Blame policy/modules/system/iptables.if
|
Chris PeBenito |
17de1b7 |
## <summary>Policy for iptables.</summary>
|
|
Chris PeBenito |
17de1b7 |
|
|
Chris PeBenito |
17de1b7 |
########################################
|
|
Chris PeBenito |
17de1b7 |
## <summary>
|
|
Chris PeBenito |
17de1b7 |
## Execute iptables in the iptables domain.
|
|
Chris PeBenito |
17de1b7 |
## </summary>
|
|
Chris PeBenito |
17de1b7 |
## <param name="domain">
|
|
Chris PeBenito |
17de1b7 |
## <summary>
|
|
Chris PeBenito |
17de1b7 |
## Domain allowed access.
|
|
Chris PeBenito |
17de1b7 |
## </summary>
|
|
Chris PeBenito |
17de1b7 |
## </param>
|
|
Chris PeBenito |
17de1b7 |
#
|
|
Chris PeBenito |
17de1b7 |
interface(`iptables_domtrans',`
|
|
Chris PeBenito |
17de1b7 |
gen_require(`
|
|
Chris PeBenito |
17de1b7 |
type iptables_t, iptables_exec_t;
|
|
Chris PeBenito |
17de1b7 |
')
|
|
Chris PeBenito |
17de1b7 |
|
|
Chris PeBenito |
8021cb4 |
corecmd_search_bin($1)
|
|
Chris PeBenito |
c0868a7 |
domtrans_pattern($1,iptables_exec_t,iptables_t)
|
|
Chris PeBenito |
17de1b7 |
')
|
|
Chris PeBenito |
17de1b7 |
|
|
Chris PeBenito |
17de1b7 |
########################################
|
|
Chris PeBenito |
17de1b7 |
## <summary>
|
|
Chris PeBenito |
17de1b7 |
## Execute iptables in the iptables domain, and
|
|
Chris PeBenito |
17de1b7 |
## allow the specified role the iptables domain.
|
|
Chris PeBenito |
17de1b7 |
## </summary>
|
|
Chris PeBenito |
17de1b7 |
## <param name="domain">
|
|
Chris PeBenito |
17de1b7 |
## <summary>
|
|
Chris PeBenito |
17de1b7 |
## Domain allowed access.
|
|
Chris PeBenito |
17de1b7 |
## </summary>
|
|
Chris PeBenito |
17de1b7 |
## </param>
|
|
Chris PeBenito |
17de1b7 |
## <param name="role">
|
|
Chris PeBenito |
17de1b7 |
## <summary>
|
|
Chris PeBenito |
17de1b7 |
## The role to be allowed the iptables domain.
|
|
Chris PeBenito |
17de1b7 |
## </summary>
|
|
Chris PeBenito |
17de1b7 |
## </param>
|
|
Chris PeBenito |
bbcd3c9 |
## <rolecap/>
|
|
Chris PeBenito |
17de1b7 |
#
|
|
Chris PeBenito |
17de1b7 |
interface(`iptables_run',`
|
|
Chris PeBenito |
17de1b7 |
gen_require(`
|
|
Chris PeBenito |
17de1b7 |
type iptables_t;
|
|
Chris PeBenito |
17de1b7 |
')
|
|
Chris PeBenito |
17de1b7 |
|
|
Chris PeBenito |
17de1b7 |
iptables_domtrans($1)
|
|
Chris PeBenito |
17de1b7 |
role $2 types iptables_t;
|
|
Chris PeBenito |
770c015 |
|
|
Chris PeBenito |
296273a |
sysnet_run_ifconfig(iptables_t, $2)
|
|
Chris PeBenito |
770c015 |
|
|
Chris PeBenito |
770c015 |
optional_policy(`
|
|
Chris PeBenito |
296273a |
modutils_run_insmod(iptables_t, $2)
|
|
Chris PeBenito |
770c015 |
')
|
|
Chris PeBenito |
17de1b7 |
')
|
|
Chris PeBenito |
17de1b7 |
|
|
Chris PeBenito |
17de1b7 |
########################################
|
|
Chris PeBenito |
17de1b7 |
## <summary>
|
|
Chris PeBenito |
17de1b7 |
## Execute iptables in the caller domain.
|
|
Chris PeBenito |
17de1b7 |
## </summary>
|
|
Chris PeBenito |
17de1b7 |
## <param name="domain">
|
|
Chris PeBenito |
17de1b7 |
## <summary>
|
|
Chris PeBenito |
17de1b7 |
## Domain allowed access.
|
|
Chris PeBenito |
17de1b7 |
## </summary>
|
|
Chris PeBenito |
17de1b7 |
## </param>
|
|
Chris PeBenito |
17de1b7 |
#
|
|
Chris PeBenito |
17de1b7 |
interface(`iptables_exec',`
|
|
Chris PeBenito |
17de1b7 |
gen_require(`
|
|
Chris PeBenito |
17de1b7 |
type iptables_exec_t;
|
|
Chris PeBenito |
17de1b7 |
')
|
|
Chris PeBenito |
17de1b7 |
|
|
Chris PeBenito |
8021cb4 |
corecmd_search_bin($1)
|
|
Chris PeBenito |
17de1b7 |
can_exec($1,iptables_exec_t)
|
|
Chris PeBenito |
17de1b7 |
')
|