40 lines
1.8 KiB
Diff
40 lines
1.8 KiB
Diff
|
From feefaa074e75466aa75c29f17a3d83ac6ce004f0 Mon Sep 17 00:00:00 2001
|
||
|
|
From: Ondrej Mosnacek <omosnace@redhat.com>
|
||
|
|
Date: Thu, 18 Feb 2021 10:00:12 +0100
|
||
|
|
Subject: [PATCH] iptables.fc: Add missing legacy entries
|
||
|
|
|
||
|
|
The iptables, arptables, and ebtables stack is being deprecated in favor
|
||
|
|
of nftables. For now, netfilter reimplementations of these tools are
|
||
|
|
available for backwards compatibility, but have a diffferent filename
|
||
|
|
now (the main location is now a symlink). Add file context entries for
|
||
|
|
arptables and ebtables; iptables is already covered by the wildcard
|
||
|
|
rule.
|
||
|
|
|
||
|
|
This change fixed several ebtables-related denials for me.
|
||
|
|
|
||
|
|
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
|
||
|
|
---
|
||
|
|
policy/modules/system/iptables.fc | 2 ++
|
||
|
|
1 file changed, 2 insertions(+)
|
||
|
|
|
||
|
|
diff --git a/policy/modules/system/iptables.fc b/policy/modules/system/iptables.fc
|
||
|
|
index 2c19023..9fb2e34 100644
|
||
|
|
--- a/policy/modules/system/iptables.fc
|
||
|
|
+++ b/policy/modules/system/iptables.fc
|
||
|
|
@@ -13,10 +13,12 @@
|
||
|
|
/usr/libexec/ipset -- gen_context(system_u:object_r:iptables_exec_t,s0)
|
||
|
|
|
||
|
|
/usr/sbin/arptables -- gen_context(system_u:object_r:iptables_exec_t,s0)
|
||
|
|
+/usr/sbin/arptables-legacy -- gen_context(system_u:object_r:iptables_exec_t,s0)
|
||
|
|
/usr/sbin/arptables-restore -- gen_context(system_u:object_r:iptables_exec_t,s0)
|
||
|
|
/usr/sbin/arptables-save -- gen_context(system_u:object_r:iptables_exec_t,s0)
|
||
|
|
/usr/sbin/conntrack -- gen_context(system_u:object_r:iptables_exec_t,s0)
|
||
|
|
/usr/sbin/ebtables -- gen_context(system_u:object_r:iptables_exec_t,s0)
|
||
|
|
+/usr/sbin/ebtables-legacy -- gen_context(system_u:object_r:iptables_exec_t,s0)
|
||
|
|
/usr/sbin/ebtables-restore -- gen_context(system_u:object_r:iptables_exec_t,s0)
|
||
|
|
/usr/sbin/ipchains.* -- gen_context(system_u:object_r:iptables_exec_t,s0)
|
||
|
|
/usr/sbin/ip6?tables.* -- gen_context(system_u:object_r:iptables_exec_t,s0)
|
||
|
|
--
|
||
|
|
1.8.3.1
|
||
|
|
|