1*4882a593SmuzhiyunFrom 67394d078c2e1438293b25d08cf408b0b0d55755 Mon Sep 17 00:00:00 2001 2*4882a593SmuzhiyunFrom: Fabrice Fontaine <fontaine.fabrice@gmail.com> 3*4882a593SmuzhiyunDate: Wed, 22 Sep 2021 23:55:59 +0200 4*4882a593SmuzhiyunSubject: [PATCH] policy/modules/services/wireguard.te: make iptables optional 5*4882a593Smuzhiyun 6*4882a593SmuzhiyunMake iptables optional to avoid the following build failure raised since 7*4882a593Smuzhiyunversion 2.20210908 and 8*4882a593Smuzhiyunhttps://github.com/SELinuxProject/refpolicy/commit/7f1a7b1cacd5d211077ce62fbb4e91890e65c820: 9*4882a593Smuzhiyun 10*4882a593Smuzhiyun Compiling targeted policy.33 11*4882a593Smuzhiyun env LD_LIBRARY_PATH="/tmp/instance-0/output-1/host/lib:/tmp/instance-0/output-1/host/usr/lib" /tmp/instance-0/output-1/host/usr/bin/checkpolicy -c 33 -U deny -S -O -E policy.conf -o policy.33 12*4882a593Smuzhiyun policy/modules/services/wireguard.te:66:ERROR 'type iptables_exec_t is not within scope' at token ';' on line 591892: 13*4882a593Smuzhiyun #line 66 14*4882a593Smuzhiyun allow wireguard_t iptables_exec_t:file { getattr open map read execute ioctl }; 15*4882a593Smuzhiyun checkpolicy: error(s) encountered while parsing configuration 16*4882a593Smuzhiyun make[1]: *** [Rules.monolithic:79: policy.33] Error 1 17*4882a593Smuzhiyun 18*4882a593SmuzhiyunFixes: 19*4882a593Smuzhiyun - http://autobuild.buildroot.org/results/a4223accc6adb70b06fd4e74ca4f28484446b6fa 20*4882a593Smuzhiyun 21*4882a593SmuzhiyunSigned-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> 22*4882a593Smuzhiyun[Upstream status: https://github.com/SELinuxProject/refpolicy/pull/408] 23*4882a593Smuzhiyun--- 24*4882a593Smuzhiyun policy/modules/services/wireguard.te | 10 ++++++---- 25*4882a593Smuzhiyun 1 file changed, 6 insertions(+), 4 deletions(-) 26*4882a593Smuzhiyun 27*4882a593Smuzhiyundiff --git a/policy/modules/services/wireguard.te b/policy/modules/services/wireguard.te 28*4882a593Smuzhiyunindex 7241f65e6..33fd3c55d 100644 29*4882a593Smuzhiyun--- a/policy/modules/services/wireguard.te 30*4882a593Smuzhiyun+++ b/policy/modules/services/wireguard.te 31*4882a593Smuzhiyun@@ -61,10 +61,6 @@ corecmd_exec_shell(wireguard_t) 32*4882a593Smuzhiyun 33*4882a593Smuzhiyun domain_use_interactive_fds(wireguard_t) 34*4882a593Smuzhiyun 35*4882a593Smuzhiyun-# wg-quick can be configured to run iptables and other networking 36*4882a593Smuzhiyun-# config tools when bringing up/down the wg interfaces 37*4882a593Smuzhiyun-iptables_domtrans(wireguard_t) 38*4882a593Smuzhiyun- 39*4882a593Smuzhiyun # wg-quick tries to read /proc/filesystem when running "stat" and "mv" commands 40*4882a593Smuzhiyun kernel_dontaudit_read_system_state(wireguard_t) 41*4882a593Smuzhiyun kernel_dontaudit_search_kernel_sysctl(wireguard_t) 42*4882a593Smuzhiyun@@ -75,3 +71,9 @@ miscfiles_read_localization(wireguard_t) 43*4882a593Smuzhiyun sysnet_run_ifconfig(wireguard_t, wireguard_roles) 44*4882a593Smuzhiyun 45*4882a593Smuzhiyun userdom_use_user_terminals(wireguard_t) 46*4882a593Smuzhiyun+ 47*4882a593Smuzhiyun+# wg-quick can be configured to run iptables and other networking 48*4882a593Smuzhiyun+# config tools when bringing up/down the wg interfaces 49*4882a593Smuzhiyun+optional_policy(` 50*4882a593Smuzhiyun+ iptables_domtrans(wireguard_t) 51*4882a593Smuzhiyun+') 52*4882a593Smuzhiyun-- 53*4882a593Smuzhiyun2.33.0 54*4882a593Smuzhiyun 55