From feefaa074e75466aa75c29f17a3d83ac6ce004f0 Mon Sep 17 00:00:00 2001
From: Ondrej Mosnacek <omosnace@redhat.com>
Date: Thu, 18 Feb 2021 10:00:12 +0100
Subject: [PATCH] iptables.fc: Add missing legacy entries

The iptables, arptables, and ebtables stack is being deprecated in favor
of nftables. For now, netfilter reimplementations of these tools are
available for backwards compatibility, but have a diffferent filename
now (the main location is now a symlink). Add file context entries for
arptables and ebtables; iptables is already covered by the wildcard
rule.

This change fixed several ebtables-related denials for me.

Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
---
 policy/modules/system/iptables.fc | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/policy/modules/system/iptables.fc b/policy/modules/system/iptables.fc
index 2c19023..9fb2e34 100644
--- a/policy/modules/system/iptables.fc
+++ b/policy/modules/system/iptables.fc
@@ -13,10 +13,12 @@
 /usr/libexec/ipset          --  gen_context(system_u:object_r:iptables_exec_t,s0)
 
 /usr/sbin/arptables         --  gen_context(system_u:object_r:iptables_exec_t,s0)
+/usr/sbin/arptables-legacy      --  gen_context(system_u:object_r:iptables_exec_t,s0)
 /usr/sbin/arptables-restore     --  gen_context(system_u:object_r:iptables_exec_t,s0)
 /usr/sbin/arptables-save        --  gen_context(system_u:object_r:iptables_exec_t,s0)
 /usr/sbin/conntrack		    --	gen_context(system_u:object_r:iptables_exec_t,s0)
 /usr/sbin/ebtables		    --	gen_context(system_u:object_r:iptables_exec_t,s0)
+/usr/sbin/ebtables-legacy	    --	gen_context(system_u:object_r:iptables_exec_t,s0)
 /usr/sbin/ebtables-restore	--	gen_context(system_u:object_r:iptables_exec_t,s0)
 /usr/sbin/ipchains.*		--	gen_context(system_u:object_r:iptables_exec_t,s0)
 /usr/sbin/ip6?tables.*		--	gen_context(system_u:object_r:iptables_exec_t,s0)
-- 
1.8.3.1