Re: Iptables discussion

[Daniel J Walsh <dwalsh@redhat.com>]

With the current way that policy is written all devices get the 
netif_type by default.  This type is then only used in the can_network 
macros. 

define(`base_can_network',`
...
#
# Allow the domain to send or receive using any network interface.
# netif_type is a type attribute for all network interface types.
#
allow $1 netif_type:netif { $2_send rawip_send };
allow $1 netif_type:netif { $2_recv rawip_recv };
...


Since we would want to take this ability away from a specific device, we 
would need some kind of
boolean or tunable to take away the netif_type for say the ethernet 
device.   I could envision something
like the following

in types/network.te

define(`network_device_domain', `
type netif_$1_t;
boolean allow_$1_all_communication true;
if (allow_$1_all_communication) {
typeattribute netif_$1_t netif_type;
}
')

Of course you can wrap typeattributes in booleans yet, so this would 
have to be enhanced.
Then the user or iptables would have to add the appropriate rules for 
the selinux domain

define(`can_nitif_communicate', `
allow $1_t netif_$2_t:netif { $3_send rawip_send };
allow $1_t netif_$2_t:netif { $3_recv rawip_recv };
')
can_netif_communicate(httpd_t, eth0, tcp)


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.