

# corenetwork_receive_raw_on_all_interfaces(domain,[`optional'])

#

define(`corenetwork_receive_raw_on_all_interfaces',`

requires_block_template(`corenetwork_receive_raw_on_all_interfaces_depend',$2)

allow $1 netif_type:netif rawip_recv;

')

define(`corenetwork_receive_raw_on_all_interfaces_depend',`

attribute netif_type;

class netif rawip_recv;

')

########################################

#

# This section is processed through m4 to create real interfaces

#

########################################

# dont generate anything but macros on this pass

ifdef(`interface_pass',`

define(`allow',`dnl')

define(`type',`dnl')

define(`attribute',`dnl')

define(`portcon',`dnl')

define(`devices_make_device_node',`dnl')

')

define(`create_netif_interfaces',``

#######################################

#

# corenetwork_send_tcp_on_interface_$1(domain,[`optional'])

#

define(`corenetwork_send_tcp_on_interface_$1',`

requires_block_template(`corenetwork_send_tcp_on_interface_$1_depend',dollarstwo)

allow dollarsone $1_netif_t:netif tcp_send;

')

define(`corenetwork_send_tcp_on_interface_$1_depend',`

type $1_netif_t;

class netif tcp_send;

')

#######################################

#

# corenetwork_send_udp_on_interface_$1(domain,[`optional'])

#

define(`corenetwork_send_udp_on_interface_$1',`

requires_block_template(`corenetwork_send_udp_on_interface_$1_depend',dollarstwo)

allow dollarsone $1_netif_t:netif udp_send;

')

define(`corenetwork_send_udp_on_interface_$1_depend',`

type $1_netif_t;

class netif udp_send;

')

#######################################

#

# corenetwork_send_raw_on_interface_$1(domain,[`optional'])

#

define(`corenetwork_send_raw_on_interface_$1',`

requires_block_template(`corenetwork_send_raw_on_interface_$1_depend',dollarstwo)

allow dollarsone $1_netif_t:netif rawip_send;

allow dollarsone self:capability net_raw;

')

define(`corenetwork_send_raw_on_interface_$1_depend',`

type $1_netif_t;

class netif rawip_send;

class capability net_raw;

')

#######################################

#

# corenetwork_receive_tcp_on_interface_$1(domain,[`optional'])

#

define(`corenetwork_receive_tcp_on_interface_$1',`

requires_block_template(`corenetwork_receive_tcp_on_interface_$1_depend',dollarstwo)

allow dollarsone $1_netif_t:netif tcp_recv;

')

define(`corenetwork_receive_tcp_on_interface_$1_depend',`

type $1_netif_t;

class netif tcp_recv;

')

#######################################

#

# corenetwork_receive_udp_on_interface_$1(domain,[`optional'])

#

define(`corenetwork_receive_udp_on_interface_$1',`

requires_block_template(`corenetwork_receive_udp_on_interface_$1_depend',dollarstwo)

allow dollarsone $1_netif_t:netif udp_recv;

')

define(`corenetwork_receive_udp_on_interface_$1_depend',`

type $1_netif_t;

class netif udp_recv;

')

#######################################

#

# corenetwork_receive_raw_on_interface_$1(domain,[`optional'])

#

define(`corenetwork_receive_raw_on_interface_$1',`

requires_block_template(`corenetwork_receive_raw_on_interface_$1_depend',dollarstwo)

allow dollarsone $1_netif_t:netif rawip_recv;

')

define(`corenetwork_receive_raw_on_interface_$1_depend',`

type $1_netif_t;

class netif rawip_recv;

')

'') dnl end create_interfaces

#

# network_interface(linux_interfacename)

#

define(`network_interface',`

ifdef(`interface_pass',`

create_netif_interfaces($1)

',`

type $1_netif_t alias netif_$1_t, netif_type;

requires_block_template(`type unlabeled_t')

netifcon $1 system_u:object_r:$1_netif_t system_u:object_r:unlabeled_t

')

')

#

# network_node(node_name,address,netmask)

#

define(`network_node',`

ifdef(`interface_pass',`

#create_node_interfaces($1)

',`

type $1_node_t alias node_$1_t, node_type;

nodecon $2 $3 system_u:object_r:$1_node_t

')

')

define(`declare_ports',`dnl

ifelse(eval($3 < 1024),1,`typeattribute $1 reserved_port_type;',`dnl')

portcon $2 $3 system_u:object_r:$1

ifelse(`$4',`',`',`declare_ports($1,shiftn(3,$*))')dnl

')

#

# network_port(port_name,protocol portnum [,protocol portnum[,...]])

#

define(`network_port',`

ifdef(`interface_pass',`

#create_port_interfaces($1)

',`

type $1_port_t, port_type;

declare_ports($1_port_t,shift($*))

')

')