IPTables needs to be able to talk to the terminal

IPTables needs to be able to talk to the terminal

[Daniel J Walsh]

[-- Attachment #1: Type: text/plain, Size: 67 bytes --]

service iptables status  needs to be able to work.

Policy changes

[-- Attachment #2: nsaserefpolicy_policy_modules_system_iptables.patch --]
[-- Type: text/x-patch, Size: 750 bytes --]

--- nsaserefpolicy/policy/modules/system/iptables.te	2007-02-19 11:32:53.000000000 -0500
+++ serefpolicy-2.5.4/policy/modules/system/iptables.te	2007-02-19 16:08:20.000000000 -0500
@@ -51,7 +51,7 @@
 
 mls_file_read_up(iptables_t)
 
-term_dontaudit_use_console(iptables_t)
+term_use_console(iptables_t)
 
 domain_use_interactive_fds(iptables_t)
 
@@ -77,9 +77,11 @@
 userdom_use_all_users_fds(iptables_t)
 
 ifdef(`targeted_policy', `
-	term_dontaudit_use_unallocated_ttys(iptables_t)
-	term_dontaudit_use_generic_ptys(iptables_t)
+	term_use_unallocated_ttys(iptables_t)
+	term_use_generic_ptys(iptables_t)
+	term_use_all_user_ptys(iptables_t)
 	files_dontaudit_read_root_files(iptables_t)
+ 	unconfined_rw_pipes(iptables_t)
 ')
 
 optional_policy(`

Re: IPTables needs to be able to talk to the terminal

[Christopher J. PeBenito]

On Tue, 2007-02-20 at 11:45 -0500, Daniel J Walsh wrote:
> service iptables status  needs to be able to work.

Notes inline:

> --- nsaserefpolicy/policy/modules/system/iptables.te    2007-02-19 11:32:53.000000000 -0500
> +++ serefpolicy-2.5.4/policy/modules/system/iptables.te 2007-02-19 16:08:20.000000000 -0500
> @@ -51,7 +51,7 @@
>  
>  mls_file_read_up(iptables_t)
>  
> -term_dontaudit_use_console(iptables_t)
> +term_use_console(iptables_t)
>  
>  domain_use_interactive_fds(iptables_t)

Since "service iptables status" is interactive, this doesn't seem to
fit.

> @@ -77,9 +77,11 @@
>  userdom_use_all_users_fds(iptables_t)
>  
>  ifdef(`targeted_policy', `
> -       term_dontaudit_use_unallocated_ttys(iptables_t)
> -       term_dontaudit_use_generic_ptys(iptables_t)
> +       term_use_unallocated_ttys(iptables_t)
> +       term_use_generic_ptys(iptables_t)
> +       term_use_all_user_ptys(iptables_t)

This last line doesn't fit since not all users can run iptables; this
type of thing is what run interfaces are for.

>         files_dontaudit_read_root_files(iptables_t)
> +       unconfined_rw_pipes(iptables_t)

What is this for?

-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.