iptables_selinux(8)

1iptables_selinux(8)         SELinux Policy iptables        iptables_selinux(8)
2
3
4

NAME

6       iptables_selinux - Security Enhanced Linux Policy for the iptables pro‐
7       cesses
8

DESCRIPTION

10       Security-Enhanced Linux secures the  iptables  processes  via  flexible
11       mandatory access control.
12
13       The  iptables  processes  execute with the iptables_t SELinux type. You
14       can check if you have these processes running by executing the ps  com‐
15       mand with the -Z qualifier.
16
17       For example:
18
19       ps -eZ | grep iptables_t
20
21
22

ENTRYPOINTS

24       The iptables_t SELinux type can be entered via the iptables_exec_t file
25       type.
26
27       The default entrypoint paths for the iptables_t domain are the  follow‐
28       ing:
29
30       /sbin/ip6?tables.*,     /sbin/ip6?tables-multi.*,     /sbin/ip6?tables-
31       restore.*,    /usr/sbin/ip6?tables.*,     /usr/sbin/ip6?tables-multi.*,
32       /usr/sbin/ip6?tables-restore.*, /sbin/ipchains.*, /usr/sbin/ipchains.*,
33       /usr/libexec/iptables/iptables.init,                 /usr/libexec/ipta‐
34       bles/ip6tables.init, /sbin/nft, /sbin/ipset, /sbin/ipvsadm, /sbin/ebta‐
35       bles,     /sbin/arptables,     /usr/sbin/ipset,      /usr/sbin/ipvsadm,
36       /sbin/ipvsadm-save,  /usr/libexec/ipset, /usr/sbin/ebtables, /sbin/xta‐
37       bles-multi, /usr/sbin/arptables, /usr/sbin/conntrack,  /sbin/arptables-
38       save, /sbin/ipvsadm-restore, /sbin/ebtables-restore, /usr/sbin/ipvsadm-
39       save, /sbin/arptables-restore, /sbin/xtables-nft-multi,  /usr/sbin/xta‐
40       bles-multi,    /usr/sbin/ipvsadm-restore,   /sbin/xtables-legacy-multi,
41       /usr/sbin/ebtables-restore, /usr/sbin/xtables-nft-multi, /usr/sbin/xta‐
42       bles-legacy-multi
43

PROCESS TYPES

45       SELinux defines process types (domains) for each process running on the
46       system
47
48       You can see the context of a process using the -Z option to ps
49
50       Policy governs the access confined processes have  to  files.   SELinux
51       iptables policy is very flexible allowing users to setup their iptables
52       processes in as secure a method as possible.
53
54       The following process types are defined for iptables:
55
56       iptables_t
57
58       Note: semanage permissive -a iptables_t can be used to make the process
59       type  iptables_t permissive. SELinux does not deny access to permissive
60       process types, but the AVC (SELinux denials) messages are still  gener‐
61       ated.
62
63

BOOLEANS

65       SELinux  policy  is customizable based on least access required.  ipta‐
66       bles policy is extremely flexible and has several booleans  that  allow
67       you  to manipulate the policy and run iptables with the tightest access
68       possible.
69
70
71
72       If you want to allow users to resolve user passwd entries directly from
73       ldap  rather  then  using  a  sssd server, you must turn on the authlo‐
74       gin_nsswitch_use_ldap boolean. Disabled by default.
75
76       setsebool -P authlogin_nsswitch_use_ldap 1
77
78
79
80       If you want to allow dhcpc client applications to execute iptables com‐
81       mands,  you  must  turn on the dhcpc_exec_iptables boolean. Disabled by
82       default.
83
84       setsebool -P dhcpc_exec_iptables 1
85
86
87
88       If you want to allow all domains to execute in fips_mode, you must turn
89       on the fips_mode boolean. Enabled by default.
90
91       setsebool -P fips_mode 1
92
93
94
95       If  you  want  to allow confined applications to run with kerberos, you
96       must turn on the kerberos_enabled boolean. Enabled by default.
97
98       setsebool -P kerberos_enabled 1
99
100
101
102       If you want to allow system to run with  NIS,  you  must  turn  on  the
103       nis_enabled boolean. Disabled by default.
104
105       setsebool -P nis_enabled 1
106
107
108
109       If  you  want to allow confined applications to use nscd shared memory,
110       you must turn on the nscd_use_shm boolean. Disabled by default.
111
112       setsebool -P nscd_use_shm 1
113
114
115

MANAGED FILES

117       The SELinux process type iptables_t can manage files labeled  with  the
118       following file types.  The paths listed are the default paths for these
119       file types.  Note the processes UID still need to have DAC permissions.
120
121       etc_runtime_t
122
123            /[^/]+
124            /etc/mtab.*
125            /etc/blkid(/.*)?
126            /etc/nologin.*
127            /etc/.fstab.hal..+
128            /halt
129            /fastboot
130            /poweroff
131            /.autofsck
132            /etc/cmtab
133            /forcefsck
134            /.suspended
135            /fsckoptions
136            /.autorelabel
137            /etc/.updated
138            /var/.updated
139            /etc/killpower
140            /etc/nohotplug
141            /etc/securetty
142            /etc/ioctl.save
143            /etc/fstab.REVOKE
144            /etc/network/ifstate
145            /etc/sysconfig/hwconf
146            /etc/ptal/ptal-printd-like
147            /etc/sysconfig/iptables.save
148            /etc/xorg.conf.d/00-system-setup-keyboard.conf
149            /etc/X11/xorg.conf.d/00-system-setup-keyboard.conf
150
151       initrc_tmp_t
152
153
154       iptables_lock_t
155
156            /var/lock/subsys/iptables
157            /var/lock/subsys/ip6tables
158
159       iptables_tmp_t
160
161
162       iptables_var_lib_t
163
164            /var/lib/ebtables(/.*)?
165
166       iptables_var_run_t
167
168            /var/run/xtables.*
169            /var/run/ebtables.*
170
171       psad_tmp_t
172
173
174       psad_var_log_t
175
176            /var/log/psad(/.*)?
177
178       shorewall_var_lib_t
179
180            /var/lib/shorewall(/.*)?
181            /var/lib/shorewall6(/.*)?
182            /var/lib/shorewall-lite(/.*)?
183
184       system_conf_t
185
186            /ostree/repo(/.*)?
187            /etc/yum.repos.d(/.*)?
188            /etc/sysctl.conf(.old)?
189            /etc/sysconfig/ip6?tables.*
190            /etc/ostree/remotes.d(/.*)?
191            /etc/sysconfig/ipvsadm.*
192            /etc/sysconfig/ebtables.*
193            /etc/sysconfig/system-config-firewall.*
194            /ostree/deploy/rhel-atomic-host/deploy(/.*)?
195
196

FILE CONTEXTS

198       SELinux requires files to have an extended attribute to define the file
199       type.
200
201       You can see the context of a file using the -Z option to ls
202
203       Policy  governs  the  access  confined  processes  have to these files.
204       SELinux iptables policy is very flexible allowing users to setup  their
205       iptables processes in as secure a method as possible.
206
207       STANDARD FILE CONTEXT
208
209       SELinux  defines the file context types for the iptables, if you wanted
210       to store files with these types in a diffent paths, you need to execute
211       the  semanage  command  to  sepecify  alternate  labeling  and then use
212       restorecon to put the labels on disk.
213
214       semanage  fcontext  -a  -t  iptables_unit_file_t  '/srv/myiptables_con‐
215       tent(/.*)?'
216       restorecon -R -v /srv/myiptables_content
217
218       Note:  SELinux  often  uses  regular expressions to specify labels that
219       match multiple files.
220
221       The following file types are defined for iptables:
222
223
224
225       iptables_exec_t
226
227       - Set files with the iptables_exec_t type, if you want to transition an
228       executable to the iptables_t domain.
229
230
231       Paths:
232            /sbin/ip6?tables.*,   /sbin/ip6?tables-multi.*,  /sbin/ip6?tables-
233            restore.*,  /usr/sbin/ip6?tables.*,  /usr/sbin/ip6?tables-multi.*,
234            /usr/sbin/ip6?tables-restore.*,                  /sbin/ipchains.*,
235            /usr/sbin/ipchains.*,         /usr/libexec/iptables/iptables.init,
236            /usr/libexec/iptables/ip6tables.init,    /sbin/nft,   /sbin/ipset,
237            /sbin/ipvsadm, /sbin/ebtables,  /sbin/arptables,  /usr/sbin/ipset,
238            /usr/sbin/ipvsadm,     /sbin/ipvsadm-save,     /usr/libexec/ipset,
239            /usr/sbin/ebtables,   /sbin/xtables-multi,    /usr/sbin/arptables,
240            /usr/sbin/conntrack,  /sbin/arptables-save, /sbin/ipvsadm-restore,
241            /sbin/ebtables-restore,  /usr/sbin/ipvsadm-save,  /sbin/arptables-
242            restore,     /sbin/xtables-nft-multi,     /usr/sbin/xtables-multi,
243            /usr/sbin/ipvsadm-restore,             /sbin/xtables-legacy-multi,
244            /usr/sbin/ebtables-restore,           /usr/sbin/xtables-nft-multi,
245            /usr/sbin/xtables-legacy-multi
246
247
248       iptables_initrc_exec_t
249
250       - Set files with the iptables_initrc_exec_t type, if you want to  tran‐
251       sition an executable to the iptables_initrc_t domain.
252
253
254       Paths:
255            /etc/rc.d/init.d/ip6?tables,            /etc/rc.d/init.d/ebtables,
256            /etc/rc.d/init.d/nftables
257
258
259       iptables_lock_t
260
261       - Set files with the iptables_lock_t type, if you  want  to  treat  the
262       files as iptables lock data, stored under the /var/lock directory
263
264
265       Paths:
266            /var/lock/subsys/iptables, /var/lock/subsys/ip6tables
267
268
269       iptables_tmp_t
270
271       - Set files with the iptables_tmp_t type, if you want to store iptables
272       temporary files in the /tmp directories.
273
274
275
276       iptables_unit_file_t
277
278       - Set files with the iptables_unit_file_t type, if you  want  to  treat
279       the files as iptables unit content.
280
281
282       Paths:
283            /usr/lib/systemd/system/ppp.*,    /usr/lib/systemd/system/ipset.*,
284            /usr/lib/systemd/system/vsftpd.*,            /usr/lib/systemd/sys‐
285            tem/proftpd.*,  /usr/lib/systemd/system/iptables.*,  /usr/lib/sys‐
286            temd/system/arptables.*, /usr/lib/systemd/system/ip6tables.*
287
288
289       iptables_var_lib_t
290
291       - Set files with the iptables_var_lib_t type, if you want to store  the
292       iptables files under the /var/lib directory.
293
294
295
296       iptables_var_run_t
297
298       -  Set files with the iptables_var_run_t type, if you want to store the
299       iptables files under the /run or /var/run directory.
300
301
302       Paths:
303            /var/run/xtables.*, /var/run/ebtables.*
304
305
306       Note: File context can be temporarily modified with the chcon  command.
307       If  you want to permanently change the file context you need to use the
308       semanage fcontext command.  This will modify the SELinux labeling data‐
309       base.  You will need to use restorecon to apply the labels.
310
311

COMMANDS

313       semanage  fcontext  can also be used to manipulate default file context
314       mappings.
315
316       semanage permissive can also be used to manipulate  whether  or  not  a
317       process type is permissive.
318
319       semanage  module can also be used to enable/disable/install/remove pol‐
320       icy modules.
321
322       semanage boolean can also be used to manipulate the booleans
323
324
325       system-config-selinux is a GUI tool available to customize SELinux pol‐
326       icy settings.
327
328

AUTHOR

330       This manual page was auto-generated using sepolicy manpage .
331
332