Re: Iptables discussion

[Daniel J Walsh <dwalsh@redhat.com>]

Ivan Gyurdiev wrote:

>On Mon, 2005-07-25 at 14:28 -0400, Ivan Gyurdiev wrote:
>  
>
>>>So you could have:
>>>
>>>can_network(apache_t)
>>>
>>>and then to change it to only use eth0,
>>>
>>>can_network(apache_t,eth0_netif_t)
>>>      
>>>
>>I think automatic policy editing has to occur post-m4 - it doesn't
>>make sense to me to be generating pre-m4 macros - this is going
>>to be very hard to validate, and require a long time to compile and
>>process.
>>
>>Your 1-line change expands to several hundred rules in policy.
>>    
>>
>
>Perhaps I misunderstood what you were saying.
>Dan's saying you want the netif argument to be optional,
>and we fallback to a default label where everything's allowed 
>if the argument is missing - so you'd only add a specific 
>label for things you want managed by iptables. 
>
>That would make sense, and might be a good idea.
>
>
>  
>
Ok so then a tool could add the following rules to only allow apache and 
named to run on 0.

type netif_eth0_t, netif_type;
netifcon eth0 system_u:object_r:netif_eth0_t system_u:object_r:unlabeled_t
allow httpd_t netif_eth0_t:netif { tcp_recv tcp_send rawip_send 
rawip_recv };
allow named_t netif_eth0_t:netif { udp_recv udp_send tcp_recv tcp_send 
rawip_send rawip_recv };


-- 



--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.