On Tue, 2 Oct 2007 11:07:09 -0700 Tim Fenn <fenn(a)stanford.edu> wrote:
I recently dove into policy writing, but will rewrite my policy based
on the domain transfer suggestion and report back once I have
something working.
Here is the policy I cooked up:
<policy>
policy_module(mydhcp,1.0.0)
########################################
#
# Declarations
#
require {
type dhcpc_t;
type insmod_t;
type iptables_t;
class rawip_socket { read write };
}
iptables_domtrans(dhcpc_t)
#============= insmod_t ==============
allow insmod_t iptables_t:rawip_socket { read write };
</policy>
Not sure if it would be best to transfer iptables_t to modutils here?
-Tim
--
---------------------------------------------------------
Tim Fenn
fenn(a)stanford.edu
Stanford University, School of Medicine
James H. Clark Center
318 Campus Drive, Room E300
Stanford, CA 94305-5432
Phone: (650) 736-1714
FAX: (650) 736-1961
---------------------------------------------------------