Signed-off-by: Dave Sugar <dsugar@xxxxxxxxxx> --- policy/modules/system/iptables.if | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/policy/modules/system/iptables.if b/policy/modules/system/iptables.if index 7d8f1821..725a6a3d 100644 --- a/policy/modules/system/iptables.if +++ b/policy/modules/system/iptables.if @@ -183,6 +183,25 @@ interface(`iptables_dontaudit_read_pids',` dontaudit $1 iptables_runtime_t:file read; ') +######################################## +## <summary> +## Allow specified domain to get status of iptables service +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`iptables_status',` + gen_require(` + type iptables_unit_t; + class service status; + ') + + allow $1 iptables_unit_t:service status; +') + ######################################## ## <summary> ## All of the rules required to -- 2.20.1
