[Fwd: [PATCH] refpolicy: system_iptables changes]

[Fwd: [PATCH] refpolicy: system_iptables changes]

[Daniel J Walsh]

Switch iptables to use nsswitch

--- nsaserefpolicy/policy/modules/system/iptables.te	2007-07-25 10:37:42.000000000 -0400
+++ serefpolicy-3.0.4/policy/modules/system/iptables.te	2007-07-25 12:27:26.000000000 -0400
@@ -44,6 +44,8 @@
 
 corenet_relabelto_all_packets(iptables_t)
 
+auth_use_nsswitch(iptables_t)
+
 dev_read_sysfs(iptables_t)
 
 fs_getattr_xattr_fs(iptables_t)
@@ -62,6 +64,7 @@
 init_use_script_ptys(iptables_t)
 # to allow rules to be saved on reboot:
 init_rw_script_tmp_files(iptables_t)
+init_rw_script_stream_sockets(iptables_t)
 
 libs_use_ld_so(iptables_t)
 libs_use_shared_libs(iptables_t)
@@ -96,10 +99,6 @@
 ')
 
 optional_policy(`
-	nscd_socket_use(iptables_t)
-')
-
-optional_policy(`
 	ppp_dontaudit_use_fds(iptables_t)
 ')


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: [Fwd: [PATCH] refpolicy: system_iptables changes]

[Christopher J. PeBenito]

On Thu, 2007-08-02 at 14:29 -0400, Daniel J Walsh wrote:
> Switch iptables to use nsswitch
> 
> --- nsaserefpolicy/policy/modules/system/iptables.te    2007-07-25
> 10:37:42.000000000 -0400
> +++ serefpolicy-3.0.4/policy/modules/system/iptables.te 2007-07-25
> 12:27:26.000000000 -0400
> @@ -44,6 +44,8 @@
> 
>  corenet_relabelto_all_packets(iptables_t)
> 
> +auth_use_nsswitch(iptables_t)
> +

I applied this part a few lines down

>  dev_read_sysfs(iptables_t)
> 
>  fs_getattr_xattr_fs(iptables_t)
> @@ -62,6 +64,7 @@
>  init_use_script_ptys(iptables_t)
>  # to allow rules to be saved on reboot:
>  init_rw_script_tmp_files(iptables_t)
> +init_rw_script_stream_sockets(iptables_t)

This is weird, what caused this behavior?

-- 
Chris PeBenito
Tresys Technology, LLC
(410) 290-1411 x150


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

Re: [Fwd: [PATCH] refpolicy: system_iptables changes]

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Christopher J. PeBenito wrote:
> On Thu, 2007-08-02 at 14:29 -0400, Daniel J Walsh wrote:
>> Switch iptables to use nsswitch
>>
>> --- nsaserefpolicy/policy/modules/system/iptables.te    2007-07-25
>> 10:37:42.000000000 -0400
>> +++ serefpolicy-3.0.4/policy/modules/system/iptables.te 2007-07-25
>> 12:27:26.000000000 -0400
>> @@ -44,6 +44,8 @@
>>
>>  corenet_relabelto_all_packets(iptables_t)
>>
>> +auth_use_nsswitch(iptables_t)
>> +
> 
> I applied this part a few lines down
> 
>>  dev_read_sysfs(iptables_t)
>>
>>  fs_getattr_xattr_fs(iptables_t)
>> @@ -62,6 +64,7 @@
>>  init_use_script_ptys(iptables_t)
>>  # to allow rules to be saved on reboot:
>>  init_rw_script_tmp_files(iptables_t)
>> +init_rw_script_stream_sockets(iptables_t)
> 
> This is weird, what caused this behavior?
> 
Some firewall tool that execs iptables.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org

iD8DBQFGzKkmrlYvE4MpobMRAjVpAJ9fsuWej8tKcqTObJ21bRtIooItuACfcKmg
9ARrzgIfAFMNwxcgvY6yuAE=
=eIl/
-----END PGP SIGNATURE-----

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.