* [Fwd: [PATCH] refpolicy: system_iptables changes]
@ 2007-08-02 18:29 Daniel J Walsh
2007-08-22 19:55 ` Christopher J. PeBenito
0 siblings, 1 reply; 3+ messages in thread
From: Daniel J Walsh @ 2007-08-02 18:29 UTC (permalink / raw)
To: Christopher J. PeBenito, SE Linux
Switch iptables to use nsswitch
--- nsaserefpolicy/policy/modules/system/iptables.te 2007-07-25 10:37:42.000000000 -0400
+++ serefpolicy-3.0.4/policy/modules/system/iptables.te 2007-07-25 12:27:26.000000000 -0400
@@ -44,6 +44,8 @@
corenet_relabelto_all_packets(iptables_t)
+auth_use_nsswitch(iptables_t)
+
dev_read_sysfs(iptables_t)
fs_getattr_xattr_fs(iptables_t)
@@ -62,6 +64,7 @@
init_use_script_ptys(iptables_t)
# to allow rules to be saved on reboot:
init_rw_script_tmp_files(iptables_t)
+init_rw_script_stream_sockets(iptables_t)
libs_use_ld_so(iptables_t)
libs_use_shared_libs(iptables_t)
@@ -96,10 +99,6 @@
')
optional_policy(`
- nscd_socket_use(iptables_t)
-')
-
-optional_policy(`
ppp_dontaudit_use_fds(iptables_t)
')
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [Fwd: [PATCH] refpolicy: system_iptables changes]
2007-08-02 18:29 [Fwd: [PATCH] refpolicy: system_iptables changes] Daniel J Walsh
@ 2007-08-22 19:55 ` Christopher J. PeBenito
2007-08-22 21:22 ` Daniel J Walsh
0 siblings, 1 reply; 3+ messages in thread
From: Christopher J. PeBenito @ 2007-08-22 19:55 UTC (permalink / raw)
To: Daniel J Walsh; +Cc: SE Linux
On Thu, 2007-08-02 at 14:29 -0400, Daniel J Walsh wrote:
> Switch iptables to use nsswitch
>
> --- nsaserefpolicy/policy/modules/system/iptables.te 2007-07-25
> 10:37:42.000000000 -0400
> +++ serefpolicy-3.0.4/policy/modules/system/iptables.te 2007-07-25
> 12:27:26.000000000 -0400
> @@ -44,6 +44,8 @@
>
> corenet_relabelto_all_packets(iptables_t)
>
> +auth_use_nsswitch(iptables_t)
> +
I applied this part a few lines down
> dev_read_sysfs(iptables_t)
>
> fs_getattr_xattr_fs(iptables_t)
> @@ -62,6 +64,7 @@
> init_use_script_ptys(iptables_t)
> # to allow rules to be saved on reboot:
> init_rw_script_tmp_files(iptables_t)
> +init_rw_script_stream_sockets(iptables_t)
This is weird, what caused this behavior?
--
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [Fwd: [PATCH] refpolicy: system_iptables changes]
2007-08-22 19:55 ` Christopher J. PeBenito
@ 2007-08-22 21:22 ` Daniel J Walsh
0 siblings, 0 replies; 3+ messages in thread
From: Daniel J Walsh @ 2007-08-22 21:22 UTC (permalink / raw)
To: Christopher J. PeBenito; +Cc: SE Linux
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Christopher J. PeBenito wrote:
> On Thu, 2007-08-02 at 14:29 -0400, Daniel J Walsh wrote:
>> Switch iptables to use nsswitch
>>
>> --- nsaserefpolicy/policy/modules/system/iptables.te 2007-07-25
>> 10:37:42.000000000 -0400
>> +++ serefpolicy-3.0.4/policy/modules/system/iptables.te 2007-07-25
>> 12:27:26.000000000 -0400
>> @@ -44,6 +44,8 @@
>>
>> corenet_relabelto_all_packets(iptables_t)
>>
>> +auth_use_nsswitch(iptables_t)
>> +
>
> I applied this part a few lines down
>
>> dev_read_sysfs(iptables_t)
>>
>> fs_getattr_xattr_fs(iptables_t)
>> @@ -62,6 +64,7 @@
>> init_use_script_ptys(iptables_t)
>> # to allow rules to be saved on reboot:
>> init_rw_script_tmp_files(iptables_t)
>> +init_rw_script_stream_sockets(iptables_t)
>
> This is weird, what caused this behavior?
>
Some firewall tool that execs iptables.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org
iD8DBQFGzKkmrlYvE4MpobMRAjVpAJ9fsuWej8tKcqTObJ21bRtIooItuACfcKmg
9ARrzgIfAFMNwxcgvY6yuAE=
=eIl/
-----END PGP SIGNATURE-----
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2007-08-22 21:22 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2007-08-02 18:29 [Fwd: [PATCH] refpolicy: system_iptables changes] Daniel J Walsh
2007-08-22 19:55 ` Christopher J. PeBenito
2007-08-22 21:22 ` Daniel J Walsh
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.