From feefaa074e75466aa75c29f17a3d83ac6ce004f0 Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Thu, 18 Feb 2021 10:00:12 +0100 Subject: [PATCH] iptables.fc: Add missing legacy entries The iptables, arptables, and ebtables stack is being deprecated in favor of nftables. For now, netfilter reimplementations of these tools are available for backwards compatibility, but have a diffferent filename now (the main location is now a symlink). Add file context entries for arptables and ebtables; iptables is already covered by the wildcard rule. This change fixed several ebtables-related denials for me. Signed-off-by: Ondrej Mosnacek --- policy/modules/system/iptables.fc | 2 ++ 1 file changed, 2 insertions(+) diff --git a/policy/modules/system/iptables.fc b/policy/modules/system/iptables.fc index 2c19023..9fb2e34 100644 --- a/policy/modules/system/iptables.fc +++ b/policy/modules/system/iptables.fc @@ -13,10 +13,12 @@ /usr/libexec/ipset -- gen_context(system_u:object_r:iptables_exec_t,s0) /usr/sbin/arptables -- gen_context(system_u:object_r:iptables_exec_t,s0) +/usr/sbin/arptables-legacy -- gen_context(system_u:object_r:iptables_exec_t,s0) /usr/sbin/arptables-restore -- gen_context(system_u:object_r:iptables_exec_t,s0) /usr/sbin/arptables-save -- gen_context(system_u:object_r:iptables_exec_t,s0) /usr/sbin/conntrack -- gen_context(system_u:object_r:iptables_exec_t,s0) /usr/sbin/ebtables -- gen_context(system_u:object_r:iptables_exec_t,s0) +/usr/sbin/ebtables-legacy -- gen_context(system_u:object_r:iptables_exec_t,s0) /usr/sbin/ebtables-restore -- gen_context(system_u:object_r:iptables_exec_t,s0) /usr/sbin/ipchains.* -- gen_context(system_u:object_r:iptables_exec_t,s0) /usr/sbin/ip6?tables.* -- gen_context(system_u:object_r:iptables_exec_t,s0) -- 1.8.3.1